Dubai International Financial Centre. Comprehensive data protection. Law (free zone)
DIFC DPLData Protection Law, DIFC Law No. 5 of 2020
§1Summary
- Synopsis
A GDPR-style data protection law for the DIFC financial free zone, covering lawful processing, rights, accountability, DPIAs, breach notification and international transfers. The 2025 amendments added a direct private right of action in the DIFC Courts and widened territorial reach.
- Key themes
- Unique features
Since July 2025 data subjects can sue in the DIFC Courts for compensation (including non-material damage), and the law reaches any controller/processor processing in the DIFC under stable arrangements regardless of incorporation. Includes specific rules on public authority data sharing and annual DPO assessment.
- SaaS relevance
A SaaS processing personal data for DIFC-registered clients, or within the DIFC on a stable basis, is covered even if incorporated elsewhere.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Commissioner as soon as practicable; data subjects where high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy list / appropriate safeguards (SCCs, BCRs) / derogations
- Maximum penalty
- Administrative fines per contravention per Schedule (up to USD 50,000 for key items after 2025) plus court damages
§3Dates
- Key dates
- Adopted
- In force
- Enforcement from 1 Oct 2020; amended by DIFC Laws Amendment Law No. 1 of 2025 (enacted 8 Jul 2025, in force 15 Jul 2025); Data Protection Regulations 2020, updated 1 Sept 2023
§4Text and authority
- Text
- Authoritative text difc.com
- Authority
- Commissioner of Data Protection (DIFC)
§5Where it applies
- Domestic law of
- Dubai International Financial Centre
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Breach timing and per-item fine schedule from memory of DPL structure; verify current Schedule 2. Adopted date not re-verified.