DIFC DPL

Overview

The DIFC DPL is the standalone data protection law for the Dubai International Financial Centre, one of the UAE's three separate data protection regimes. The 2025 amendment significantly strengthened the framework by introducing a private right of action for data subjects in DIFC Courts and increasing penalties. The law includes explicit cookie-specific provisions requiring minimum necessary cookies and easily accessible controls.

What This Means for Your Website

• Consent is required before processing personal data of DIFC users
• Cookie usage must follow the minimum necessary principle
• Cookie controls must be easily accessible to data subjects
• The 2025 amendment allows data subjects to sue directly in DIFC Courts
• Annual DPO assessment submissions must be filed with the Commissioner
• 72-hour breach notification applies
• DPIA is required for high-risk processing activities

Key Requirements

The Commissioner of Data Protection enforces the law with penalties of USD 10,000-50,000 per violation, increased by the 2025 amendment. The cookie-specific provisions requiring minimum necessary cookies and accessible controls are among the most explicit in the Middle East. Data subjects now have a private right of action under the 2025 amendment, allowing them to sue without going through the regulator.

How ConsentStack Handles This

ConsentStack enforces minimum necessary cookie principles and provides easily accessible cookie controls for DIFC users, meeting the explicit cookie requirements of the DPL.