Regulations › Rest of world › United Arab Emirates
DIFC DPL
Data Protection Law, DIFC Law No. 5 of 2020
WhenIn effect since 1 July 2020
Who enforces itCommissioner of Data Protection, DIFC
Who it applies toControllers and processors in the Dubai International Financial Centre, and processing of personal data there.
Tell the regulatorNotify the Commissioner as soon as practicable in the circumstances
DPO requiredDPO required for DIFC Bodies and for controllers or processors performing high-risk processing…
RegistrationControllers and processors must register by filing a notification of processing with the Commi…
Transfers abroadTransfer if destination has adequate protection or with appropriate safeguards, or listed dero…
Request deadlineRespond within one month, extendable by two months for complex or numerous requests
Maximum fineAdministrative fines up to USD 100,000 per standard contravention under Schedule 2
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
Applies to controllers or processors incorporated in DIFC, and to processing in DIFC including through stable arrangements, wherever the controller sits.Art. 6(3) · source ↗
2025 amendment clarified reach over non-DIFC entities processing DIFC data via stable arrangements.
Lawful basis
1
Multiple bases including consent, contract, legal obligation, vital interests and legitimate interests.Art. 10 · source ↗
Consent
2
Consent must be freely given by a clear affirmative act, specific and informed; withdrawal as easy as giving it.Art. 12 · source ↗
Sensitive data
2
Special categories may not be processed unless a listed condition, such as explicit consent, applies.Art. 11 · source ↗
Children
0
No children's consent age; minors are excluded from certain automated-decision exceptions.Art. 38(4) · source ↗
People's rights
Rights
3
Withdraw consent, access, rectification, erasure, objection (incl. direct marketing), restriction, portability and automated-decision rights.Arts. 32-38 · source ↗
Request deadline
2
Respond within one month, extendable by two months for complex or numerous requests.Art. 33(1), (7) · source ↗
Marketing
1
Inform subjects before first disclosure for marketing and honor the right to object at any time, offered by the first communication.Art. 34(1)(b)-(c), (4) · source ↗
Governance
DPO required
1
DPO required for DIFC Bodies and for controllers or processors performing high-risk processing on a systematic or regular basis.Art. 16(2) · source ↗
DPO qualifications
2
DPO must know the law, be independent and reside in the UAE unless a group employee in an international role.Arts. 16(7), 17 · source ↗
Registration
2
Controllers and processors must register by filing a notification of processing with the Commissioner, kept up to date, with fees.Art. 14(7)-(8) · source ↗
Fee amounts set by DIFCA Board Regulations, not in the Law.
DPIA
2
DPIA required before high-risk processing; consult the Commissioner if high residual risk remains.Arts. 20(1), 21(1) · source ↗
Failure to do a DPIA: USD 50,000 fine after 2025 amendment (Mondaq).
Records
2
Controllers must keep a written record of processing activities, which may be electronic.Art. 15(1) · source ↗
Retention
2
Keep data no longer than necessary; when the basis ends, delete, anonymize, pseudonymize, encrypt or put it beyond use.Arts. 9(1)(i), 22(1) · source ↗
Breaches
Tell the regulator
1
Notify the Commissioner as soon as practicable in the circumstances; no fixed hours.Art. 41(1) · source ↗
Tell people
2
Notify data subjects as soon as practicable where the breach is likely to result in high risk.Art. 42(1) · source ↗
Transfers
Transfers abroad
2
Transfer if destination has adequate protection or with appropriate safeguards, or listed derogations.Arts. 26-27 · source ↗
Enforcement
Maximum fine
2
Administrative fines up to USD 100,000 per standard contravention under Schedule 2.Art. 62; Schedule 2 · secondary source · source ↗
Fine schedule not readable in fetched text. Secondary source reports scope for larger fines for serious violations; 2025 amendment set USD 25,000-50,000 tiers for listed failures.
Criminal liability
0
No criminal offences identified; enforcement is by administrative fines and directions.Not addressed · secondary source · source ↗
Penalty part of the Law not visible in fetched text.
Private action
2
Data subjects may sue directly in DIFC Courts for financial and non-financial harm, including distress.Art. 64A · secondary source · source ↗
Added by DIFC Laws Amendment Law No. 1 of 2025.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws