Made under the Data Protection Law 2020, the Regulations detail records of processing, notifications to the Commissioner, complaints, fines, personal data breaches, digital marketing and communications and autonomous or AI-based systems, with appendices of fees, standard notices and the list of adequate jurisdictions for transfers.
The DIFC Data Protection Regulations are the operational rules made under the Data Protection Law, DIFC Law No. 5 of 2020. Consolidated Version No. 2, read for this record, has been in force since 1 September 2023. They apply to every person to whom the Law applies (Regulation 1.1.2): controllers and processors established in the DIFC or processing personal data in the DIFC.
The Regulations turn the Law's duties into filings, deadlines and fees. Under Regulation 3 a controller or processor must notify the Commissioner of Data Protection of its processing of personal data, of special categories of data and of transfers to jurisdictions without adequate protection, within 30 days of starting the processing, again on every anniversary while the processing continues, and within 30 days of any change in the manner of processing. The notification describes the processing, its purposes, the data subjects, the classes of data and the jurisdictions to which data is transferred. Appendix 1 fixes the fees in three categories, for DFSA-authorised entities, other non-retail entities and retail entities respectively: USD 1,250, USD 750 or USD 250 for the initial notification, USD 500, USD 250 or USD 100 for annual renewal and USD 100, USD 50 or USD 10 for amendments.
Regulation 2 requires records of processing activities under Article 15 of the Law in electronic form, linked to the lawful basis, consents, contracts, data locations, impact assessments, breach records and retention policies, but exempts controllers and processors with fewer than 50 employees unless they carry out high-risk processing. Regulation 4 obliges controllers to submit the Annual Assessment in the format the Commissioner publishes on the DIFC Client Portal and to answer inspection notices in time, with fines under Article 62 of the Law for unjustified failure. Regulation 5 records the Commissioner's two approved sets of standard contractual clauses for transfers to non-adequate jurisdictions, and Appendix 3 lists the adequate jurisdictions, including ADGM, the EEA states, the United Kingdom, Switzerland, Japan, Singapore and Canada.
Regulation 7 sets the fine procedure: a written notice of fine in the form in Appendix 2, a notice of objection to the Commissioner, suspension of recovery while an objection is pending, and an application to the Court within 30 days of the Commissioner's confirmed decision; the fine amounts are in Schedule 2 of the Law. Regulation 8 requires a controller to report a personal data breach to the Commissioner without undue delay by email or web form, allows the Commissioner to direct communication to data subjects or the public, and provides for fines where a breach should have been notified and was not. Regulation 9 governs direct marketing, cookies and tracking, requiring clear notice at collection, an opt-out on first collection and privacy-protective default settings. Regulation 10 imposes duties on deployers and operators of AI systems that process personal data. The Regulations are in force.
Every person to whom the Data Protection Law applies: controllers and processors established in the DIFC or processing personal data in the DIFC, including DFSA-authorised firms, other DIFC companies and retail entities, together with deployers and operators of AI systems and persons who inadvertently obtain personal data.
| Regulation 2 | Controllers and processors must keep electronic records of processing activities under Article 15 of the Law, linked to the lawful basis, consents, contracts, data locations, impact assessments, breach records and retention policies; entities with fewer than 50 employees are exempt unless they carry out high-risk processing. |
| Regulation 3.1 | A controller or processor must notify the Commissioner of its processing of personal data, special categories of data and transfers to non-adequate jurisdictions, describing the processing, its purposes, the data subjects, the classes of data and the destination jurisdictions. |
| Regulation 3.2 | The notification is due within 30 days of commencing the processing, on every anniversary of the initial notification while processing continues, and within 30 days of any change in the manner of processing. |
| Regulation 4.1 | Controllers must submit the Annual Assessment in the format and by the deadline the Commissioner publishes on the DIFC Client Portal; unjustified failure may attract a fine for failure to respond or an administrative fine under Article 62(2) and Schedule 2 of the Law. |
| Regulation 5 | For Article 27(2)(c) of the Law the Commissioner has approved two sets of standard contractual clauses for transfers to non-adequate jurisdictions, published on the DIFC website. |
| Regulation 7 | Fines under Article 62 are imposed by written notice in the Appendix 2 form; a notice of objection suspends recovery, unpaid fines may be recovered as a debt or through the Court, and the person may apply to the Court within 30 days of the Commissioner confirming the decision. |
| Regulation 8.1 | A controller must report a personal data breach to the Commissioner without undue delay after becoming aware of it, by email to the Commissioner or through the DIFC website form. |
| Regulation 8.3 | Where a controller or processor should have notified the Commissioner or affected data subjects of a breach and failed to do so, the Commissioner may impose fines or seek sanctions and remedies under Parts 9 and 10 of the Law. |
| Regulation 9 | For direct marketing, cookies, pixel and in-app tracking, controllers must tell data subjects at collection in clear and plain language, offer an opt-out on first collection, and set privacy preferences by default to collect no more than the minimum data necessary. |
| Regulation 10 | Deployers and operators of autonomous and semi-autonomous systems that process personal data, or use it to train such systems, take on controller-type accountability and specific obligations under this Regulation. |
| Regulation 3.3 (Appendix 1 fees) | Notification fees for the three categories (DFSA-authorised entities, other non-retail entities and retail entities respectively): USD 1,250, USD 750 or USD 250 for the initial notification; USD 500, USD 250 or USD 100 for annual renewal; USD 100, USD 50 or USD 10 for amendments. |
| Regulation 5 (Appendix 3 adequacy list) | Lists the jurisdictions treated as adequate under Article 26(2) of the Law, including ADGM, the EU and EEA states, the United Kingdom, Switzerland, Japan, Singapore, South Korea, Canada, California, Argentina, Uruguay and the Crown Dependencies; the Commissioner may add others. |
The Regulations do not themselves fix fine amounts; those are in Schedule 2 of the Data Protection Law and are imposed under Article 62 by the notice procedure in Regulation 7, with objection to the Commissioner and application to the Court within 30 days. The Commissioner may fine a controller for failing to submit the Annual Assessment or respond to an inspection notice without justification (Regulation 4), for failing to notify a breach (Regulation 8.3), and may take enforcement action for unfair or deceptive practices such as misleading privacy notices (Regulation 6.2).
The notification fee, the renewal cycle and the adequacy list our clients need for cross-border data flows are set here rather than in the Law. For every DIFC entity we administer we file the initial notification within 30 days of incorporation, diarise the anniversary renewal alongside the licence, and budget the non-retail fees of USD 750 and USD 250 that apply to most of our holding companies, with the higher DFSA-authorised rates for the regulated firms we support. We complete the Annual Assessment on the Client Portal for clients who ask us to, and we keep the processing notification current when a client starts moving data to a group company abroad, checking Appendix 3 first and putting the DIFC standard contractual clauses in place where the destination is not listed. Clients with under 50 staff are told they are exempt from the records-of-processing duty unless their processing is high risk.
DIFC Data Protection Law
GDPR-aligned statute replacing the 2007 law: it sets lawful bases for processing, data subject rights, controller and processor duties, breach notification, data protecti…
ADGM Data Protection Regulations
GDPR-style regime administered by the ADGM Office of Data Protection: data-protection principles, individual rights, controller and processor duties, data protection offi…
Personal Data Protection Law (PDPL)
The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirement…
DIFC Operating Law
Requires any person operating or conducting business in or from the DIFC to be registered under a prescribed law and to hold a valid licence or permission, and sets out t…
DIFC Operating Regulations
Made under Article 46 of the Operating Law, the Regulations govern issue and renewal of commercial and operating licences, restricted, short-term and qualified retail lic…
DIFC Companies Law
Governs the incorporation and running of DIFC companies: private companies (one to fifty shareholders) and public companies, directors' duties, shares and capital, accoun…
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →