Privacy & data protection
DIFC
DIFC Data Protection Law (Dubai)
The DIFC Data Protection Law governs how organisations in the Dubai International Financial Centre handle personal data. We help you map your data, close the gaps and demonstrate compliance to the DIFC Commissioner of Data Protection.
What DIFC is
The DIFC Data Protection Law is the data protection regime of the Dubai International Financial Centre, a financial free zone with its own legal framework. It sets out lawful bases for processing, individual rights, accountability obligations and rules on international data transfers, and is overseen by the DIFC Commissioner of Data Protection.
The law draws on international data protection standards and is a legal obligation you demonstrate compliance with rather than a standard an accredited body certifies you against. It applies to entities established in the DIFC that process personal data as controllers or processors, and includes registration and notification duties with the Commissioner.
The structure of the law
Part 1 to 2 · Application and definitions
The law sets out who it covers, defining personal data, controllers, processors and the territorial reach across entities established in or operating from the DIFC.
Part 3 · Data protection principles
Processing must be lawful, fair and transparent, limited to a stated purpose, accurate, minimised, kept no longer than needed and secured.
Part 4 · Lawful bases and special categories
It specifies the grounds on which processing may proceed and adds tighter conditions for sensitive categories of personal data.
Part 5 · Accountability and governance
Controllers and processors must demonstrate compliance through records of processing, data protection by design, assessments for high-risk activities and, where required, a Data Protection Officer.
Part 6 · Rights of data subjects
Individuals may access, rectify, erase, restrict, port and object to the processing of their personal data, including rules on automated decisions.
Part 7 · International transfers
Transfers outside the DIFC are permitted only to jurisdictions with adequate protection or under recognised safeguards and derogations.
Part 8 · The Commissioner and enforcement
The DIFC Commissioner of Data Protection oversees the regime, handles registration and notification, investigates and can issue directions and fines.
Part 9 · Breach notification
Controllers must notify the Commissioner, and affected individuals where relevant, of personal data breaches that meet the stated threshold.
Who needs it
- Entities registered or operating in the Dubai International Financial Centre
- Controllers and processors handling personal data within the DIFC
- Financial and professional services firms using the DIFC as a regional base
What you get
- A data map and gap assessment against the DIFC Data Protection Law
- Policies, notices and lawful-basis records
- Individual rights, breach notification and records of processing procedures
- Registration support and a compliance evidence pack
Timelines depend on your role, how much personal data you process and how it moves internationally. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The regime in force is DIFC Law No. 5 of 2020, the Data Protection Law, which replaced the earlier 2007 law and applies alongside the DIFC Data Protection Regulations that carry much of the operational detail. The DIFC has issued periodic amendments and Commissioner guidance since enactment, so the Regulations and published guidance should be read with the primary law rather than in isolation. There is no transition from an older edition to manage today; the practical task is keeping your programme current as the Commissioner updates guidance, fees and notification expectations. We confirm the exact provisions and any recent amendments that bear on your scope during the engagement.
What it costs
There is no DIFC Data Protection certificate to buy; it is a legal obligation you demonstrate to the Commissioner, not a standard an accredited body certifies you against, and tr3labs is never the certifier, auditor or regulator. The costs that sit side by side are our scoped advisory and implementation fee, quoted up front once we understand your size, your role as controller or processor and your starting point, and any independent input you choose to add, such as an external assessment, legal advice or Data Protection Officer support, each charged separately on its own schedule. Registration and notification fees payable to the DIFC Commissioner, where they apply, are set by the DIFC and are separate again. We scope it with you rather than quote blind.
How tr3labs gets you there
Scope and data mapping
We confirm your role as controller or processor, map what personal data you hold and how it flows, and measure your current practices against the DIFC law.
Build the controls
We help you put the policies, notices, lawful-basis records and data protection processes in place, including the international transfer provisions the law requires.
Rights, registration and governance
We implement individual rights, breach notification and records of processing, and support the registration and notification duties with the Commissioner, confirmed through an internal review.
Readiness and evidence
We assemble the evidence that demonstrates compliance to the Commissioner and to customers, and keep you aligned as the law and its guidance develop.
DIFC Data Protection Law compared with GDPR
Both are principles-based privacy regimes with closely aligned rights and obligations, which is why the DIFC law is often described as GDPR-like and the two are easily conflated.
| DIFC Data Protection Law | GDPR | |
|---|---|---|
| Covers | Entities in the Dubai International Financial Centre | Organisations processing EU and EEA personal data |
| Who asks for it | DIFC Commissioner of Data Protection | EU and EEA national supervisory authorities |
| Core idea | Principles, rights and accountability for a financial free zone | Principles, rights and accountability across the EU and EEA |
| Certification | No certificate; compliance shown to the Commissioner | No certificate; compliance shown to regulators |
| Distinctive duty | Registration and notification with the Commissioner | Lead supervisory authority and one-stop-shop mechanism |
| Often held with | UAE PDPL, ISO 27001 | ISO 27001, national privacy laws |
DIFC FAQ
- How much does DIFC Data Protection compliance cost?
- There is no DIFC Data Protection certificate to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any independent assessment, legal advice or DPO support you choose. Registration and notification fees payable to the DIFC Commissioner, where they apply, are set by the DIFC and separate again.
- How long does DIFC compliance take?
- It depends on your role, how much personal data you process and how it moves internationally. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- How does the DIFC law differ from the wider UAE PDPL?
- The DIFC is a financial free zone with its own data protection law overseen by the DIFC Commissioner, separate from the federal UAE PDPL. Which applies depends on where your entity is established. We confirm this during scoping.
- Do we have to register with the DIFC Commissioner?
- The DIFC regime includes registration and notification duties with the Commissioner of Data Protection. We help you understand and meet those obligations as part of the engagement.
- Is the DIFC Data Protection Law a certification?
- No. It is a legal obligation you demonstrate compliance with to the Commissioner, not a certifiable standard. We build the controls and evidence that support and demonstrate your compliance.
Related standards
Related reading
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
9 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read