Framework library · United Arab Emirates

DIFC Data Protection Law

DIFC Data Protection Law 2020 and Regulation 10. Published by DIFC Commissioner of Data Protection, version DIFC Law No. 5 of 2020 (amended 2025). Kapālins maps it to 5 controls. 1 of 5 controls are proved by a live signal from the platform, and 4 by the assessment.

Read the source document

Controls mapped
DIFC-14Accountability and security of processingLive signal
DIFC-20Data protection impact assessmentAssessment
DIFC-26Transfers out of the DIFCAssessment
DIFC-41Personal data breach notification to the CommissionerAssessment
DIFC-REG10Autonomous and semi-autonomous systems (Regulation 10)Assessment

Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.

History

How DIFC Data Protection Law got here.

  1. In force

    DIFC Data Protection Law No. 5 of 2020 came into force. DIFC

  2. Amended

    DIFC Laws Amendment Law No. 2 of 2022 amended the Data Protection Law. DIFC

  3. Amended

    DIFC announced amended Data Protection Regulations, including Regulation 10 on autonomous and semi-autonomous systems. DIFC

  4. Amended

    DIFC Laws Amendment Law No. 1 of 2025 amended the Data Protection Law (consolidated July 2025). DIFC

See this framework on your estateAll 42 frameworks