DIFC and ADGM data protection,
how the free zone regimes work.

The DIFC Data Protection Law came into force on 1 July 2020, replacing the 2007 law. The current consolidated version (July 2025) includes amendments made in 2022 and by DIFC Laws Amendment Law No. 1 of 2025. It is closely modelled on the GDPR: lawful bases including consent and legitimate interests, special categories of personal data, data protection by design and by default, records of processing, DPIAs, processor contracts and the full set of data subject rights.

Who it covers. Under Article 6 it applies to a controller or processor incorporated in the DIFC, wherever the processing happens, and to any controller or processor processing personal data in the DIFC as part of stable arrangements, wherever it is incorporated.

Registration. Every controller and processor must register with the Commissioner of Data Protection by filing a notification of its processing operations (Article 14(7)). Under the Regulations the notification is due within 30 days of starting processing and is renewed each year. Fees depend on the category: USD 1,250 to register and USD 500 to renew for DFSA-authorised firms, USD 750 and USD 250 for other non-retail firms, and USD 250 and USD 100 for retail.

DPO. A DPO is mandatory for DIFC Bodies and for any controller or processor carrying out High Risk Processing Activities on a systematic or regular basis, and the Commissioner can require one in other cases. The DPO must reside in the UAE unless they hold a similar group-wide role. Controllers that must appoint a DPO also file an annual assessment of their processing (Article 19). Organisations that do not need a DPO must still allocate responsibility for data protection clearly. See our DPO guide.

Breaches. A controller must notify the Commissioner as soon as practicable of a personal data breach that compromises a data subject's confidentiality, security or privacy, and tell affected data subjects as soon as practicable where the breach is likely to result in a high risk to them (Articles 41 and 42). Processors must tell the controller without undue delay.

Transfers. Transfers out of the DIFC need an adequate level of protection in the destination, as determined by the Commissioner, or appropriate safeguards under Article 27, such as standard data protection clauses adopted by the Commissioner or binding corporate rules, or one of its derogations. See standard contractual clauses.

Regulation 10 of the DIFC Data Protection Regulations (in the consolidated version in force from 1 September 2023) deals with personal data processed through autonomous and semi-autonomous systems, which in practice covers many AI systems. It introduces the roles of deployer (the person on whose authority, or for whose benefit, a system runs) and operator (a provider running the system for a deployer), held to standards similar to a controller and a processor. Where a website or app uses such a system to process personal data, the deployer or operator must:

• give clear notice on first use that the system may process personal data in ways that are not human-initiated, and how that affects people's rights;
• describe the human-defined purposes, the principles and limits within which the system can set further purposes, the outputs and how they are used, the safeguards built in, and the codes or frameworks it was built to (the Regulation names, among others, the NIST AI framework and OECD and UNESCO principles);
• on request, provide evidence of algorithms that seek human intervention where processing could be unfair or discriminatory, plus a risk and impact assessment; and
• on request, provide a register of use cases, data access routes for data subjects, whether decisions are fully automated, third parties involved and transfer safeguards.

The guidance notes say certification requirements are expected in future guidance. If you deploy AI to DIFC users, our guides to the NIST AI RMF and ISO 42001 cover the frameworks the notice can point to.

ADGM enacted its Data Protection Regulations 2021 on 14 February 2021, replacing the 2015 regulations. For entities incorporated on or after that date they took effect on 14 August 2021. The DPR 2021 apply to processing in the context of the activities of an establishment of a controller or processor in ADGM, whether or not the processing takes place in ADGM, and regardless of where the data subjects are. ADGM's Office of Data Protection describes them as closely aligned with the GDPR.

• Registration and fee. ADGM registered entities that process personal data must register as data controllers and pay a data protection fee (section 24 and the Fees Rules 2021) and a yearly renewal fee. Failing to pay can bring a fine of up to 150% of the fee.
• DPO. Mandatory for public authorities, and where core activities involve regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data.
• Breaches. Notify the Commissioner without undue delay and, where feasible, within 72 hours; tell data subjects without undue delay when the breach is likely to result in a high risk to them.
• Transfers. ADGM follows the European Commission's approach of designating adequate jurisdictions, and has published an addendum for using the EU standard contractual clauses.
• Fines. The Commissioner can impose fines of up to USD 28 million.
• Micro-businesses. Some exemptions apply to entities with five or fewer employees, unless they carry out high-risk processing.