# Financial Free Zones — DIFC & ADGM Data Protection

## DIFC — DP Law No. 5 of 2020, as amended by Amendment Law No. 1 of 2025

**Amendment in force 15 July 2025** — the most significant change since 2020:
- **Statutory private right of action** for data subjects (GDPR-style claims risk)
- **Documented transfer adequacy assessments** required for data exports
- Commissioner may **review/withdraw adequacy decisions**
- **Higher fine tiers** — e.g., up to USD 50,000 for Art. 28 public-authority data-sharing breaches (up from 10,000); new USD 25,000–50,000 tiers for failing to notify processing or conduct required DPIAs

Ongoing obligations: **annual notification/registration** with the Commissioner of Data Protection (fee-bearing), DPO for high-risk processing (incl. systematic monitoring or large-scale special-category data), DPIAs for high-risk processing, breach notification to the Commissioner **as soon as practicable** where a breach compromises confidentiality/security/privacy (data subjects where high risk), transfers via the DIFC adequacy list or appropriate safeguards (SCCs/BCRs). GDPR-family law: EU programmes port well — re-check transfer files against the 2025 assessment duty.

## ADGM — Data Protection Regulations 2021

In force 11 February 2021 (consolidated 2024; no 2025-26 amendment verified). Office of Data Protection (Commissioner):
- **Annual notification + fee** (fixed penalty ~USD 450 for late renewal)
- **72-hour breach notification** to the Commissioner; data-subject notice where high risk
- DPO where required (high-risk processing); DPIAs; RoPA
- Transfers: adequacy decisions or appropriate safeguards; GDPR-family rights set

## Shared guidance
Both zones displace the federal PDPL within their perimeters, but sector overlays still apply (ICT Health Law for patient data; CBUAE for CBUAE-licensed activities). Prudential/conduct regulation sits with **DFSA** (DIFC) and **FSRA** (ADGM) — never cite CBUAE rules for a firm regulated only by DFSA/FSRA.