United Arab EmiratesDIFC Data Protection Law, comprehensive regime
In force since .
A comprehensive regime rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Self, Regulator
- Where the report goes
- Filed with regulator, Produced on request
What it requires
- An app whose Controller or Processor is incorporated in the DIFC, or that Processes Personal Data in the DIFC as part of stable arrangements, must have a lawful basis under Article 10 for Processing Personal Data, and must obtain the Data Subject's explicit consent or satisfy another condition in Article 11 before Processing a faceprint, voiceprint, or other biometric identifier used to uniquely identify a natural person, including one derived from a photo, video, or audio recording.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Under Article 6(3)(b), when does a Controller or Processor incorporated outside the DIFC Process Personal Data 'in the DIFC' 'as part of stable arrangements', a term the Law does not define?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 15 makes a controller keep a written record of its processing activities, and a processor a record of the processing it carries out for a controller. Article 41(6) makes the controller document every personal data breach, with its facts, effects and the remedial action, in a form that lets the Commissioner verify compliance and available without delay on request. Article 12(2) and (9) make a controller relying on consent able to show that consent was freely given and that its methods for recording consent and its withdrawal are in place and periodically evaluated. The items of the Article 15 record and of the breach record are not log content values, so only the consent state is coded. The law sets no period for keeping these records. The Article 6(3)(b) prong that reaches processing in the DIFC under stable arrangements is read with the incorporation prong as establishment.
- Kind
- Explicit
- As of
- Provision
- Article 15 (records of processing activities), with Article 41(6) (documenting every breach) and Article 12(2) and (9) (demonstrating consent)
- Trigger
- personal_data_processing
- security_incident
- consent_or_optout
What this law does
The DIFC Data Protection Law is a separate statute of the Dubai International Financial Centre free zone, in force since and administered by the DIFC Commissioner.
Article 6 applies it in the jurisdiction of the DIFC, to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC whether or not the Processing takes place in the DIFC, and to Processing in the DIFC by a Controller or Processor of any place of incorporation as part of stable arrangements, including transfers of Personal Data out of the DIFC. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles (Schedule 1).
Schedule 1's Special Categories of Personal Data includes "genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person," with no source-based exclusion for an identifier derived from a recording, and Article 11 bars the Processing of Special Categories of Personal Data unless a listed condition applies, the first being the Data Subject's explicit consent.
Part 6 gives a Data Subject the rights to withdraw consent, to access, rectification and erasure, to object to Processing, to restriction of Processing, to data portability (Article 37), to object to a decision based solely on automated Processing, including Profiling, and to require manual review of it (Article 38), and to non-discrimination for exercising those rights (Article 39).
Articles 26 and 27 allow a transfer out of the DIFC only where the destination ensures an adequate level of protection or the transfer rests on appropriate safeguards, a specific derogation or the limited circumstances in Article 27(4).
A Controller must notify the Commissioner as soon as practicable of a Personal Data Breach that compromises a Data Subject's confidentiality, security or privacy (Article 41), and must communicate the breach to an affected Data Subject when it is likely to result in a high risk to the Data Subject's security or rights (Article 42).
Article 64A gives a Data Subject who suffers damage by reason of a contravention of the Law the right to apply to the Court for compensation from the Controller or the Processor. This row follows the consolidated version of July 2025, as amended by DIFC Laws Amendment Law No. 1 of 2025.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .