Law: DIFC Data Protection Law No. 5 of 2020 (‘the Data Protection Law’)

Regulator: The Commissioner of Data Protection

Summary: The Dubai International Financial Centre (‘DIFC’) is a Financial Free Zone within the UAE, which itself is a Federation composed of seven emirates. Being a Financial Free Zone means that UAE federal civil and commercial law does not apply, and the DIFC is able to create its own legal and regulatory framework for all civil and commercial matters.

On 21 May 2020, the Data Protection Law was enacted in the DIFC and it came into effect on 1 July 2020 in addition to the Data Protection Regulations 2020. The Data Protection Law introduces requirements for, data protection officer appointments, data protection impact assessments, and the right to data portability. As such, the Data Protection Law will move the DIFC into closer alignment with the EU’s General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’). The Data Protection Law will become enforceable from 1 October 2020.