# DIFC & ADGM Data Protection: DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021

> GDPR-aligned data protection laws for firms in the UAE’s financial free zones.

URL: https://securei3.com/standards/difc-adgm-data-protection/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


Firms in the Dubai International Financial Centre and Abu Dhabi Global Market follow their own data protection laws, closely modelled on the GDPR, enforced by the DIFC Commissioner of Data Protection and the ADGM Office of Data Protection. Obligations include accountability, data protection officers in some cases, impact assessments, breach notification and transfer rules.

We build privacy programmes that satisfy free-zone laws together with the federal PDPL for onshore entities in the same group.

## Who it is for

- DIFC and ADGM registered firms
- Groups with free-zone and onshore UAE entities

## Benefits

- One privacy programme across UAE regimes
- Regulator-ready accountability

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Does the federal PDPL apply in DIFC?

No. DIFC and ADGM have their own data protection laws, and the federal PDPL excludes them. Groups with entities in several zones must address each regime.

Related: https://securei3.com/standards/uae-pdpl/, https://securei3.com/standards/gdpr/, https://securei3.com/standards/iso-27701/

Contact: https://securei3.com/contact/: info@securei3.com