The Dubai International Financial Centre's own GDPR-aligned data protection law, enforced by the DIFC Commissioner of Data Protection, substantially amended in July 2025 to add a private right of action.
Source: IQWorks Glossary — iqworks.ai | Last updated: 2026-08-09
Last verified: August 9, 2026
DIFC DP Law Regulation Guide
Requirements, penalties, individual rights, and enforcement details
DIFC Law No. 5 of 2020 governs the processing of personal data by entities established in the Dubai International Financial Centre. It replaced the DIFC's earlier 2007 law and is closely modelled on the GDPR, covering lawful bases, data subject rights, accountability obligations, impact assessments, breach notification and restricted international transfers. Enforcement sits with the DIFC Commissioner of Data Protection, independently of the UAE federal regime.
The most significant development since enactment is the amendment package that took effect on 15 July 2025. It introduced a private right of action, allowing individuals to bring claims directly in the DIFC Courts without first exhausting administrative remedies, and revised the schedule of financial penalties. The maximum fine for failing to carry out a data protection impact assessment before high-risk processing rose from USD 20,000 to USD 50,000, the maximum for non-compliance with the Article 28 public-authority disclosure obligations rose from USD 10,000 to USD 50,000, and failure to submit the annual DPO assessment to the Commissioner became a distinct breach attracting up to USD 25,000. Serious contraventions remain subject to larger, uncapped penalties.
Because a DIFC-registered entity is governed by this law rather than Federal Decree-Law No. 45 of 2021, groups with both mainland and free-zone entities are running two regimes at once and need their records of processing, consent evidence and breach procedures scoped per entity.
How IQWorks Helps
Related Terms
ADGM Data Protection Regulations 2021
Abu Dhabi Global Market's free-zone data protection regime, enforced by the independent ADGM Office of Data Protection, with fines for serious breaches capped at USD 28 million.
UAE PDPL (Federal Decree-Law No. 45 of 2021)
The UAE's federal personal data protection law, in force since January 2022, establishes controller and processor obligations across the Emirates, though its executive regulations remain incomplete, leaving several operational details unresolved.
Data Protection Impact Assessment (DPIA)
A Data Protection Impact Assessment is a systematic process for evaluating the potential impact of a data processing activity on individuals' privacy, required under the GDPR for processing likely to result in high risk to data subjects.
Cross-Border Data Transfer
Cross-border data transfer refers to the movement of personal data from one country or jurisdiction to another, which is regulated by data protection laws that impose specific requirements to ensure adequate protection.