The UAE has three main data protection regimes. Entities established in the Dubai International Financial Centre follow DIFC Data Protection Law No. 5 of 2020; entities in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021; and businesses on the mainland and in most other free zones follow the federal PDPL, Decree-Law 45/2021. The starting test is where the entity processing the data is established, with sector laws for health and banking on top.
- difc data protection law vs uae pdpl
- adgm data protection regulations 2021
- does uae pdpl apply in free zones
- which data protection law applies to my company in dubai
- difc data protection registration
Which data protection law applies to your company?
The answer starts with one question: where is the entity that processes the data established? If it is in the Dubai International Financial Centre (DIFC), your reference is DIFC Data Protection Law No. 5 of 2020. If it is in Abu Dhabi Global Market (ADGM), it is the ADGM Data Protection Regulations 2021. On the mainland and in most other free zones, the federal PDPL, Decree-Law 45/2021, applies.
The reason for the split is that DIFC and ADGM are financial free zones with their own civil and commercial legal frameworks, designed to be familiar to international financial institutions. That is why the federal law expressly excludes free zones that have their own data protection legislation.
This matters in practice if you are a fintech startup inside one of the two centers, a mainland business serving clients there, or a group with entities in more than one place. If you are mainland only, your core list is the UAE PDPL checklist.
The three regimes at a glance
| Item | DIFC | ADGM | Federal PDPL |
|---|---|---|---|
| Core text | Data Protection Law No. 5 of 2020 and regulations | Data Protection Regulations 2021 | Federal Decree-Law 45/2021 |
| Regulator | DIFC Commissioner of Data Protection | ADGM Office of Data Protection | UAE Data Office (supervision evolving) |
| Who it covers | Entities established in DIFC | Entities established in ADGM | Mainland, most free zones, and processing of residents' data from abroad |
| Model | Closely aligned with the EU GDPR | Closely aligned with the EU GDPR | International principles with local specifics |
| Registration | Required for covered entities | Required for covered entities | Details tied to the executive regulations |
| Maturity | Established, with detailed regulations and guidance | Established, with detailed regulations and guidance | Executive regulations and supervision still developing |
The common ground is large: a legal basis for every processing activity, transparency, data minimization, individual rights, appropriate security, breach notification and limits on transfers outside protected jurisdictions. The bigger differences lie in procedure and in how much published guidance exists.
How do you work out which regime applies?
- 1Identify the legal entity
Which entity collects the data and decides how it is used? Look at the licence, not where the team physically sits.
- 2Find where it is established
DIFC, ADGM, another free zone, or the mainland of one of the emirates.
- 3Check the sector
Health, banking and credit data have their own legislation and regulators that can add requirements.
- 4List your service providers
Hosting, messaging, payments and analytics process your data and need suitable contracts.
- 5Trace the data flows
Does data move between group entities or out of the country? Each transfer may need a basis and safeguards.
| Scenario | Most likely regime |
|---|---|
| A fintech established in DIFC serving clients across the UAE | DIFC law, plus financial regulator requirements |
| An online store licensed by Dubai's Department of Economy and Tourism | Federal PDPL |
| A software company in a free zone without its own data law | Federal PDPL |
| An asset manager in ADGM | ADGM regulations, plus financial regulator requirements |
| A group with one entity in DIFC and one on the mainland | Each entity by its location, with transfer arrangements between them |
Which differences matter in practice?
- Registration with the data protection office, renewed periodically
- Detailed published guidance that helps implementation
- Lists of jurisdictions with adequate protection for transfers
- Clear rules on when a data protection officer is required
- In DIFC, additional rules for processing through autonomous systems such as AI
- Broad reach, including processing of residents' data from abroad
- Many details left to the executive regulations
- Supervision evolving, with a Federal Authority for AI and Data announced
- Exclusions for government data and sectors with their own laws
- The same core principles: consent, rights, security and notification
For a small mainland business, the most important difference is that some procedural details are not final yet, so applying the principles well and watching for updates is usually enough. A company in DIFC or ADGM has clear procedural duties from day one, such as registration, and should handle them before launch.
Multi-entity groups and clients under other regimes
In the UAE many businesses have more than one entity: a head office in DIFC, a sales branch on the mainland, a tech team in another free zone. Or a small mainland company sells a tool to a financial firm in ADGM. In these cases:
- Map which entity collects which data, where it is stored and who can access it.
- Sign intra-group data processing and transfer agreements.
- If you supply a client in DIFC or ADGM, expect a data processing agreement and detailed security questionnaires.
- Keep one privacy policy where possible, clearly naming the responsible entity in each case.
- Make hosting location a deliberate choice; many large organizations prefer data kept in the country or region.
If you are building internal tools for a multi-entity company, see internal tools for UAE companies, and for hosting options see data hosting in the UAE.
How do you build one app that satisfies all three?
The good news is that the technical requirements are very close. If you build your app to the highest common standard, you do not need a separate version per regime, just settings and policies that vary by entity.
Build a bilingual (Arabic and English) client portal for our company with data protection features suitable for DIFC, ADGM and the federal PDPL. In settings, add a 'Responsible entity' field per client (DIFC, ADGM or mainland) and show the matching privacy policy. Use SSO for staff and OTP sign-in for clients. Add roles: owner, data protection officer, staff and client, each seeing only what they need. Log every access, export or deletion of personal data. Add a 'My data' page for clients with export and deletion requests, a dashboard for the data protection officer showing requests and deadlines, and a register of possible breaches with discovery date and actions taken. Encrypt data and host it in-region with daily backups.
Try it in FanannRead more on the Fanann Enterprise and trust and security pages.
Your next steps
- Identify where each entity in your group is established and its governing law.
- If you are in DIFC or ADGM, check registration requirements with the data protection office before launch.
- Map your data and how it flows between entities and out of the country.
- Build your app to the highest common standard: consents, rights, roles, logs and encryption.
- Review your position with a specialist lawyer and follow federal supervision updates.
First know who you are legally and where you are established, then build privacy to one high standard that fits everyone.
Key takeaways
- Where your company is established is the starting point: DIFC, ADGM, or the mainland and other free zones.
- The DIFC and ADGM laws are closely modeled on the EU GDPR, and each has its own regulator and registration.
- The federal PDPL excludes free zones that have their own data protection laws.
- Groups with entities in several places may fall under more than one regime, so plan for it early.
- Building your app to the highest common standard is easier than maintaining a different version per regime.
Frequently asked questions
Does the UAE PDPL apply in free zones?
What is the DIFC data protection law?
How does ADGM data protection differ from the federal law?
My company is in DIFC and my customers are across the UAE. Which law do I follow?
Does my company in DIFC or ADGM need to register with the data protection office?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “DIFC and ADGM data protection vs the federal PDPL: what applies to you” https://fanann.com/en/blog/difc-adgm-data-protection-vs-pdpl/ My question: difc data protection law vs uae pdpl Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.