The UAE has more than one data protection regime. Companies registered in the Dubai International Financial Centre follow the DIFC Data Protection Law No. 5 of 2020, while most onshore businesses follow the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the PDPL). ADGM has its own regulations too. Groups with entities in both DIFC and onshore Dubai often have to comply with two laws at once. This guide compares the DIFC DPL and the UAE PDPL and explains how to build one compliance programme that satisfies both.
Key Takeaways
- The DIFC DPL applies to entities incorporated in DIFC and to processing carried out in DIFC; the UAE PDPL applies onshore and excludes free zones that have their own data protection laws.
- The DIFC Commissioner of Data Protection is an active regulator with published guidance and enforcement; the PDPL is overseen by the UAE Data Office, with detailed requirements set by executive regulations.
- Both laws are GDPR-influenced: lawful basis, data subject rights, breach notification, DPIAs, DPOs for high-risk processing and restrictions on international transfers.
- Key differences sit in applicability, registration and notification duties, DPO triggers, transfer mechanisms and the maturity of enforcement.
- A single ISO 27701-style privacy programme with a jurisdiction overlay is the practical way to comply with both.
The UAE Data Protection Landscape at a Glance
Three regimes matter for most organisations operating in the UAE: the federal PDPL for onshore businesses, the DIFC Data Protection Law for DIFC entities and the ADGM Data Protection Regulations 2021 for Abu Dhabi Global Market entities. Sector laws sit on top, including Federal Law No. 2 of 2019 on ICT in health fields and banking secrecy obligations under CBUAE rules. Our UAE PDPL compliance guide covers the federal law in depth; this article focuses on how DIFC differs.
Scope: Who Each Law Applies To
DIFC DPL 2020. Applies to controllers and processors incorporated in DIFC, regardless of where the processing takes place, and to processing carried out in DIFC as part of stable arrangements, even by entities incorporated elsewhere. It has extraterritorial reach similar to the GDPR.
UAE PDPL. Applies to the processing of personal data of individuals in the UAE by controllers or processors inside the country, and to controllers or processors outside the UAE that process data of individuals in the UAE. It expressly does not apply to government data, government entities, personal health data and credit data governed by other laws, or to entities in free zones that have their own data protection legislation, which is why DIFC and ADGM companies look to their own regimes.
Practical result. A bank’s DIFC-registered advisory arm follows the DIFC DPL; its onshore operating company follows the PDPL plus CBUAE requirements. Data shared between them is a cross-entity transfer that needs a basis under both laws.
Regulators and Enforcement
The DIFC Commissioner of Data Protection has operated since 2007 under earlier versions of the law and actively publishes guidance, runs an annual assessment process and has issued fines and directions. DIFC entities must notify the Commissioner of their processing activities and pay an annual fee as part of their licence obligations.
The UAE Data Office was established under the PDPL as the federal regulator. The detailed obligations, timelines and penalty amounts under the PDPL are set by executive regulations, so onshore organisations should confirm the current status of those regulations with counsel before relying on specific deadlines. Our practical PDPL guide is updated as that position develops.
Key Differences Between the DIFC DPL and the UAE PDPL
Lawful basis. Both laws require a lawful basis for processing. The DIFC DPL mirrors the GDPR set, including legitimate interests. The PDPL leads with consent and lists exceptions such as contract performance, legal obligation and public interest; treat legitimate interests more cautiously onshore.
Data protection officer. Under the DIFC DPL a DPO is mandatory for DIFC bodies and for organisations performing high-risk processing on a systematic or regular basis, and the DPO must be resident in the UAE unless an exemption is granted. The PDPL requires a DPO where processing creates a high risk, involves large-scale sensitive data or systematic monitoring, and allows the DPO to be inside or outside the UAE.
Breach notification. The DIFC DPL requires notification to the Commissioner as soon as practicable where a breach compromises confidentiality, security or privacy, and to affected individuals where there is a high risk. The PDPL requires notification to the UAE Data Office and, where there is a risk to privacy, to data subjects, with the timing to be set by executive regulations.
International transfers. The DIFC maintains a list of adequate jurisdictions and recognises standard contractual clauses, binding corporate rules and other safeguards; the Commissioner’s Ethical Data Management Risk Index and transfer guidance are mature. The PDPL permits transfers to jurisdictions with adequate protection as determined by the Data Office, and otherwise with appropriate safeguards or specific exceptions.
Data subject rights. Both grant access, rectification, erasure, restriction, portability and objection rights. The DIFC DPL sets a one-month response window; PDPL timelines depend on the executive regulations.
Records and DPIAs. Both require records of processing and data protection impact assessments for high-risk processing. DIFC entities must also notify the Commissioner of certain high-risk processing and complete the annual assessment.
Penalties. The DIFC DPL sets published administrative fines and allows the Commissioner to issue directions and the courts to award compensation. PDPL penalties are to be defined through executive regulations and Cabinet decisions.
What Happens When Both Laws Apply
Many groups have a DIFC-registered entity for financial services, legal or holding activities and onshore entities for operations. Common pitfalls include a single privacy notice that cites the wrong law, shared HR and CRM systems with no intra-group transfer agreement, and a DPO appointed under one regime but not notified under the other.
The practical approach is one programme, two overlays: a common records-of-processing inventory, policy set and security controls, with jurisdiction-specific notices, DPO registrations, transfer agreements and breach playbooks. Aligning the programme to ISO 27701 or to the controls in our ISO 27001 certification roadmap gives auditors in both jurisdictions evidence they recognise.
Security Controls Both Laws Expect
Neither law prescribes specific technologies, but both require appropriate technical and organisational measures. In practice regulators and auditors look for access control and MFA, encryption at rest and in transit, data classification and loss prevention, logging and monitoring, vendor due diligence and tested incident response. Our guides to identity and access management best practices and incident response planning for UAE organisations map directly to these expectations.
Frequently Asked Questions
Does the UAE PDPL apply to DIFC companies?
Generally no. The PDPL excludes entities in free zones that have their own data protection laws, and DIFC has the DIFC Data Protection Law No. 5 of 2020. DIFC entities follow the DIFC DPL, while their onshore affiliates follow the PDPL.
What is the DIFC Data Protection Law?
DIFC Law No. 5 of 2020 is the data protection law of the Dubai International Financial Centre. It is GDPR-influenced, enforced by the DIFC Commissioner of Data Protection, and applies to entities incorporated in DIFC and to processing carried out in DIFC.
Do I need a DPO under the DIFC DPL?
A DPO is mandatory for DIFC bodies and for organisations that perform high-risk processing on a systematic or regular basis. Other DIFC entities should document their assessment of whether a DPO is required. The DPO must normally be resident in the UAE.
How does breach notification differ between DIFC and the PDPL?
DIFC requires notification to the Commissioner as soon as practicable for breaches that compromise confidentiality, security or privacy, and to individuals where there is high risk. The PDPL requires notification to the UAE Data Office, with the detailed timing set by executive regulations.
Can personal data be transferred from DIFC to onshore UAE?
Onshore UAE is not automatically treated as adequate by DIFC, so transfers from a DIFC entity to an onshore affiliate need a lawful basis and appropriate safeguards such as an intra-group data transfer agreement using recognised clauses.
Which law applies to an ADGM company?
ADGM entities follow the ADGM Data Protection Regulations 2021, enforced by the ADGM Office of Data Protection, which are also GDPR-influenced and distinct from both the DIFC DPL and the federal PDPL.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA helps DIFC, ADGM and onshore organisations build one privacy and security programme that satisfies every regime through our data privacy and protection services, regulatory compliance consulting and GRC services. Talk to our Dubai privacy team about a gap assessment. This article is general information, not legal advice.