Dubai and DIFC

Data privacy in Dubai and the DIFC

Dubai businesses can fall under different data protection regimes depending on where they are licensed and what sector they operate in. This guide explains which rules apply onshore in Dubai and inside the Dubai International Financial Centre, and how our Dubai data privacy consultants help organisations align with regulatory and legal requirements.

Last reviewed: 25 September 2026

Which data privacy law applies in Dubai

Most onshore and non financial free zone businesses in Dubai are governed by the UAE federal Personal Data Protection Law, Federal Decree Law No. 45 of 2021. Entities licensed in the DIFC are instead governed by DIFC Data Protection Law No. 5 of 2020, overseen by the DIFC Commissioner of Data Protection.

Sector rules can apply on top. Healthcare providers in Dubai must consider Dubai Health Authority requirements and federal health data rules, and financial institutions onshore may be subject to Central Bank expectations.

Onshore Dubai or mainland free zones: UAE federal PDPL.
DIFC licensed entities: DIFC Data Protection Law No. 5 of 2020 and its Regulations.
Healthcare, financial services and telecoms: additional sector obligations.
Serving EU or Saudi customers: GDPR or Saudi PDPL may also be relevant.

What the DIFC Commissioner expects

The DIFC regime is closely modelled on European standards. Controllers are expected to register with the Commissioner, pay annual notification fees, maintain records of processing and, where processing is high risk, appoint a Data Protection Officer and carry out impact assessments.

DIFC entities must also meet requirements on transfers outside the DIFC, breach notification to the Commissioner, and specific rules on processing using new technologies such as AI systems.

Common gaps we see in Dubai organisations

No clear view of which regime applies across group entities in Dubai, DIFC and abroad.
Privacy notices and consent flows copied from GDPR templates without local adjustment.
Cross border transfers to cloud and group providers without a documented basis.
No tested breach response process or notification timeline.
DPO role unassigned or held by someone without time or independence.

How we help Dubai and DIFC businesses

Our senior specialists support Dubai organisations with regime scoping, gap assessments, data mapping, DIFC registration and DPO support, privacy notices, transfer assessments and AI governance. Many clients start with a DEX self assessment, then move to a fractional DPO retainer for ongoing support.

Common questions

Does the UAE PDPL apply to DIFC companies?

Generally no. DIFC licensed entities are governed by the DIFC Data Protection Law instead, though group companies outside the DIFC may still fall under the federal law.

Do I need a Data Protection Officer in the DIFC?

A DPO is required for DIFC controllers and processors carrying out high risk processing on a systematic or regular basis, and for certain public authorities. Many organisations appoint a fractional DPO to meet this.

Do you offer data privacy consulting in Dubai?

Yes. Digital Ethics Advisors works with organisations across Dubai, the DIFC and the wider GCC on data privacy, data protection and AI governance advisory.