Dubai International Financial Centre. AI / automated decisions. Regulation (free zone)
DIFC Regulation 10DIFC Data Protection Regulations – Regulation 10 (Processing Personal Data Through Autonomous and Semi-Autonomous Systems)
Partly verified
Medium confidence.Exact enforcement/compliance date for Reg 10 not stated in sources consulted.
§1Summary
- Synopsis
Sets data protection rules for AI and other autonomous systems that process personal data in the DIFC. Deployers (treated as controllers) and operators (treated as processors) must give clear notices at first use, keep registers of use cases and assess risks before high-risk processing.
- Key themes
- Unique features
One of the first AI-specific provisions in a Middle East data protection regime; high-risk AI use requires human-defined purposes, Commissioner audit/certification, or an Autonomous Systems Officer. A certification application is available via the DIFC portal.
- SaaS relevance
AI-enabled SaaS deployed by DIFC entities must support the notice, register and certification obligations.
§2Obligations
- Extraterritorial
- Yes
- DPO
- Conditional
- Cross-border transfers
- As DIFC DPL
- Maximum penalty
- As DIFC DPL
§3Dates
- Key dates
- Adopted
- In force
- Enacted 1 Sept 2023 within amended DP Regulations; certification framework and further high-risk guidance expected 2026
§4Text and authority
- Text
- Authoritative text difc.com
- Authority
- Commissioner of Data Protection (DIFC)
§5Where it applies
- Domestic law of
- Dubai International Financial Centre
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Exact enforcement/compliance date for Reg 10 not stated in sources consulted.