UAE Data Protection: Federal, DIFC and ADGM

The most common and most expensive mistake in UAE privacy programmes is assuming a single national law. There are three regimes, and they are genuinely separate: Federal Decree-Law No. 45 of 2021 applies across the Emirates and is overseen by the UAE Data Office; DIFC Law No. 5 of 2020 applies to entities established in the Dubai International Financial Centre and is enforced by the DIFC Commissioner of Data Protection; and the ADGM Data Protection Regulations 2021 apply to entities established in Abu Dhabi Global Market and are enforced by the independent ADGM Office of Data Protection.

Which regime governs an entity is determined by where that entity is registered. A DIFC-registered company is governed by the DIFC law rather than the federal Decree-Law, even for processing that happens physically elsewhere in the UAE. Financial services groups routinely hold entities in more than one of the three, which means one group can be answerable to three different regulators on the same underlying dataset.

The first deliverable in any UAE programme is therefore an entity map: which legal entities exist, where each is registered, and which processing activities each one controls.

Federal Decree-Law No. 45 of 2021 entered into force on 2 January 2022. Its substantive obligations are recognisable from the GDPR: a lawful basis for processing, transparency to data subjects, records of processing, a Data Protection Officer where processing is high risk or involves large volumes of sensitive data, impact assessments, breach notification, and a full set of data subject rights including access, rectification, erasure, restriction, portability and objection.

The complication is that the executive regulations expected to set out registration mechanics, response timelines and the detailed cross-border transfer conditions remain incomplete. Organizations sometimes read that as permission to wait. It is not: the obligations stated directly in the Decree-Law are in force now, and only the operational detail is outstanding.

The workable approach is to build to what the Decree-Law states, document the judgment calls made where it is silent, and structure the programme so that outstanding detail can be slotted in without rework. Recording the reasoning behind each judgment call matters as much as the decision itself, because it is the evidence that the organization acted in good faith on the law as it stood.

DIFC Law No. 5 of 2020 is closely modelled on the GDPR and has been enforced by the Commissioner of Data Protection since 2020. The amendment package that took effect on 15 July 2025 is the most significant change since enactment.

Two elements stand out. First, the introduction of a private right of action: individuals can now bring claims directly in the DIFC Courts without first exhausting administrative remedies. That shifts the risk profile of a DIFC entity from purely regulatory to litigation exposure, and it is the change most likely to be underestimated by teams that track only fine ceilings. Second, the revised penalty schedule raised the maximum fine for failing to conduct a data protection impact assessment before high-risk processing from USD 20,000 to USD 50,000, raised the maximum for non-compliance with the Article 28 public-authority disclosure obligations from USD 10,000 to USD 50,000, and made failure to submit the annual DPO assessment to the Commissioner a distinct breach attracting up to USD 25,000.

The annual DPO assessment is worth singling out because it is an easy, entirely avoidable failure: it is a recurring filing obligation, and missing it is now independently sanctionable.

The ADGM Data Protection Regulations 2021 were made on 14 February 2021 and applied from 14 August 2021 to entities registered on or after 14 February 2021, and from 14 February 2022 to entities that existed before that date. The structure again follows the GDPR, and the Fines Rules cap penalties for serious breaches at USD 28 million alongside smaller fixed fines for administrative failures.

For a group operating across mainland, DIFC and ADGM, the practical question is how much of the programme can be shared. Policies, training and security controls generally can be. What cannot be shared is the evidence layer: records of processing, consent records, impact assessments and breach registers all need to be attributable to the specific entity and producible to that entity's regulator.

ComplyIQ handles this by scoping compliance records per entity while allowing shared policy and control libraries, so a group runs one programme with three defensible evidence sets rather than three disconnected programmes or one undifferentiated pile.