DIFC Law · Dubai International Financial Centre
DIFC Law No. 5 of 2020 — Data Protection Law
A reference record of DIFC Law No. 5 of 2020, drawn from the instrument's own official text. It sets out how the law is organised — its Parts, its article count and its length — and links to the text itself. It does not interpret the law or offer advice on it.
Where this instrument arises in our work: Data Protection
At a glance
| Citation | DIFC Law No. 5 of 2020 |
| Short title | Data Protection Law |
| Instrument type | DIFC Law |
| Enacted | 2020 |
| Jurisdiction | Dubai International Financial Centre |
| Parts | 10 |
| Numbered articles | 65 |
| Length of official text | 54 pages |
How DIFC Law No. 5 of 2020 is organised
The 10 Parts below are the instrument's own divisions, in the order the official text sets them out.
| Part | Heading |
|---|---|
| Part 1 | Introduction And Scope |
| Part 2 | General Requirements |
| Part 3 | Joint Controllers And Processors |
| Part 4 | Data Export And Sharing |
| Part 5 | Information Provision |
| Part 6 | Rights Of Data Subjects |
| Part 7 | Personal Data Breaches |
| Part 8 | The Commissioner |
| Part 9 | Remedies, Liability And Sanctions |
| Part 10 | General Exemptions |
What DIFC Law No. 5 of 2020 covers, article by article
The 62 article headings below are the instrument's own, reproduced in its order. They are a map of the law, not a summary of it — for the wording of any article, read the official text.
- Title and repeal
- Legislative authority
- Date of enactment
- Commencement
- Purpose of this Law
- Application of the Law
- Schedules
- Administration of the Law
- General requirements
- Lawfulness of Processing
- Processing of Special Categories of Personal Data
- Consent
- Legitimate interests
- Accountability and notification
- Records of Processing activities
- Designation of the DPO
- The DPO: competencies and status
- Role and tasks of the DPO
- DPO Controller assessment
- Data protection impact assessment
- Prior consultation
- Cessation of Processing
- Joint Controllers
- Processors and Sub-processors
- Confidentiality
- Transfers out of the DIFC: adequate level of protection
- Data sharing
- Nature of Processing information
- Right to withdraw consent
- Rights to access, rectification and erasure of Personal Data
- Right to object to Processing
- Right to restriction of Processing
- Controller's obligation to notify
- Right to data portability
- Automated individual decision-making, including Profiling
- Non-discrimination
- Methods of exercising Data Subject rights
- Notification of Personal Data Breaches to the Commissioner
- Notification of Personal Data Breaches to a Data Subject
- Appointment of the Commissioner
- Removal of the Commissioner
- Resignation of the Commissioner
- Powers, functions and objectives of the Commissioner
- Delegation of powers and establishment of advisory committee
- Codes of conduct
- Monitoring of approved codes of conduct
- Certification schemes
- Certification and Accreditation
- Production of information
- Regulations
- Funding
- Annual budget of the Commissioner
- Accounts
- Audit of Commissioner
- Annual report
- Directions
- Lodging complaints and mediation
- General contravention
- Imposition of fines
- Application to the Court
- Compensation
- General exemptions
Decisions applying this instrument
DIFC Courts decisions on this estate that cite it, most recent first. Each link goes to our record of that decision, not to commentary on it.
- SCT 029/2023 — Mintil v Mester [2023] DIFC SCT 029 16 Feb 2023
- CFI 019/2009 — CFI 019/2009 - Order 31 Aug 2009
Primary sources
Everything on this page comes from these two. Links go to the issuing legislator.
Acting on DIFC Law No. 5 of 2020
This page is a record, not advice. If data protection law bears on a matter you are dealing with, speak to us about the facts.