ObiterDictum.

A financial free zone, effectively one business district in Dubai, with its own courts and its own body of law separate from the rest of the UAE. Its data law binds only companies registered there. Though it occupies only a small district, the DIFC is one of the world's leading financial centres, home to thousands of registered companies including many of the region's banks, funds and international firms, so its rules reach a great deal of significant activity.

Only if your entity is established in the DIFC. If not, this law does not apply, though the UAE's national law may.

A familiar GDPR-style set: a lawful basis, transparency, data-subject rights (with a one-month deadline to answer access requests), security, breach handling, a data protection officer where required, and safeguards for transfers out of the zone.

A dedicated rulebook for AI, "Regulation 10", which makes the business deploying an AI system accountable for what the system does. It introduces specific roles ("Deployer" and "Operator"), requires a register of AI processing, expects privacy by design, and created a named oversight role, the Autonomous Systems Officer. Proposed 2026 changes would add "safety" as a design principle, detail the Officer's duties, and create an ASO certification. Those changes are proposed, not yet law: the consultation closed in July 2026 and the results are awaited.