Why the free zones are treated separately
DIFC and ADGM are common law jurisdictions with independent legal systems and their own data protection legislation: DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021. Each has a commissioner with supervisory and enforcement powers.
The practical consequence is that a UAE group can be subject to two or three regimes at once, with a federally regulated entity, a DIFC entity and an ADGM entity holding overlapping data. Running a single programme with jurisdictional annexes is usually cleaner than maintaining separate ones.
Lawful basis and accountability
Both regimes take a GDPR style approach: a list of lawful bases in which consent is one option rather than the default, an explicit accountability principle, and requirements for records, notices and assessments. Legitimate interests is available in both, subject to a balancing exercise.
The accountability framing matters. Under these laws, being able to evidence your decisions is itself a requirement, not simply useful in an investigation.
- Consent, contract, legal obligation, vital interests, public interest and legitimate interests.
- Written records of processing activities, maintained and kept current.
- Data protection impact assessments for high risk processing.
- Privacy notices that reflect what actually happens to the data.
- Written contracts imposing obligations on processors.
Registration and notification
DIFC entities must notify the Commissioner of Data Protection of their processing operations and keep that notification current, with annual renewal and fees. ADGM operates its own notification regime with the Office of Data Protection. Lapsed or inaccurate filings are an easily avoided source of enforcement exposure, and they are visible to the regulator without any investigation.
Data protection officer thresholds
Both regimes require a data protection officer in defined circumstances, broadly where the entity carries out high risk processing activities, and DIFC expects the appointment to be notified. Where an appointment is not mandatory, the accountability obligations still need an owner, so most entities assign the responsibility formally regardless.
Transfers out of the zone
Transfers to a jurisdiction without an adequate level of protection require appropriate safeguards, such as standard contractual clauses, binding corporate rules, or a permitted derogation. Both regimes publish or recognise adequacy positions, and DIFC has specific provisions covering transfers in response to foreign authority requests.
Note that a transfer from a DIFC entity to a mainland UAE entity is a transfer for these purposes. Intra group flows are where this is most often overlooked.
Breach notification
Both regimes require notification to the relevant commissioner where a breach compromises a data subject's confidentiality, security or privacy, with tight timeframes, and communication to affected individuals where there is a high risk to them. As with the federal law, the deciding factor is whether your detection and escalation route actually works under pressure.
Common questions
Does the UAE federal PDPL apply to DIFC and ADGM entities?
Generally no. Entities in those financial free zones are governed by the zone's own data protection law, and the federal law carves out free zones with their own regimes. A group with mainland and free zone entities will be dealing with both.
Do we need to register with the DIFC Commissioner?
DIFC entities carrying out processing are required to notify the Commissioner and keep that notification current, with annual renewal. ADGM has its own notification process with its Office of Data Protection.
Is a DIFC programme enough for GDPR?
It gets you a long way, because the DIFC law is closely modelled on European standards, but it is not automatic. If you offer goods or services to individuals in the EU or monitor their behaviour, GDPR applies in its own right and needs its own assessment.
Is moving data from DIFC to mainland Dubai a cross border transfer?
Yes, for the purposes of the DIFC law. The receiving jurisdiction is separate, so the transfer needs a lawful route and appropriate safeguards, even between entities in the same group.