DIFC Enacts Key Amendments To Data Protection Law

Introduction

On 8 July 2025, the Dubai International Financial Centre ("DIFC") enacted a comprehensive set of legislative amendments following a public consultation paper released in February 2025.

A focal point of these amendments is the Data Protection Law ("DPL"), which has undergone substantial revision to clarify extra-territorial applicability, address data sharing with authorities and reinforce the right of action of data subjects.

Article 6: Clarifying the Scope of Application

Article 6 of the DPL clarifies the scope of application of the DPL in respect of when processing is considered to occur "in the DIFC."

The amendment makes clear that the DPL applies not only to entities incorporated in the DIFC but also to non-DIFC controllers and processors who process personal data of individuals who reside or work in the DIFC. This applies whether the data processing is conducted directly or indirectly through stable arrangements with third parties