DIFC Data Protection Law No. 5 of 2020chapter by chapter

Regulation 2.1.1-2.1.4; 2.22.1 Records of Processing Activities (RoPA)

A Controller or Processor must record, at minimum, the Article 15(1)(a)-(h) information in an electronic or similar database format covering its Personal Data Processing operations (lawful basis, consent records, Controller/Processor contracts, data location, DPIAs, breach records, Special Category processing information, retention/erasure policies), keep the RoPA accurate and up to date, and make it available to the Commissioner on request. This does not apply to a Controller/Processor employin

Regulation 3.1.1-3.1.23.1 Contents of the Notification

A Controller or Processor must notify the Commissioner of Personal Data Processing operations covering Personal Data, Special Categories of Data, and transfers to non-adequate jurisdictions, with the notification containing a description of the Processing, its purpose, the Data Subjects/classes involved, the Personal Data classes involved, and a statement of transfer jurisdictions and their adequacy status.

Regulation 3.2.13.2 Time for filing Notifications

The Commissioner notification must be filed within 30 days of commencing the relevant Processing, on every anniversary of the initial notification where Processing continues, and within 30 days of any Processing being carried out in a manner different from that described in the initial notification.

Regulation 3.33.3 Fees

A Controller or Processor must pay the applicable Appendix 1 fees (registration, annual renewal, particulars amendment -- tiered by Category I/II/III entity type).

Regulation 4.1.1-4.1.24.1 Submission of Annual Assessment

A Controller must submit its Annual Assessment via the DIFC Client Portal in the Commissioner-published format, content and deadline; if the submission is missed or incomplete, the Controller must respond to any Commissioner direction to submit or complete it within the further period allowed, with proper justification for any extension sought.

Regulation 4.2.1-4.2.24.2 Inspections

A Controller or Processor receiving a Commissioner notice of inspection must respond to questions asked or information requested within the time prescribed in the notice; if the response is missed or incomplete, it must comply with any Commissioner direction to properly respond within a further period, with proper justification for any extension.

Regulation 6.1.36.1 Processing complaints and procedures for mediation

Where the Commissioner concludes a mediation/complaints process by issuing a written direction requiring a Controller to do or cease doing an act or thing, the Controller must comply with the direction within the specified time.

Regulation 7.2.1-7.2.5; 7.3.1-7.3.27.2 Notice of objection; 7.3 Application to the Court

A Controller or Processor wishing to object to an administrative fine must file a Notice of Objection (Appendix 2, Notice 2) detailing every matter it believes should be considered; alternatively, or if the fine remains unpaid after the payment period, it may apply to the Court within 30 days of the Commissioner's confirmed decision to prevent recovery of the fine as a debt due.

Regulation 8.18.1 Article 41 Breach - Report to Commissioner

A Controller must report a Personal Data Breach to the Commissioner (by email to commissioner@dp.difc.ae or via the DIFC website form) without undue delay after becoming aware of the breach.

Regulation 8.2.1-8.2.28.2 Article 42 Breach - Report to Data Subject

Where the Commissioner directs a Controller to communicate a Personal Data Breach to affected Data Subjects, or to make a public communication about it, the Controller must comply using the reasonable means directed (e.g. email, letter, media).

Regulation 8.4.2-8.4.48.4 Inadvertently Obtaining Personal Data

A person (Party A) who inadvertently obtains data must reasonably attempt to identify and notify the previous controller/possessor (Party B), requesting removal or acceptance within 30 days; if Party B recovers it within 30 days, Party A must expunge it from its records; if Party B is unreachable, unidentifiable, or does not recover it within 30 days, Party A must notify the Commissioner, provide possession/control and details of how it was obtained, and take reasonable steps to expunge it from

Regulation 9.2.1-9.2.29.2 Notice and Default Settings

A Controller must provide clear, transparent, intelligible information, in plain language, at the time of collecting Personal Data, on whether it will be used to enable Digital Communications and Services, and must give the Data Subject an opportunity to refuse or opt out the first time such data is collected for that purpose.

Regulation 9.2.39.2 Notice and Default Settings

Privacy preferences must default to collecting no more than the minimum Personal Data necessary; on first platform/application use, the Data Subject must be offered colour-neutral, non-promoting selection boxes/buttons, plain-language explanations of preferences and how to change them, and an easily accessible ongoing means (e.g. preferences link/dashboard) to alter privacy preferences.

Regulation 9.3.1-9.3.39.3 Conditions for Consent in Digital Communications and Services

A Controller relying on consent for Digital Communications and Services Processing must obtain it via a clear affirmative act (unticked selection box or similar), with language clarifying the collection reason/purpose and a link to accessible rights information including consent withdrawal; pre-ticked boxes, silence, or inactivity are not acceptable consent methods.

Regulation 9.3.49.3 Conditions for Consent in Digital Communications and Services

A Controller relying on previously obtained information/consent (soft opt-in) for Digital Communications and Services must ensure: the Personal Data was obtained directly from the Data Subject in the course of a sale/negotiation of a similar product/service; the new communications relate to similar products/services; an unsubscribe/opt-out opportunity is offered at any time or with each communication; proportionate measures assess ongoing consent validity (including re-affirming consent where ex

Regulation 10.2.110.2 Obligations of Deployers and Operators of Systems

Where Personal Data is Processed for use in, or to enable the learning processes of, an autonomous or semi-autonomous System, the Deployer or Operator of that System must adhere to the general Article 9 requirements and principles for Processing Personal Data.

Regulation 10.2.2(a)-(b)10.2 Obligations of Deployers and Operators of Systems

A Deployer or Operator of a System used in an application/website must provide clear, explicit notice on initial use/access alerting users to the System's non-human-initiated Processing and its impact on individual rights, including a comprehensive description of human-defined processing purposes, self-defining principles/limits, System output and its use, design safeguards, and applicable codes/certifications/principles.

Regulation 10.2.2(c)-(h)10.2 Obligations of Deployers and Operators of Systems

On request by an affected/relevant party or the Commissioner, a Deployer or Operator must provide evidence of System audit/certification compliance, human-intervention algorithms (for unfair/discriminatory impact, law-enforcement access, or Regulation 9 non-compliance risk) with related risk/impact assessments, and a register covering use cases, Data Subject access mechanisms, automated-decision-only use, Third Party/Requesting Authority Processing arrangements and lawful bases, Joint Controller

Regulation 10.3.1-10.3.210.3 General Requirements for AI Autonomous and Semi-Autonomous Systems

No person may use, operate, provide, offer or commercially make available a System to Process Personal Data unless it Processes only for human-defined/approved purposes (or self-defined purposes within human-defined principles/limits) and is designed to the Ethical, Fairness, Transparency, Secure and Accountability principles, complying with any Commissioner-established audit/certification requirements.

Regulation 10.3.310.3 General Requirements for AI Autonomous and Semi-Autonomous Systems

No person may use, operate, provide, offer or commercially make available a System for High Risk Processing Activities unless the applicable Commissioner audit/certification requirements exist and are met, the System Processes solely for human-defined/approved purposes, and the Deployer or Operator has appointed an Autonomous Systems Officer (ASO) with DPO-equivalent competencies, status, role and tasks.