LexLint

The law for AI, agents, crawlers, and personal data

Law note · United Arab Emirates

DIFC Data Protection Law, comprehensive regime

cite DIFC Law No. 5 of 2020 stage IN FORCE in force since 2020-07-01 kind Comprehensive regime binds private bodies reviewed 2026-08-29

What it requires

  • An app that is a controller or processor established in or targeting the DIFC free zone must establish a lawful basis for processing personal data, and must obtain explicit consent or another qualifying condition before processing a faceprint, voiceprint, or other biometric identifier used to uniquely identify a natural person, including one derived from a photo, video, or audio recording.

When LexLint raises it

  • crawls_web
  • trains_models
  • generates_content
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
Excludes recording-derived identifiers
No

What we found

The DIFC Data Protection Law is a separate statute of the Dubai International Financial Centre free zone, in force since 2020-07-01, enforced by the DIFC Commissioner of Data Protection, not the federal Bureau. It applies only within the DIFC's own geographic free-zone footprint (Dubai's financial district), not to a UAE business operating onshore elsewhere. Controller and Processor are General Data Protection Regulation (GDPR)-style defined roles (Sched. 1). Sched.

1's Special Categories of Personal Data includes "genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person," with no source-based exclusion for an identifier derived from a recording, so processing such data ordinarily requires explicit consent or another qualifying condition.

The DIFC framework is close to full GDPR Chapter III parity on data-subject rights (portability at Art. 37, automated decision-making and profiling safeguards at Art. 38, non-discrimination at Art. 39, confirmed by the Law's own index), and Arts. 26-27 set a near-identical adequacy-plus-alternative-safeguards structure to the federal PDPL for cross-border transfer.

The individual operative texts of these articles, and of the Part 7 breach-notification provisions and any private-right-of-action provision, were not each pulled verbatim in this research pass; this document records the structure the index confirms rather than asserting undconfirmed detail.

Primary source

official consolidated statute text, published at assets.u.ae

← Back to the example  ·  Lint your app →