DIFC DP Law

IQWorks Research

Dubai International Financial Centre

DIFC Data Protection Law No. 5 of 2020

The Dubai International Financial Centre's own GDPR-aligned data protection law, enforced by the DIFC Commissioner of Data Protection, substantially amended in July 2025 to add a private right of action.

Source: IQWorks — iqworks.ai | Last updated: 2026-03-20

Effective

Jul 1, 2020

Jurisdiction

Dubai International Financial Centre

Max Penalty

Scheduled fines up to USD 100,000 per contravention, with uncapped penalties available for serious breaches

Enforced By

DIFC Commissioner of Data Protection

Who Does DIFC DP Law Apply To?

Entities established in the Dubai International Financial Centre. A DIFC entity is governed by this law rather than the UAE federal Decree-Law No. 45 of 2021.

Key Requirements

GDPR-Aligned Accountability

Controllers must identify a lawful basis, provide transparent notices, maintain processing records, and be able to demonstrate compliance to the Commissioner on request.

Annual DPO Assessment

Controllers must complete an annual assessment of whether a Data Protection Officer is required and submit it to the Commissioner. Since the July 2025 amendments, failing to do so is a distinct breach attracting a fine of up to USD 25,000.

Impact Assessments

A data protection impact assessment is required before high-risk processing. The maximum fine for failing to carry one out rose from USD 20,000 to USD 50,000 in the July 2025 amendments.

Private Right of Action

The amendments that took effect on 15 July 2025 allow individuals to bring claims directly in the DIFC Courts without first exhausting administrative remedies, which materially changes the litigation exposure of a DIFC entity.

Individual Rights Under DIFC DP Law

Right of access to personal data

Right to rectification and erasure

Right to restriction of processing

Right to data portability

Right to object, including to direct marketing

Right to bring a claim directly in the DIFC Courts

Frequently Asked Questions

What is DIFC DP Law?

The Dubai International Financial Centre's own GDPR-aligned data protection law, enforced by the DIFC Commissioner of Data Protection, substantially amended in July 2025 to add a private right of action.

What are the penalties for DIFC DP Law non-compliance?

The maximum penalty under DIFC DP Law is Scheduled fines up to USD 100,000 per contravention, with uncapped penalties available for serious breaches. Enforcement is handled by DIFC Commissioner of Data Protection.

Who does DIFC DP Law apply to?

Entities established in the Dubai International Financial Centre. A DIFC entity is governed by this law rather than the UAE federal Decree-Law No. 45 of 2021.