DIFC and ADGM Data Protection Compared

Why three regimes exist at once

The United Arab Emirates has a federal data protection law and two financial free zones that operate their own. This is not an oversight. DIFC and ADGM are common-law jurisdictions with independent legislative authority, established so that international financial firms could operate under a familiar legal framework.

The consequence for a data protection programme is concrete. Where your entity is registered determines which law applies, which regulator supervises you, and which penalty regime you face.

Which regime applies where

An entity registered in the Dubai International Financial Centre sits under DIFC Data Protection Law No. 5 of 2020. Its supervisor is the DIFC Commissioner of Data Protection.

An entity registered in Abu Dhabi Global Market sits under the ADGM Data Protection Regulations 2021. Those regulations came into force on 14 February 2021, replacing the 2015 regulations. The supervisor is the ADGM Office of Data Protection.

An entity registered anywhere else in the United Arab Emirates sits under the federal Personal Data Protection Law, supervised by the UAE Data Office.

Registration is the test, not physical location and not where customers are. An entity registered in Dubai but outside the DIFC perimeter does not gain DIFC status by serving DIFC clients.

What the two free zone regimes have in common

Both are modelled on the European General Data Protection Regulation. ADGM acknowledged the influence of the DIFC law of 2020 when drafting its own update, and both took GDPR as the benchmark.

That shared origin produces substantive overlap. Both recognise the same lawful bases for processing: consent, contract, legal obligation, public interest, legitimate interest and vital interest. Both require consent to be explicit, informed, freely given and withdrawable.

Both give data subjects a comparable set of rights. Both require a data protection officer in defined circumstances. Both require that personal data transferred abroad receives an adequate level of protection.

Both also set breach notification obligations that run without undue delay, with 72 hours as the outer bound familiar from GDPR.

Where the two regimes differ

The clearest practical difference is enforcement exposure.

The DIFC Commissioner of Data Protection can issue administrative fines, and the maximum administrative fine under the DIFC regime is one hundred thousand US dollars. The ADGM regulations carry a higher ceiling.

Beyond penalties, the differences are procedural rather than conceptual. Each zone maintains its own registration, notification and transfer mechanisms, and each publishes its own guidance. A control set designed for one will map onto the other, but the filings will not.

The trap for groups

A group with entities in more than one jurisdiction does not get to pick. A DIFC entity, an ADGM entity and a mainland entity within the same group answer to three different supervisors under three different texts.

That means three notification paths and three sets of records, even where the underlying security controls are shared infrastructure. Consolidating the controls is sensible. Consolidating the compliance obligations is not available.

Design accordingly. One control set, three evidence packs. A programme built the other way around produces three control sets and satisfies none of the supervisors efficiently.

What transfers from a GDPR programme

An organisation that already runs a GDPR programme has most of the substance. The lawful bases, the records of processing, the data subject request process and the transfer assessments all carry across in principle.

What does not carry across is the paperwork. Registration, notification routing and the supervisor relationship are specific to each zone, and a GDPR filing satisfies neither. Treat a GDPR programme as the control baseline and the zone requirements as the filing layer on top.

How this interacts with the security regimes

Data protection and information security obligations run in parallel rather than in sequence.

A DIFC-authorised firm sits under the DIFC data protection regime. If it is regulated by the DFSA, it sits under DFSA Technology and Risk Management rules as well. Those are separate obligations with separate evidence.

A Dubai government supplier may sit under DESC ISR v3 and its 13 control domains through contract. Its personal data obligations run under whichever regime matches its registration.

An operator of critical national infrastructure sits under the UAE Information Assurance Standard and its 188 controls. That applies regardless of registration, because the standard is federal.

What evidence each regime expects

All three data protection regimes expect appropriate technical and organisational measures, and all three judge appropriateness after an incident rather than before.

Penetration testing produces dated, scoped evidence that the technical measures protecting personal data were tested and that findings were closed. That record supports the appropriateness argument under any of the three regimes, because the standard of proof is the same even where the texts differ.

What testing does not do is satisfy the procedural obligations. Records of processing, notification templates, transfer assessments and officer appointments are separate artefacts under each regime.

What the ransomware data adds

Financial Services carries 11 claimed organisations on this tracker, fourth of 13 sectors. The sector draws 8 distinct ransomware groups, and no single operation dominates it.

That matters for free zone firms specifically. A defence built around the methods of one group covers a small fraction of the observed activity. The notification obligations are identical regardless of which group was responsible.

Where groups usually get this wrong

The common failure is designing for the largest entity and assuming the others inherit. They do not. A mainland entity inside a group led by a DIFC entity still answers to the federal law and to the UAE Data Office, on its own.

How much of the UAE record sits in free zone territory

Financial Services is the sector most associated with both free zones. It holds 11 of the 112 attributed UAE claims on this tracker, which is 10.7% of the published record.

That figure understates free zone exposure rather than measuring it. A DIFC or ADGM registration is a legal address, not an industry, and this tracker records sector rather than jurisdiction. Firms registered in either zone appear in the Professional Services and Technology rows as well, and nothing in the source data separates them.

What the tracker can show	What it cannot show
Sector of the claimed organisation	Free zone of registration
Date the claim was published	Which regime governs the data
Group making the claim	Whether a controller or a processor was affected

The consequence for a firm inside either zone is that the national figures are the wrong benchmark. Obligations follow the registration, and the 11 claims in Financial Services neither confirm nor rule out that a claimed organisation sat inside a zone.

Establish which regime governs your processing before an incident forces the question. The answer determines who receives the notification and on what clock, and it is not derivable from any figure on this site.

Practical sequence

1. List every group entity and record which jurisdiction each is registered in, because the registration determines the regime.
2. Identify the supervisor for each entity, since notification goes to different offices.
3. Build one control set across the group, because the security requirements converge.
4. Build separate notification paths per regime, because the procedural requirements do not.
5. Check whether DFSA Technology and Risk Management rules apply on top of the data protection regime for regulated firms.
6. Keep dated testing evidence, since every regime judges the appropriateness of measures after the fact.
7. Read the federal PDPL guide for any group entity registered outside a free zone.

Sources

Read each text from its issuing authority before acting on any summary, including this one. The comparison above draws on published overviews of both regimes and should be confirmed against the primary sources.

• DIFC, issuing authority for DIFC Data Protection Law No. 5 of 2020
• ADGM, issuing authority for the Data Protection Regulations 2021
• UAE Legislation portal, official text of federal decree-laws