The DIFC Data Protection Law is the privacy law of the Dubai International Financial Centre, a financial free zone with its own legal system. It is modelled on international data protection law and puts duties on controllers and processors, gives rights to data subjects and is enforced by the DIFC Commissioner of Data Protection. The Regulations add detail on records, notification, breach reporting, digital marketing and autonomous systems such as AI.
Free account needed to download. You come straight back to the file.
Who it is for. Controllers and processors incorporated in the DIFC, wherever they process, and any controller or processor, wherever incorporated, that processes personal data in the DIFC as part of stable arrangements. DIFC Bodies are covered too.
What this list covers. Data Protection Law, DIFC Law No. 5 of 2020, Consolidated Version (July 2025), as amended by DIFC Laws Amendment Law No. 2 of 2022 and No. 1 of 2025, and the Data Protection Regulations, Consolidated Version No. 2 (in force 1 September 2023), both read as published by DIFC. DIFC may amend either text, so check its Legal Database for later changes: 172 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Art. 6 | Who the Law covers | The Law applies in the DIFC to automated processing and to filed manual records. It covers controllers and processors incorporated in the DIFC wherever they process, and others processing in the DIFC through stable arrangements. Private household use is out. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 9(1)(a)-(b) | Lawful, fair and transparent | Process personal data only on a lawful basis from Article 10, fairly, and in a way people can understand and see coming. |
| Art. 9(1)(c)-(d) | Purpose limitation | Decide on clear, legitimate purposes when you collect data, state them, and do not later use the data in ways that do not fit those purposes. |
| Art. 9(1)(e) | Ready access to data | Keep personal data organised so you can find it quickly when you need to show compliance, handle a person's request or answer the Commissioner. |
| Art. 9(1)(f) | Data minimisation | Collect and keep only the personal data that is relevant and needed for the purposes you stated. |
| Art. 9(1)(g) | Honour data subject rights | Run every processing activity so that the rights people have under the Law, from consent withdrawal to portability, can in fact be exercised. |
| Art. 9(1)(h) | Accuracy | Keep personal data accurate and current. Where it is wrong or stale, correct or erase it without undue delay. |
| Art. 9(1)(i) | Storage limitation | Keep data in a form that identifies people only for as long as the purposes need, then delete or anonymise it. |
| Art. 9(1)(j) | Security of processing | Protect personal data from unauthorised or unlawful processing, including transfers, and from accidental loss, destruction or damage, using suitable technical and organisational measures. |
| Art. 9(2) | Accountability for the principles | Take responsibility for each of the Article 9(1) principles, and be able to show the Commissioner that you meet them. |
| Art. 10(a)-(d) | Lawful bases | Before processing, identify one lawful basis: valid consent, a contract with the person, a legal requirement, or protecting someone's vital interests. Record which one you rely on. |
| Art. 10(e) | Lawful basis for DIFC Bodies | DIFC Bodies may process where needed for a task in the DIFC's interests or to use their powers and functions, including powers they have passed to a third party who receives the data. |
| Art. 10(f) | Legitimate interests | You may rely on your own or a third party's legitimate interests only where the person's interests and rights do not outweigh them, and subject to Article 13. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 11 | Special categories of data | Treat racial or ethnic origin, political or religious views, criminal record, union membership, health, sex life, genetic and identifying biometric data as special. Meet Article 10 plus a ground in Article 11, such as explicit consent. |
| Art. 11(g) | Notice when a law requires the processing | If you process special category data because a specific legal requirement obliges you to, tell the person clearly as soon as reasonably practicable, unless that law forbids telling them. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 12(1) | Consent must be real | Obtain consent by a clear positive act that shows the person agrees. It is not free where a service is conditional on consent for processing it does not need, or for excessive data. |
| Art. 12(2) | Prove consent | Where consent is your basis, keep evidence that the person gave it freely. |
| Art. 12(3)-(4) | Separate purposes and separate requests | Ask for consent for each purpose separately and in plain language. If the same request covers other matters, make the data protection request stand out from them. |
| Art. 12(5) | Withdrawal must be easy | Tell people when they consent that they can withdraw and how. Withdrawal must be no harder than giving consent, and earlier processing stays lawful. |
| Art. 12(6)-(8) | Check consent stays valid | For ongoing processing, regularly judge whether the person would still expect it to continue. If not, ask them promptly to reaffirm. Silence after a reasonable period counts as withdrawal. |
| Art. 12(9) | Consent records and reviews | Be able to show the Commissioner that you have working methods to record consent and withdrawals, and that you review them periodically. |
| Art. 12(10) | Periodic refresh of consent | Where processing is not a one-off and continues on consent, give people a regular chance to reaffirm or withdraw. |
| Art. 12(11)-(12) | Single discrete incidents | A single transaction or one-off, clearly bounded purpose with a definable end is a single discrete incident. The Article 12 rules still apply to it, except the ongoing-validity and periodic-refresh steps. |
| Art. 13 | Limits on legitimate interests | Public authorities cannot use legitimate interests as a basis. Intra-group transfers for internal administration, and fraud prevention or network security that is necessary and proportionate, can qualify. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 14(1) | Compliance programme | Run a programme that shows you comply with the Law. Its depth should match your size and resources, the data categories you handle and the risks to people. |
| Art. 14(2)(a)-(b) | Security measures matched to risk | Choose technical and organisational measures after weighing the processing context, the risks to people and good industry security practice, covering loss, alteration, disclosure and unlawful access. |
| Art. 14(2)(c) | Necessary data only, by default | Configure systems so that by default only the data needed for each purpose is processed, in amount, extent, retention period and who can access it. |
| Art. 14(2)(d) | Keep measures current | Review and update your measures as the law, your operations and technology change. |
| Art. 14(3) | Data protection by design and default | Build compliance into processing from the point you choose the means, reinforce principles like minimisation, and do not make data visible to an unlimited audience without the person's action. |
| Art. 14(4) | Privacy defaults for online platforms | If you offer online services through a platform, set defaults to the minimum data needed, prompt users to choose privacy preferences on first use, and make them easy to change. |
| Art. 14(5) | Written data protection policy | Keep a written data protection policy that fits the scale and kind of your processing and is consistent with the Law. |
| Art. 14(6) | Codes and certification as evidence | Adherence to an approved code of conduct (Article 48) or certification scheme (Article 50) is treated as meeting the Article 14 duties. |
| Art. 14(7)-(8) | Notify the Commissioner of processing | Register with the Commissioner by notifying your processing operations and keep it current through amended notifications. Notifications go on a public register and attract a fee. |
| Art. 15(1) | Controller's record of processing | Keep a written record of processing, covering contacts, purposes, data subject and data categories, recipients, transfers and safeguards, retention periods and security measures. |
| Art. 15(2) | Processor's record of processing | A processor keeps its own written record of all processing it carries out for a controller, with the same details as the controller's record. |
| Art. 16(1)-(2) | When a DPO is compulsory | Appoint a DPO if you are a DIFC Body (courts acting judicially excepted) or you regularly and systematically carry out high risk processing. Any other controller or processor may choose to appoint one. |
| Art. 16(3) | Commissioner may order a DPO | The Commissioner can require a controller or processor outside the compulsory cases to designate a DPO. |
| Art. 16(4) | Allocate responsibility without a DPO | If you need no DPO, assign clear responsibility for data protection within the organisation and be ready to give the Commissioner the names on request. |
| Art. 16(5)-(7) | Who may be the DPO | A DPO may be staff, a group employee or an outside provider, and one DPO can serve a group if reachable from every entity. The DPO must live in the UAE unless a group employee doing the role internationally. |
| Art. 16(8) | Publish DPO contact details | Make your DPO's contact details easy for the public to find, and confirm the DPO's identity to the Commissioner in writing if asked. |
| Art. 17(1)-(2) | DPO competence and independence | Your DPO must know the Law, be able to do the Article 18 tasks, act independently on their own authority, report to senior management, and have enough resources and access to information. |
| Art. 17(3) | DPO cooperation with the Commissioner | The DPO cooperates openly with the Commissioner and passes on relevant information, except where privilege or another legal duty of non-disclosure applies. |
| Art. 17(4) | DPO holding other roles | A DPO may hold other roles and tasks, provided they do not conflict with the DPO duties. |
| Art. 18(1) | Support the DPO | Involve the DPO promptly in every data protection issue, give them enough resources, let them act independently, and avoid extra duties that create a conflict of interest. |
| Art. 18(2) | People can contact the DPO | Let individuals contact your DPO about any matter concerning their data and the exercise of their rights. |
| Art. 18(3) | Tasks of the DPO | The DPO monitors compliance with the Law and your policies including training and audits, advises staff, advises on impact assessments, cooperates with the Commissioner and acts as its contact point. |
| Art. 19 | Annual assessment to the Commissioner | Where a DPO is compulsory, have the DPO assess your processing each year, say whether you plan high risk processing next year, and submit it in the format and by the deadline the Commissioner publishes. |
| Art. 20(1) | Impact assessment before high risk processing | Before starting high risk processing, assess its impact on personal data protection and the risks to people. You may also assess processing that is not high risk. |
| Art. 20(2)-(3) | Shared assessments and DPO oversight | One assessment can cover similar operations, or rely on a current group assessment of the same processing. The DPO, where appointed, oversees impact assessments. |
| Art. 20(4)-(5) | Commissioner's lists | The Commissioner may publish lists of processing that counts as high risk, and of processing that needs no impact assessment. A list does not remove your duty to comply with the Law. |
| Art. 20(6) | What an assessment must contain | Describe the processing and purposes, assess necessity and proportionality, test the lawful basis, assess the risks to people, and set out the safeguards and security measures to address them. |
| Art. 20(7)-(8) | Codes and people's views | Take account of any approved code of conduct you follow, and where appropriate ask the affected people or their representatives for input, weighing commercial, public and security interests. |
| Art. 20(9) | When a fresh assessment is not needed | Where processing rests on a legal obligation or public task and an impact assessment was already done when that law was adopted, you need no new one, unless the law requires it. |
| Art. 20(10) | Review the assessment | Review whether processing follows the assessment, regularly in proportion to its scale, and whenever the risk changes. |
| Art. 20(11) | Processor helps with assessments | A processor, including one being appointed, provides the information a controller reasonably asks for to complete an impact assessment. |
| Art. 21(1)-(2) | Prior consultation | If an assessment shows risks to people remain particularly high despite your measures, consult the Commissioner. The Commissioner confirms in writing if the processing would breach the Law. |
| Art. 21(3) | Voluntary and urgent consultation | You may consult the Commissioner before starting any processing. If time is short and there is a pressing business need you may begin, but you stay liable and must not override people's vital interests. |
| Art. 21(4)-(5) | Follow the Commissioner's directions | Carry out directions that follow a consultation without delay, including stopping if told. Skipping a required consultation can lead to heavier penalties. |
| Art. 21(6)-(7) | Joint consultations and timing | You may run assessments and consultations jointly with other controllers, such as for a shared platform. The Commissioner aims to reply within four weeks, extendable by up to four more for complex cases. |
| Art. 21(8) | Stop unlawful processing | If the Commissioner finds the processing unlawful, stop it at once unless the Commissioner directs otherwise. |
| Art. 21(9) | What to give the Commissioner | A consultation should set out who is responsible for what, the purposes and means, the safeguards, DPO contacts, the impact assessment and anything else the Commissioner asks for. |
| Art. 21(10) | Processor helps with consultation | A processor, including one being appointed, assists the controller in any prior consultation with the Commissioner. |
| Art. 22(1)-(3) | Wind down when processing must stop | When your basis ends or changes, or a person's right requires you to stop, make sure all copies, including your processors', are deleted, anonymised, pseudonymised or encrypted, or archived beyond further use. |
| Art. 22(4) | When data may be kept | You need not remove data that is needed for legal claims or a legal duty, used in public-interest research, or part of a dataset lawfully used to train or refine an AI system without risk to people. |
| Art. 22(5) | Assessment before research or AI retention | Before relying on the research or AI training exceptions to keep data, carry out an impact assessment, and limit the processing to what those purposes need. |
| Art. 22(6) | Retention policy and exit process | Have a policy and process for data kept under Article 22(4), and when the grounds for keeping it end, delete, anonymise, pseudonymise, encrypt or put it beyond further use. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 23(1)-(2) | Joint controller agreement | If you decide purposes and means together with someone else, sign a binding written agreement that splits compliance duties and how people exercise rights and receive the Article 29 and 30 information. |
| Art. 23(3) | Share the arrangement with people | Make the joint controller agreement, or a fair summary, available to affected people. |
| Art. 23(4) | Joint responsibility stays | Whatever your agreement says, each joint controller remains responsible for all controller duties, and people can exercise their rights against any of them. |
| Art. 24(1) | Processor contract and due diligence | Use a binding written agreement with every processor, and only pick processors that give enough assurance their measures will meet the Law and protect people's rights. |
| Art. 24(2) | Sub-processor authorisation | A processor may hire a sub-processor only with the controller's written authorisation. Where authorisation is general, the processor warns of changes and gives due weight to the controller's good faith objections. |
| Art. 24(3)-(4) | Sub-processor contract and liability | A processor needs a binding agreement passing all its obligations down to each sub-processor, and remains fully liable to the controller if the sub-processor fails. |
| Art. 24(5)(a) | What the processing agreement records | State the subject-matter and duration, nature and purpose, types of data and data subjects, and the controller's rights and obligations. |
| Art. 24(5)(b)(i)-(ii) | Documented instructions | Processors act only on documented instructions, including for disclosures to authorities and transfers abroad, unless the law requires otherwise. If it does, they tell the counterparty or the controller, unless that law forbids it. |
| Art. 24(5)(b)(iii)-(v) | Confidentiality, security and sub-processors | Processor staff are bound by confidentiality. The processor applies the Article 14 measures and meets the conditions for engaging any sub-processor. |
| Art. 24(5)(b)(vi)-(vii) | Help with rights, security and breaches | Processors support the controller in answering rights requests and in meeting its security, impact assessment, consultation and breach notification duties. |
| Art. 24(5)(b)(viii) | Return or delete at the end | When services end, the processor deletes or returns all personal data as the controller chooses, and deletes existing copies unless the law requires storage. |
| Art. 24(5)(b)(ix)-(x) | Demonstrate compliance and allow audits | Processors provide the information needed to show compliance to the controller or the Commissioner, and allow and assist audits and inspections by the controller, its auditor or the Commissioner. |
| Art. 24(6) | Flag instructions that break the Law | A processor or sub-processor must tell the controller or processor straight away if it thinks an instruction infringes the Law. |
| Art. 24(7)-(8) | Codes, certification and standard clauses | A processor's adherence to an approved code or certification can show its measures are adequate. Using the Commissioner's published standard clauses meets the Article 24(5)(b) content requirements. |
| Art. 24(9) | A processor that sets purposes is a controller | A processor that infringes the Law by deciding the purposes and means of processing is treated as a controller for that processing, with all of a controller's duties. |
| Art. 24(10) | No processing without a written agreement | Controller and processor are both in breach if they begin agreed processing before the written agreement is in place. |
| Art. 25 | Confidentiality of people under your authority | Take steps so that anyone working under your authority with access to personal data processes it only on the controller's instructions, unless the law requires otherwise. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 26(1) | Transfers abroad need an adequate level of protection | Move personal data out of the DIFC to a third country or international organisation only if protection there is adequate, including onward transfers, or if the transfer meets Article 27. |
| Art. 26(2)-(6) | Adequacy decisions | The Commissioner decides which countries, sectors or organisations are adequate, may rely on other regulators' decisions, and publishes the list in Regulations. An adequate destination needs no further authorisation. |
| Art. 27(1)-(2) | Transfers with appropriate safeguards | Without adequacy, transfer under a safeguard: a public-authority instrument, approved binding corporate rules, the Commissioner's standard clauses, or a code or certification with binding commitments, with enforceable rights for people. |
| Art. 27(3) | Transfer exceptions | Where there is no adequacy or safeguard, a transfer needs a specific exception, for example explicit informed consent, contract necessity, public interest, legal claims, vital interests, a public register, legal duty or AML needs. |
| Art. 27(4)-(5) | Exceptional one-off transfers | A last-resort transfer must be non-repetitive, involve few people, serve compelling legitimate interests and follow your documented assessment and safeguards. Tell the Commissioner and the people affected. |
| Art. 27(6) | Limits for public authorities | A public authority subject to DIFC law cannot use the consent, contract-necessity or contract-in-interest exceptions, or the exceptional one-off transfer route. |
| Art. 27(7)-(8) | Binding corporate rules | Existing binding corporate rules may be used only for transfers within your group, and need the Commissioner's approval. You can ask for approval of rules approved elsewhere, with a full copy and transfer details. |
| Art. 27(9)-(11) | Keeping binding corporate rules current | Send the Commissioner any amended rules without delay, with changes marked, and stop relying on them if rejected. Confirm in writing each year that the rules and the transfers they support are unchanged. |
| Art. 28(1) | Requests from public authorities | When a public authority asks for personal data, judge whether the request is valid and proportionate, assess the risk to people, minimise or redact the data, and where practical get binding assurances on its use. |
| Art. 28(2)-(3) | Disclosing to a requesting authority | Disclose only after reasonable steps confirm the request is valid and proportionate, giving the controller reasonable notice where law allows. You may consult the Commissioner. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 29(1) | Notice when you collect data | When you collect data from a person, give them a concise, clear notice at that time so they can judge what providing their data means. |
| Art. 29(1)(a)-(f) | Core notice content | Say who you are and how to reach you and your DPO, the purposes and lawful basis, the legitimate interests or legal duty relied on, the data categories, and the recipients. |
| Art. 29(1)(g) | Notice of transfers abroad | Where you plan to transfer data to a third country or international organisation, say so and, for safeguard-based and contract-based transfers, point to the safeguards and how to get a copy. |
| Art. 29(1)(h)(i)-(viii) | Further notice content | Add retention period or criteria, the rights to access, correct, erase, restrict, object and port, withdrawal of consent, complaint to the Commissioner, whether data is required, automated decisions, and direct marketing use. |
| Art. 29(1)(h)(ix) | Notice of restricted rights | If you process data in a way that stops people from correcting, erasing or objecting, explain the impact explicitly and make sure the person understands and acknowledges the restriction. |
| Art. 29(2) | No need to repeat what people know | You need not give information the person already has. |
| Art. 30(1)(a)-(g) | Notice when data comes from elsewhere | If you did not collect the data from the person, give them a concise notice: who you are, purposes and basis, data categories, recipients, transfers, retention, their rights, the source, and any automated decisions. |
| Art. 30(2) | Deadline for the notice | Send the notice within one month of obtaining the data, by the first communication with the person, or before first disclosure to a processor or third party, whichever comes first. |
| Art. 30(3) | When the notice is not needed | The notice is not required if the person already has the information, it is impossible or needs disproportionate effort, a law or authority requires disclosure with protections, or professional secrecy applies. |
| Art. 31(1)-(2) | Form of the information | Give the Article 29 and 30 information in writing, including electronically. On request it may be given orally, such as during a call, once the person's identity is verified. |
| Art. 31(3) | Use a public privacy policy | You may meet the notice duties through a clear, concise public policy that you direct people to, and you can link it to further detail. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 32 | Right to withdraw consent | People can withdraw consent at any time, and this right is absolute. On withdrawal, follow Article 22, stop processing as soon as reasonably practicable and make processors stop too. |
| Art. 33(1)(a)-(b) | Right of access | On request, free of charge and within one month (the Law counts a month as 30 days), confirm in writing whether you process the person's data, give the details and provide a copy with its source. |
| Art. 33(1)(c) | Right to rectification | On request, correct inaccurate personal data within the same period, unless that is technically impossible. |
| Art. 33(2)-(3) | Right to erasure | Erase data on request when it is no longer needed, consent is withdrawn without another basis, processing is unlawful or must be deleted by law, or an objection succeeds, unless you must keep it by law or for legal claims. |
| Art. 33(4)-(5) | Technical impossibility and mitigation | If correction or erasure is technically impossible you are excused only where you collected the data from the person and warned them plainly in advance. If they suffer harm, help them mitigate it. |
| Art. 33(6) | Pass instructions to recipients and processors | When a right is properly exercised, direct recipients and processors to correct or erase the data, or to stop processing and return or erase it after a valid objection. |
| Art. 33(7) | Extending the response time | For particularly complex or numerous requests, tell the person within one month that you need up to two more months, and why. |
| Art. 33(8) | Unfounded or excessive requests | For manifestly unfounded or excessive requests, particularly repetitive ones, you may charge a reasonable fee or refuse, giving written reasons if you refuse. |
| Art. 33(9)-(11) | Register of delays and refusals | Keep a register of each time you extend the deadline or treat a request as unfounded or excessive, with reasons. The Commissioner can inspect it, and invalid reliance brings Part 9 sanctions. |
| Art. 33(12) | Verify identity | If you reasonably doubt who is asking, you may ask for more information to confirm identity. The response clock starts when you have enough to identify them. |
| Art. 33(13)-(14) | Protect other people and fix the data date | When providing a copy, do not expose other individuals' data in a way that harms their rights, and redact where needed. Answer by reference to the data as it stood when the request arrived. |
| Art. 33(15)-(17) | Restricting access for stated reasons | You may limit access to the extent necessary and proportionate to avoid obstructing inquiries or crime prevention, protect public or national security, or protect others' rights. Tell the person in writing, unless doing so defeats the purpose. |
| Art. 34(1)(a) | Right to object | People may object on grounds relating to their situation to processing based on a public task or legitimate interests. |
| Art. 34(1)(b)-(c) | Direct marketing objections | Tell people before their data is first passed on, or used for others, for direct marketing and offer them the right to object. They may object to direct marketing, including profiling for it, at any time. |
| Art. 34(2)-(3) | Acting on an objection | After a justified objection, remove the data from the processing and follow Article 22. An objection to public task or legitimate interest processing is justified unless you show compelling overriding grounds. |
| Art. 34(4) | Make the right to object prominent | No later than your first communication with a person, tell them about their Article 34(1) rights in clear language that stands out and is separate from other information. |
| Art. 35(1)-(2) | Right to restriction | People can require restricted processing while accuracy is checked, where processing is unlawful and they prefer restriction to erasure, where they need data for legal claims, or while an objection is assessed. Tell them in writing when you lift it. |
| Art. 35(3) | What may continue during restriction | While restricted, only storage, legal claims, protecting another person's rights and substantial public interest processing may continue without the person's consent. |
| Art. 36 | Tell recipients about changes | Pass on any rectification, erasure or restriction to each recipient of the data, unless impossible or disproportionate, and tell the person who the recipients are if they ask. |
| Art. 37(1)-(2) | Right to data portability | Give people the data they provided, in a structured, common, machine-readable format, where processing is by automated means and based on consent or contract. Transmit it directly to another party where feasible. |
| Art. 37(3) | Portability limit | You need not provide or transmit data where doing so would infringe another person's rights. |
| Art. 38(1) | Right to review automated decisions | People may object to a decision made solely by automated processing or profiling with legal or other seriously impactful effects, and can require a person to review it. |
| Art. 38(2)-(5) | Exceptions and safeguards for automated decisions | Solely automated decisions are allowed for contracts, where a law authorises them with safeguards, or on explicit consent. Not for minors, and contract or consent reliance needs manual review available. |
| Art. 38(6) | Automated decisions on special categories | Do not base decisions solely on automated processing of special category data unless the person gave explicit consent or there is a lawful substantial public interest with safeguards. |
| Art. 39(1)-(2) | No discrimination for using rights | Do not penalise anyone for exercising their rights, for example by refusing service, changing prices or lowering quality. A difference is fine if reasonably and directly tied to the value of their data. |
| Art. 39(3)-(4) | Incentive schemes | Offering incentives for data is allowed if terms, process and the processing involved are clear, effort is small and the Law is met. People can leave without penalty, and schemes must not be coercive or unreasonable. |
| Art. 40 | Ways to exercise rights | Offer at least two non-onerous ways to make a rights request. If you have a website, one must be free and usable without creating an account, and one should match your notice contact details. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 41(1) | Notify the Commissioner of a breach | If a personal data breach compromises someone's confidentiality, security or privacy, tell the Commissioner as soon as practicable. |
| Art. 41(2)-(3) | Processor duties on a breach | A processor tells the controller without undue delay after becoming aware of a breach, and controllers and processors cooperate fully with the Commissioner's investigation. |
| Art. 41(4)-(5) | Content of the breach notice | Describe the breach and the data and people involved, give a contact point, the likely consequences and the measures taken or planned. If you cannot give everything at once, send it in phases. |
| Art. 41(6) | Breach log | Document every breach in writing, with the facts, effects and remedial action, in enough detail for the Commissioner to verify compliance, and produce it promptly on request. |
| Art. 42(1)-(2) | Tell people about high risk breaches | When a breach is likely to create a high risk to people's security or rights, tell those affected as soon as practicable, promptly where damage is imminent, in plain language with advice on reducing harm. |
| Art. 42(3)-(4) | Public notice and the Commissioner's power | If individual notices need disproportionate effort, an equally effective public communication will do. The Commissioner can require you to notify people or to publish a notice. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 46(3)(a) | Audits and access | Allow the Commissioner to audit you, including access to premises and processing equipment and production of information. Privileged material and material under a conflicting legal duty of non-disclosure is excluded. |
| Art. 48-51 | Codes of conduct and certification | Codes of conduct and certification schemes are voluntary routes to show compliance and support transfers. They need the Commissioner's approval, certification lasts at most three years, and neither removes your responsibility. |
| Art. 52 | Produce information when required | When the Commissioner gives written notice, supply the information, your Article 15 processing records, or other relevant documents, except privileged material. Not complying is a breach. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 59 | Comply with directions | Follow any direction from the Commissioner to act or stop processing. You may ask for a review within 14 days and may challenge the direction in Court. Ignoring one can bring fines or damages. |
| Art. 60 | Right to complain to the Commissioner | People who believe the Law or their rights were breached can complain to the Commissioner, individually or together. The Commissioner may investigate, mediate and issue directions. |
| Art. 61 | What counts as a contravention | You contravene the Law by doing something it prohibits, failing to do something it or the Commissioner requires, or otherwise breaching a provision. |
| Art. 62 | Fines and objections | The Commissioner can fine a controller or processor up to the per-contravention maximums in Schedule 2, and can add a general fine, not capped by it, sized to seriousness and risk of harm. You can object under the Regulations. |
| Art. 63 | Appeal to the Court | A controller or processor found in breach, or a data subject disagreeing with a finding, can appeal to the Court within 30 days, relying on the material before the Commissioner. |
| Art. 64 | Liability for damage | A controller involved in infringing processing is liable for the damage. A processor is liable only if it broke duties aimed at processors or acted against lawful instructions. Those jointly responsible are liable for the whole. |
| Art. 64A | Private right of action | A person who suffers damage, including distress, from a contravention may apply to the Court for compensation from the controller or processor, unless the defendant proves it was in no way responsible. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 65 | DIFC Body exemptions and register | A DIFC Body acting as controller may skip certain articles only where compliance would materially prejudice its regulatory functions. It must keep a register of each use, which the Commissioner can inspect. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. 2.1.1-2.1.3 | Processing record in electronic form | Keep the Article 15 record in an electronic or database format, make it available to the Commissioner on request, and keep it accurate and up to date. |
| Reg. 2.1.4 | Link the record to supporting documents | Have your record include, or link to, documents on lawful basis and data sources, consents, controller and processor contracts, data locations, impact assessments, breach records, special category handling and retention policies. |
| Reg. 2.2 | Small organisation relief | The Article 15 and Regulation 2 record-keeping duties do not apply to a controller or processor with fewer than fifty people, unless it carries out high risk processing. |
| Reg. 3.1 | What to notify | Notify the Commissioner of your processing operations, including personal data, special categories and transfers to recipients without adequate protection, with a description, purposes, data subjects, data classes and destination jurisdictions. |
| Reg. 3.2 | When to notify | File within 30 days of starting the processing, on each anniversary while it continues, and within 30 days of any change in how data is processed. |
| Reg. 3.3 | Notification fees | Pay the fees listed in Appendix 1 of the Regulations, which depend on your category and cover registration, renewal and amendments. |
| Reg. 4.1 | Annual Assessment format | Submit the Article 19 Annual Assessment in the format and by the deadline published via the DIFC Client Portal. If late or incomplete the Commissioner may order it, then fine. |
| Reg. 4.2 | Inspection notices | Answer questions and give information in a Commissioner's inspection notice within the time stated. If you do not, the Commissioner can allow more time or fine you. |
| Reg. 5 | Standard contractual clauses | The Commissioner has approved two sets of standard contractual clauses for transfers to non-adequate jurisdictions under Article 27(2)(c), published on the DIFC data protection pages. |
| Reg. 6.1 | How to complain | A complaint to the Commissioner is a written notice with the complainant's name and address, the controller concerned, the facts and the relief sought. |
| Reg. 6.2 | Unfair or deceptive practices | Do not mislead people about your processing or about certifications, codes or compliance claims. The Commissioner may act on such complaints, for example about notices, transfers and marketing statements. |
| Reg. 8.1 | How to report a breach | Report a breach to the Commissioner without undue delay after becoming aware, by email to the address given or the form on the DIFC data protection website. |
| Reg. 8.4 | Inadvertently obtained data | If data reaches you by mistake, you are only a temporary custodian. Try to identify and tell the sender, ask them to take it back within 30 days, otherwise tell the Commissioner, hand it over and delete your copies. |
| Reg. 9.2 | Digital marketing notices and defaults | Say in clear terms at collection whether data will be used for digital communications and services such as email, SMS or cookies. Offer an opt-out at first collection and set minimum-data privacy defaults. |
| Reg. 9.3.1-9.3.3 | Consent for digital communications | Consent for digital communications and behavioural advertising needs a clear positive act, an unticked box, the reason for collection, and a link to rights and withdrawal. Pre-ticked boxes, silence and inactivity do not count. |
| Reg. 9.3.4 | Relying on earlier contact or consent | You may rely on earlier contact or consent for similar products of yours, if you collected the data directly in a sale, give an opt-out, check consent is still valid and offer easy withdrawal. |
| Reg. 10.2.1 | Autonomous systems: processing principles | Where personal data is processed in or to train an autonomous or semi-autonomous system, the deployer or operator must follow the Article 9 principles. |
| Reg. 10.2.2(a)-(b) | Autonomous systems: notice to users | On first use, tell users clearly about the system's technology and any non-human-directed processing, the impact on their rights, and its purposes, outputs, limits, safeguards and the codes or certifications it follows. |
| Reg. 10.2.2(c)-(f) | Autonomous systems: evidence on request | Provide on request evidence of audit or certification compliance, and of algorithms that call for human intervention on unfair impact, government access and digital marketing breaches, with risk and impact assessments. |
| Reg. 10.2.2(g)-(h) | Autonomous systems: register and Commissioner access | Keep a register on request of use cases, rights access, automated decisions, third parties and transfers. Give the Commissioner what it asks for, and redaction is limited to protecting IP or lawful restrictions. |
| Reg. 10.3.1 | AI design principles | Design any system that may affect people to be ethical, fair, transparent, secure and accountable, with bias mitigated and decisions explainable in non-technical terms. |
| Reg. 10.3.2 | Conditions for commercial use of systems | Do not use or supply a system for commercial processing of personal data unless it works only for human-defined or human-approved purposes, follows Regulation 10.3.1 and meets the Commissioner's audit and certification requirements. |
| Reg. 10.3.3 | High risk systems and the ASO | A system may do high risk processing only if the Commissioner has set certification requirements, it meets them and serves human-defined purposes, and the deployer or operator has appointed an Autonomous Systems Officer. |
| Reg. 10.3.4-10.3.5 | Deployers, operators and complaints | A deployer is treated as a controller and an operator as a processor for the system's processing. People can complain to the Commissioner about the outcome of a system's processing. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
It applies inside the DIFC jurisdiction under Article 6. Other laws may apply to your business outside the DIFC, so check your wider position. This list covers the DIFC Law and Regulations only.
Only for DIFC Bodies (courts acting judicially excepted) and for controllers or processors that regularly and systematically carry out high risk processing, or when the Commissioner requires it (Article 16). A DPO must live in the UAE unless a group employee doing the role internationally.
One month from the request, free of charge (Article 33(1)). The Law counts a month as 30 days. You may extend by two further months for complex or numerous requests if you tell the person within the first month and give reasons (Article 33(7)).
Schedule 2 lists maximum administrative fines per contravention, ranging from USD 25,000 to USD 100,000. Article 62(3) also lets the Commissioner issue a general fine not limited to those amounts, and people can claim compensation in the Court (Article 64A).
Yes, in part. Article 22(4) allows AI training datasets to be kept in limited cases, Article 38 covers automated decisions, and Regulation 10 sets duties for deployers and operators of autonomous and semi-autonomous systems.
Appendix 3 of the Regulations lists adequate jurisdictions under Article 26(2) and says the DIFC website holds the current list. Transfers elsewhere need a safeguard or exception under Article 27.
No. This is a plain-English summary written by SecureXcel. The Law, the Regulations and the Commissioner's guidance are the authority, so read them before you rely on a requirement.