Jurisdiction: Dubai, United Arab Emirates
Issued: 8 July 2025 | In Force: 15 July 2025
Law Reference: DIFC Laws Amendment Law No. 1 of 2025
Key Developments
1. Private Right of Action Introduced
• Data subjects can now sue controllers or processors directly in the DIFC Courts, without first going through the DIFC Commissioner.
• Claims can cover financial and non-financial loss, including emotional distress.
2. Extraterritorial Scope Clarified
The law now applies to:
• Applies to all entities incorporated in the DIFC, regardless of where data is processed.
• Covers non-DIFC entities processing data in the DIFC under stable arrangements.
• The clause relying on physical presence to define DIFC processing has been deleted.
3. Revised Rules on Public Authority Requests & Transfers
Entities must now:
• Ensure that requests from public authorities are valid and proportionate.
• No longer ensure that those authorities respect individual data rights.
• Prepare for reassessments of third-country transfer adequacy by the Commissioner.
4. Higher Penalties for Non-Compliance
Violation and Fine:
• Missing annual assessment — Up to USD 25,000
• No DPIA for high-risk processing — Up to USD 50,000
• Improper/non-compliant data sharing — Up to USD 50,000
Next Steps for Businesses
Update internal policies:
• Risk assessments
• Data-sharing protocols
• International transfer justifications
Label your data:
• Classify and tag datasets by sensitivity, purpose, and geography
• Enables better risk management, auditability, and accountability
Prepare for direct litigation:
• Strengthen documentation and response processes
• Ensure transparency and traceability in processing activities
Source: https://lnkd.in/gakep-FD