DIFC Data Protection Law No. 5 of 2020: Complete Guide

Controllers and processors incorporated, registered, or operating in DIFC, regardless of where the data subjects live, plus, in defined cases, entities processing personal data in DIFC as part of stable arrangements even without incorporation there. It is entity-based, not customer-based: a DIFC asset manager serving only Singaporean clients is fully covered, while a mainland Dubai company serving DIFC-resident customers is not (it falls under the federal PDPL). Groups commonly get this wrong in both directions when assigning policies.

Every DIFC controller and processor must notify the Commissioner of its processing operations via the DIFC portal and keep the notification current, with annual renewal and fees; this makes the processing inventory a filed document, not an internal one. A data protection officer is mandatory for entities performing high-risk processing on a systematic or regular basis (the law's Article 16 test) and for DIFC bodies; the DPO can be shared or outsourced but must be resident in the UAE unless the Commissioner permits otherwise, and their details go into the notification.

A GDPR-style catalogue: access, rectification, erasure, restriction, objection (including an absolute right against direct marketing), portability, rights around automated decision-making, and withdrawal of consent. Controllers must act within one month, extendable for complexity by two further months with explanation, mirroring GDPR timing. Requests are free in the ordinary case. The Commissioner has published guidance on handling and can order compliance; data subjects can also claim compensation through the DIFC Courts, a live route given the Centre's litigation infrastructure.

Two lanes. Adequate jurisdictions: the Commissioner maintains a list including the EU/EEA member states, the UK, and other recognized regimes; transfers there need no extra instrument. Everywhere else: appropriate safeguards, DIFC's own standard contractual clauses, the EU 2021 SCCs as recognized with the DIFC addendum, binding corporate rules, or approved codes/certifications, plus limited derogations (consent, contract necessity, legal claims). A transfer from DIFC to a mainland UAE affiliate is a cross-regime export needing these instruments, since the federal PDPL is not on the adequacy list.

The Commissioner's office is an active regulator by regional standards: it audits notifications, issues direction notices, publishes guidance (on the EU SCC recognition, DSARs, DPO duties), and levies fines, the law schedules administrative fines for specific contraventions (up to USD 100,000 per item, cumulable) and authorizes general fines for serious violations, with decisions appealable to the DIFC Courts. Enforcement themes so far: unnotified processing, weak DSAR handling, and transfer paperwork. For DFSA-regulated firms, DP Law findings can also feed prudential conduct assessments, doubling the incentive.