DIFC Data Protection Law No. 5 of 2020
The DIFC's GDPR-aligned data protection law, with DPO appointment and notification requirements.
- Issued by
- DIFC Commissioner of Data Protection
- Applies in
- United Arab Emirates
- Edition
- Current, as published
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Art.5Processing principles and accountabilityPrinciples
- Art.6Lawful basis for processingPrinciples
- Art.13-15Transparency and data subject rightsRights
- Art.28Processor contractsThird parties
- Art.30Records of processing activitiesAccountability
- Art.32Security of processingSecurity
- Art.33-34Breach notification within 72 hoursIncidents
- Art.35Data protection impact assessmentsAccountability
- Art.44International transfersTransfers
How Amoreg keeps you on it.
Enable the DIFC Data Protection Law No. 5 of 2020 and add DIFC Commissioner of Data Protection’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 9 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read DIFC Commissioner of Data Protection’s pages
- Check the library against 9 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: processing principles and accountability
- Rule
- DIFC Data Protection Law No. 5 of 2020, Art.5
- Area
- Principles
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in United Arab Emirates
- DFSA AML Module (DIFC)The AML, CTF and sanctions module of the DFSA Rulebook, aligned to Federal Decree-Law No. 10 of 2025.UAE — DIFC · 8 controls
- ADGM FSRA AML RulebookThe Anti-Money Laundering and Sanctions Rules and Guidance for relevant persons in Abu Dhabi Global Market.UAE — ADGM · 8 controls
- UAE Federal AML/CFT LawThe federal AML/CFT/CPF law and Cabinet Resolution No. 134 of 2025 executive regulations, with goAML reporting.United Arab Emirates · 8 controls
Questions
Does Amoreg watch for changes to the DIFC Data Protection Law No. 5 of 2020?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the DIFC Data Protection Law No. 5 of 2020?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The current edition as published by the issuer, last verified in August 2026; the Monitor records new publications as they appear.