DIFC Data Protection Law · DIFC Law No. 5 of 2020
DIFC Data Protection Law compliance for firms that answer to the Commissioner.
Companies licensed in the Dubai International Financial Centre, and anyone processing personal data inside it, follow the centre's own data protection law rather than the federal UAE regime. Sterling's expert and experienced consultants map your processing, set up the notification, contracts, rights handling and breach response the law expects, and leave you with evidence your board and the Commissioner's Office can follow. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. No certificate exists under this law; the DIFC Commissioner of Data Protection supervises and enforces it
8,100+ client engagements in 60+ countries.
Why firms choose Sterling
What it is
What is the DIFC Data Protection Law and what is it used for?
The DIFC Data Protection Law is the personal data statute of the Dubai International Financial Centre, a financial free zone with its own civil and commercial laws. It governs how firms in the centre use, share and export personal data about clients, staff and investors, and gives those individuals enforceable rights. The Commissioner of Data Protection, an independent office within the DIFC, administers it, maintains the register of notifications, publishes guidance and takes enforcement action.
The federal Personal Data Protection Law does not govern the DIFC: free zones with their own data protection legislation sit outside it. A group with a DIFC entity and an onshore UAE company therefore runs two regimes side by side, and this page covers only the DIFC one.
Current text. Data Protection Law, DIFC Law No. 5 of 2020, enacted on 21 May 2020 and in force since 1 June 2020. The DIFC publishes a consolidated version dated July 2025 that incorporates DIFC Law No. 2 of 2022 and DIFC Laws Amendment Law No. 1 of 2025, together with the Data Protection Regulations. Your legal advisers confirm how the amendments affect your organisation; we build and evidence the programme against the consolidated text.
Who it is for
Who needs DIFC Data Protection Law compliance?
The law reaches two groups: controllers and processors incorporated in the DIFC, even when the processing happens elsewhere, and organisations incorporated anywhere that process personal data in the DIFC. Firms come to Sterling from four directions:
- Clients and counterparties ask for proof. Banks, funds and corporate clients send privacy due diligence questionnaires before onboarding or renewing a mandate.
- A mandate or tender carries data terms. Outsourcing and technology contracts specify processor duties, audit rights and transfer safeguards you must evidence, not simply sign.
- The regulator's expectations are rising. Notification must stay current, high-risk processing needs an impact assessment and some firms must appoint a data protection officer.
- Group structures span several regimes. A DIFC entity sits beside onshore UAE, European or Asian affiliates, and shared systems move data between them.
Requirements
What are the main DIFC Data Protection Law requirements?
The consolidated law is arranged in ten Parts. The summary below states each one at title level in plain language; your programme is tested against the articles of the current consolidated text, with your legal advisers interpreting them where a legal view is needed.
- Part 1 Introduction and Scope: who and what the law covers, including DIFC-incorporated firms processing outside the centre.
- Part 2 General Requirements: the processing principles, a lawful basis for each activity, special categories, consent and legitimate interests, an accountability programme, notification to the Commissioner, the data protection officer and impact assessments before high-risk processing.
- Part 3 Joint Controllers and Processors: arrangements between joint controllers, contracts binding processors and sub-processors, and confidentiality.
- Part 4 Data Export and Sharing: transfers out of the DIFC where the destination offers adequate protection, and appropriate safeguards or specific derogations where it does not.
- Part 5 Information Provision: what individuals must be told about the processing of their data.
- Part 6 Rights of Data Subjects: withdrawal of consent, access, rectification, erasure, objection, restriction, portability and safeguards on automated decisions.
- Part 7 Personal Data Breaches: notifying the Commissioner as soon as practicable, and telling affected individuals where the law requires.
- Part 8 The Commissioner: the office, its powers and its approval of certification schemes.
- Part 9 Remedies, Liability and Sanctions: complaints, enforcement and liability.
- Part 10 General Exemptions: the limited cases where specific obligations do not apply.
What does useful DIFC data protection evidence look like?
A processing inventory matching the systems in use, with basis, retention and transfer route per activity; a notification to the Commissioner that agrees with that inventory; signed processor contracts; privacy notices; impact assessments for high-risk processing; the data protection officer decision and reasoning; logs of rights requests and breaches, including those not notified and why; and training records. Kept in Effivity, each item has an owner and a review date.
Compliance route
How do you become compliant with the DIFC Data Protection Law?
No certificate exists for this law, so the route ends not with an audit report but with a programme that runs and can be shown. Sterling builds it with you; your legal advisers own the legal interpretation.
- 01Fix the scope and your role.Confirm which entities are DIFC-incorporated or process in the centre, separate any onshore UAE or foreign affiliate onto its own regime, and decide where you act as controller, joint controller or processor.
- 02Gap analysis: test current practice against the law.Build the processing inventory, then check notices, lawful bases, contracts, transfers, security, rights handling and breach response against each Part. Working practice stays; each gap gets an owner, an action and a date.
- 03Implement and record as you go.Update the notification to the Commissioner, issue notices and procedures, sign processor and transfer terms, decide on the data protection officer, complete the impact assessments due and train the people who handle personal data.
- 04Audit, review and close the findings.An internal audit tests the programme against the consolidated law, management review decides the fixes, and every finding is closed with evidence before a client or the Commissioner asks.
- 05Answer scrutiny and keep it current.Client questionnaires and Commissioner enquiries are answered from records that already exist; notification changes, new systems and suppliers go through the same controls, and the annual licence renewal confirms the registered particulars.
Check the route before you sign. Anyone offering a "DIFC data protection certificate" in days is selling paper the law does not recognise. Ask what will be delivered and how it maps to the consolidated law, and check your notification status and Commissioner guidance on the DIFC website yourself. The certification buyer's checklist
Cost
How much does DIFC Data Protection Law compliance cost?
The cost follows the shape of your processing, not your headcount alone. An advisory boutique with a few systems differs sharply from a fund platform exporting data across a group. A Sterling proposal shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Activities, systems, processors and transfers to map, entities in scope, deliverables and how much your team does itself (Design™ or Drive™) |
| Regulatory interaction | Commissioner notifications and licence-renewal confirmations are handled through the DIFC's own services; enquiries and client audits cost internal time |
| Internal resources and legal | Process-owner and IT time, data protection officer capacity, remediation and any legal review |
| Software and learning | Included in a Sterling engagement: Effivity runs the programme and Sterling Academy trains your people, with users, courses and access period set out in the proposal |
| Continued support | Internal audits, impact assessment support, a watch on Commissioner guidance and amendments, and refresher learning under Sustain™ |
What moves the price
- Number of DIFC entities and affiliates sharing systems
- Volume of special category data and high-risk processing
- How many transfers leave the DIFC, and to where
- Whether an inventory, notices and contracts already exist
- Deadlines set by a client, a mandate or a licence renewal
What a Sterling proposal always shows
- Deliverables, assumptions, exclusions and who does what
- Legal advice identified as outside Sterling's scope
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones linked to deliverables
- One all-inclusive proposal. No surprises, ever
Timeline
How long does DIFC Data Protection Law compliance take?
As an estimate, most programmes run three to six months: shorter where a GDPR or ISO/IEC 27001 programme already exists and needs a DIFC layer, longer where many systems, processors and group transfers are mapped for the first time. Decisions set the pace more than drafting does, and controls need a few weeks of operation before they leave records.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, contracts and existing records, and how quickly the inventory fills in |
| Build and implementation | Decisions on lawful bases, retention and transfer safeguards, contract signature, IT changes and training |
| Evidence and review | Controls operating long enough to leave records, impact assessments completed, then internal audit and management review |
| Ongoing scrutiny | The timing of client audits, notification updates and licence renewal |
If a client deadline or renewal date is driving the work, tell us at the start and we will say what is realistic and which decisions must come first.
Your engagement
What your DIFC Data Protection Law engagement includes
Sterling does not certify, attest or validate compliance, and under this law there is no certificate to obtain: the Commissioner of Data Protection supervises, and our work is consulting and implementation alongside your legal advisers, not legal advice. Engagements run on Sterling OS™. Design™ means our consultants guide while your team builds; Drive™ means we manage the work and carry most of it with your people. They are alternative levels of support, not phases in sequence. Automate™ is Effivity, and Sustain™ keeps the programme current after it is in place.
Scope, gap analysis and plan
Entities, roles and priorities agreed, with owners and dates, before implementation begins.
Inventory, policies and procedures
Processing records, notices, rights and breach procedures, and retention rules written for the DIFC law.
Effivity ISO & GRC software
Your programme runs in Effivity from the first workshop, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence.
Regulator and client readiness
Notification kept aligned with the inventory, and support in answering client questionnaires and Commissioner enquiries from existing records.
Supervision and enforcement remain with the DIFC Commissioner of Data Protection.
Often combined with
Standards organisations pair with DIFC Data Protection Law
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · data protection software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the DIFC Data Protection Law.
Every Sterling DIFC data protection engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the processing inventory, risks, impact assessments, processor reviews, incidents, rights requests, training records and management review sit in one place and the programme runs in daily work rather than in a folder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, roles and scope
Which entities fall under the law, where each acts as controller or processor, and the boundary with onshore or foreign affiliates, recorded once and reviewed when the group changes.
Inventory, lawful bases and notification
Each processing activity with its purpose, basis, retention and owner; the record the Commissioner notification is checked against at every change and renewal.
Risks and impact assessments
Risks to personal data with treatments and owners, and impact assessments screened, approved and revisited when processing changes.
Processor and supplier reviews
Contracts, due diligence and periodic reviews for every processor and sub-processor, with renewal dates that raise a task before they lapse.
Transfers and safeguards
Each outbound flow listed with its destination and the adequacy finding, safeguard or derogation it relies on.
Requests and responses
Access, erasure, objection and other requests logged, assigned and answered, with the response trail kept for each one.
Incidents and notification decisions
Incidents triaged, the decision on notifying the Commissioner and individuals recorded with its reasoning, and corrective actions tracked to closure.
Audits, training and your own forms
Internal audits, management review, training records linked to Sterling Academy, and forms and workflows adapted to your firm without code.
What this means under scrutiny
A client auditor or the Commissioner's Office asks for the inventory, the processor contracts, the transfer safeguards, the breach log and the training records. In Effivity each is a screen with dates, owners and attachments, not a document someone assembles overnight. Sustain™ runs in the same workspace, so the programme stays current between reviews.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · data protection e-learning
Train every employee on DIFC data protection, not just compliance.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for every employee who handles client, staff or investor data
- Practitioner learning for the data protection officer and privacy leads
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for reviewers
- New joiners trained on arrival, so training records stay current
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about DIFC Data Protection Law
DIFC data protection resources
Services for DIFC Data Protection Law
Why Sterling
Want a successful DIFC Data Protection Law programme? Come to Sterling.
DIFC firms rarely stand alone. Most share systems, people and suppliers with affiliates under other laws. Sterling builds one core programme and adds the DIFC obligations where they differ, so your team maintains a single set of records rather than parallel ones.
A Dubai office, 60+ countries since 2003
Programmes run from our Dubai office with one engagement team accountable across every jurisdiction your group operates in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with legal advice identified as separate. No surprises, ever.
Records your people keep
Controls built into onboarding, procurement, IT change and incident handling, so evidence builds as a by-product of normal work.
Expert and experienced consultants
Consultants who have built privacy and information security programmes across sectors and countries, and who set up your DIFC programme properly the first time.
The Sterling Promise
What our DIFC Data Protection Law success guarantee means
We stay with you until your agreed DIFC Data Protection Law programme outcome is achieved, supporting implementation, preparation and the resolution of review findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a shelf of policies.
The engagement identifies the law, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. Sterling prepares the programme and the evidence; the Commissioner of Data Protection supervises and enforces the law. Our commitment concerns the agreed programme support, not a promise of every future mandate or an incident-free future.
FAQs
Frequently asked questions about the DIFC Data Protection Law
Does the UAE PDPL apply to DIFC companies?
No, not for their DIFC processing. The federal law excludes free zones that have their own data protection legislation, and the DIFC does. An onshore UAE affiliate of the same group falls under the federal law, so groups usually run one core programme with separate DIFC and federal layers.
Is there a DIFC data protection certificate?
No. The law issues no certificate of compliance. It allows the Commissioner to approve certification schemes, but compliance itself is shown through a working programme and records. If clients want an audited certificate, ISO/IEC 27701 certification by an accredited certification body is a separate, complementary route.
Do we have to notify the Commissioner of Data Protection?
Yes, if you are a DIFC entity processing personal data. Notification is made through the DIFC Client Portal at registration, changes are updated within 14 days of the new processing starting, and the particulars are confirmed each year at licence renewal. Organisations outside the DIFC can notify voluntarily.
When must a DIFC firm appoint a data protection officer?
When it is a DIFC Body or carries out high-risk processing on a systematic or regular basis, and whenever the Commissioner requires one. Other firms may appoint one voluntarily; we record the decision and its reasoning either way.
Can DIFC firms send personal data to group offices or cloud providers abroad?
Yes, with a lawful route for each transfer. Data can move to jurisdictions the DIFC recognises as adequate; otherwise the law requires appropriate safeguards, such as standard contractual clauses or binding corporate rules, or a specific derogation. The DIFC publishes its list of adequate regimes and model clauses.
Keep exploring
More on DIFC Data Protection Law and related standards
Talk to a consultant
Plan your DIFC Data Protection Law compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice