Two Free Zones, Two Standalone Regimes
The DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the ADGM Data Protection Regulations 2021 are each modelled closely on the EU GDPR, and both operate independently of the UAE onshore Personal Data Protection Law. A business holding a DIFC or ADGM licence is regulated by that free zone's Commissioner of Data Protection, not the onshore regulator — and where a group spans onshore and a free zone, more than one regime can apply to the same data flow. The first step is always a clear map of which entity processes what, under which law.
Controller and Processor Duties Are Documented, Not Assumed
Both regimes distinguish controllers from processors and require accountability to be demonstrable. Controllers need a lawful basis for each processing activity, a record of processing, transparent privacy notices and data-subject-rights handling. Processors must act only on documented instructions and sign processing agreements that meet the regulations' mandatory clauses. Inter-group arrangements are not exempt: an affiliate processing data on another's behalf still needs a compliant processor agreement.
When a DPO Is Triggered
A Data Protection Officer is required where processing is high-risk — large-scale monitoring, significant volumes of special-category data, or processing that the regulations otherwise flag. Even where a DPO is not strictly mandatory, both Commissioners expect a named accountable owner and an annual notification or assessment filing. Treating the DPO question as a one-off rather than a live trigger is a common gap.
Evidence Pack
- 01 Record of processing activities mapped to each entity, licence and applicable regime (DIFC, ADGM or onshore PDPL).
- 02 Processor agreements and inter-group data-sharing terms with the mandatory clauses in place.
- 03 DPO appointment or assessment, plus the annual notification filed with the relevant Commissioner.
- 04 Cross-border transfer assessments, adequacy reliance and standard contractual clauses where required.
- 05 Breach response runbook with the 72-hour escalation path and a maintained incident log.
Breach Escalation on the Clock
Both regimes require notification of qualifying personal-data breaches to the Commissioner without undue delay — within 72 hours of becoming aware where feasible — and notification to affected individuals where the risk is high. That timeline is unforgiving in practice: the runbook, decision tree and contacts have to exist before an incident, not be drafted during one. An incident log and post-breach remediation record are as important as the notification itself.
Cross-Border Transfers Need a Basis
Transferring personal data out of the DIFC or ADGM requires a lawful transfer mechanism — an adequacy finding for the destination, appropriate safeguards such as standard contractual clauses, or a recognised derogation. With cloud platforms, shared services and group reporting routinely moving data across borders, transfer mapping and the supporting contracts are where readiness is most often found wanting.
Operating Model Recommendation
Treat data protection as a live programme, not an annual filing. A DIFC or ADGM business should maintain a current processing register, a transfer map, signed processor terms, a tested breach runbook and a named accountable owner — reviewed before each annual notification and whenever a new system, vendor or data flow is introduced.