DIFC DPLData Protection Law, DIFC Law No. 5 of 2020In force In force from A GDPR-style data protection law for the DIFC financial free zone, covering lawful processing, rights, accountability, DPIAs, breach notification and international transfers. The 2025 amendments added a direct private right of action in the DIFC Courts and widened territorial reach.
Synopsis
A GDPR-style data protection law for the DIFC financial free zone, covering lawful processing, rights, accountability, DPIAs, breach notification and international transfers. The 2025 amendments added a direct private right of action in the DIFC Courts and widened territorial reach.
Key themes
lawful bases
data subject rights
DPIA
DPO
breach notification
transfers
private right of action
AI
Unique features
Since July 2025 data subjects can sue in the DIFC Courts for compensation (including non-material damage), and the law reaches any controller/processor processing in the DIFC under stable arrangements regardless of incorporation. Includes specific rules on public authority data sharing and annual DPO assessment.
SaaS relevance
A SaaS processing personal data for DIFC-registered clients, or within the DIFC on a stable basis, is covered even if incorporated elsewhere.
Extraterritorial
Yes
Breach notification
Commissioner as soon as practicable; data subjects where high risk
DPO
Conditional
Cross-border transfers
Adequacy list / appropriate safeguards (SCCs, BCRs) / derogations
Maximum penalty
Administrative fines per contravention per Schedule (up to USD 50,000 for key items after 2025) plus court damages
Key dates
Adopted
In force
Enforcement from 1 Oct 2020; amended by DIFC Laws Amendment Law No. 1 of 2025 (enacted 8 Jul 2025, in force 15 Jul 2025); Data Protection Regulations 2020, updated 1 Sept 2023
DIFC Regulation 10DIFC Data Protection Regulations – Regulation 10 (Processing Personal Data Through Autonomous and Semi-Autonomous Systems)In force In force from Sets data protection rules for AI and other autonomous systems that process personal data in the DIFC. Deployers (treated as controllers) and operators (treated as processors) must give clear notices at first use, keep registers of use cases and assess risks before high-risk processing.
Synopsis
Sets data protection rules for AI and other autonomous systems that process personal data in the DIFC. Deployers (treated as controllers) and operators (treated as processors) must give clear notices at first use, keep registers of use cases and assess risks before high-risk processing.
Key themes
AI
transparency notices
certification
Autonomous Systems Officer
high-risk processing
records
Unique features
One of the first AI-specific provisions in a Middle East data protection regime; high-risk AI use requires human-defined purposes, Commissioner audit/certification, or an Autonomous Systems Officer. A certification application is available via the DIFC portal.
SaaS relevance
AI-enabled SaaS deployed by DIFC entities must support the notice, register and certification obligations.
Extraterritorial
Yes
DPO
Conditional
Cross-border transfers
As DIFC DPL
Maximum penalty
As DIFC DPL
Key dates
Adopted
In force
Enacted 1 Sept 2023 within amended DP Regulations; certification framework and further high-risk guidance expected 2026
Free-zone regimes may displace the national law here. Check the free zone’s own law first.
Comprehensive data protection2
Data Office LawFederal Decree-Law No. 44 of 2021 on the Establishment of the UAE Data OfficeIn force In force from Creates the UAE Data Office as the federal regulator for personal data protection, giving it powers to issue policies, approve adequate jurisdictions, receive complaints and oversee PDPL compliance.
Synopsis
Creates the UAE Data Office as the federal regulator for personal data protection, giving it powers to issue policies, approve adequate jurisdictions, receive complaints and oversee PDPL compliance.
Key themes
supervisory authority
complaints
adequacy decisions
guidance
Unique features
The office still appears to be in set-up; the government portal describes its role prospectively.
SaaS relevance
Determines who will supervise and enforce PDPL obligations against SaaS providers once operational.
Medium confidence. Partly verifiedMedium confidence.In-force date assumed to align with PDPL; exact issue date not verified. [Link: Official UAE federal legislation portal]
Partly verifiedMedium confidence.In-force date assumed to align with PDPL; exact issue date not verified. [Link: Official UAE federal legislation portal]
UAE PDPLFederal Decree-Law No. 45 of 2021 on the Protection of Personal DataIn force In force from The onshore federal data protection law for the UAE, setting consent as the default lawful basis with listed exceptions, data subject rights, security duties and restrictions on transfers abroad. Much of the operational detail is left to Executive Regulations which have not yet been issued, so enforcement has been minimal.
Synopsis
The onshore federal data protection law for the UAE, setting consent as the default lawful basis with listed exceptions, data subject rights, security duties and restrictions on transfers abroad. Much of the operational detail is left to Executive Regulations which have not yet been issued, so enforcement has been minimal.
Key themes
consent
lawful bases
data subject rights
DPO
breach notification
records of processing
cross-border transfers
automated processing
Unique features
Excludes government data, health data and banking/credit data already covered by their own laws, and does not apply in the DIFC and ADGM free zones. Penalties are to be fixed by a Cabinet decision rather than in the law itself.
SaaS relevance
Applies to controllers and processors outside the UAE that process data of people in the UAE, so a SaaS serving UAE users is in scope even without local presence.
Extraterritorial
Yes
Breach notification
Data Office promptly on awareness (procedure to be set by Executive Regulations); data subjects in some cases
Issued Sept 2021; in force 2 Jan 2022; Executive Regulations (due within 6 months) still unpublished as of 2026; Cabinet penalty decision not published
Medium confidence. Partly verifiedMedium confidence.Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.
Partly verifiedMedium confidence.Executive Regulations and penalties decision not verified as issued; market-quoted fine figures (AED 50k–5m) could not be traced to a primary source. Text URL on uaelegislation.gov.ae assumed from portal pattern; Arabic PDF also on u.ae assets.
ePrivacy / marketing1
Consumer Protection LawFederal Law No. 15 of 2020 on Consumer ProtectionIn force General consumer protection statute which includes a duty on suppliers to protect consumer data and a prohibition on using it for marketing purposes without consent.
Synopsis
General consumer protection statute which includes a duty on suppliers to protect consumer data and a prohibition on using it for marketing purposes without consent.
Key themes
consumer data
marketing
confidentiality
Unique features
Listed by the UAE government as part of the national data protection framework.
SaaS relevance
Relevant to B2C SaaS using customer data for promotional purposes in the UAE.
Partly verifiedMedium confidence.Detail limited to UAE portal description.
Health data1
ICT Health LawFederal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health FieldsIn force In force from Regulates the electronic handling of health information by healthcare providers, insurers, claims managers and health-tech service providers, including a central medical records system, confidentiality and retention duties. Article 13 imposes a general health-data localisation rule.
Synopsis
Regulates the electronic handling of health information by healthcare providers, insurers, claims managers and health-tech service providers, including a central medical records system, confidentiality and retention duties. Article 13 imposes a general health-data localisation rule.
Key themes
health data
localisation
retention
confidentiality
central health records
Unique features
Health data may not be stored, processed, generated or transferred outside the UAE except in cases set by health authorities (Resolution 51/2021: overseas treatment, labs, research, insurance, pharmacovigilance, personal devices etc.). Applies across the UAE including free zones; records kept for at least 25 years.
SaaS relevance
Any SaaS providing electronic services in the medical field to UAE health entities must host health data in the UAE unless an exception applies.
Extraterritorial
Limited
DPO
No
Cross-border transfers
Localisation: health data stays in UAE save Resolution 51/2021 exceptions (often with consent, encryption and an in-country copy)
Key dates
Adopted
In force
Cabinet Resolution 32/2020 implementing regulations (22 Apr 2020); Ministerial Resolution 51/2021 transfer exceptions (issued 28 Apr 2021, in force 16 May 2021)
Cybercrime LawFederal Decree-Law No. 34 of 2021 on Combatting Rumours and CybercrimesIn force In force from Criminal law covering unauthorised access, misuse of electronic data and online invasion of privacy, including unlawful collection or processing of personal data and capturing or publishing images of people without consent. In the absence of PDPL penalties, it is the main source of sanctions for privacy breaches onshore.
Synopsis
Criminal law covering unauthorised access, misuse of electronic data and online invasion of privacy, including unlawful collection or processing of personal data and capturing or publishing images of people without consent. In the absence of PDPL penalties, it is the main source of sanctions for privacy breaches onshore.
Key themes
unauthorised access
unlawful processing of personal data
invasion of privacy
financial data
spam/e-marketing
Unique features
Article 13 criminalises unlawful collection, storage or processing of personal data (detention and/or AED 50,000–500,000); Articles 44–45 cover online privacy invasion.
SaaS relevance
Exposes SaaS operators and staff to criminal liability for unlawful data handling or security failings affecting UAE data.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Imprisonment and fines up to AED 5m depending on offence
Membership-based — check ratification status in the instrument record. 6 instruments from 2 bodies.
Global Cross-Border Privacy Rules Forum
Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force In force from An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Synopsis
An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Key themes
certification
interoperability
accountability agents
processors
data flows
Unique features
The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.
SaaS relevance
A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
Medium confidence. Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
United Nations
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.