Law: DIFC Data Protection Law No. 5 of 2020 ('the Data Protection Law')

Regulator: The Commissioner of Data Protection

Summary: The Dubai International Financial Centre ('DIFC') is a Financial Free Zone within the UAE, which itself is a Federation composed of seven Emirates. Being a Financial Free Zone means that UAE federal civil and commercial law does not apply, and the DIFC is able to create its own legal and regulatory framework for all civil and commercial matters.

On 21 May 2020, the Data Protection Law was enacted in the DIFC and it came into effect on 1 July 2020 in addition to the Data Protection Regulations 2020. The Data Protection Law introduces requirements for, data protection officer appointments, data protection impact assessments, and the right to data portability. As such, the Data Protection Law will move the DIFC into closer alignment with the EU's General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). The Data Protection Law will become enforceable from 1 October 2020. Moreover, on 8 March 2022, the DIFC announced the enactment of the DIFC Laws Amendment Law, DIFC Law No. 2 of 2022, which incorporates amendments to several DIFC laws including the Data Protection Law, aiming to align the DIFC's regulatory framework with international best practice.