UAE Edition 
Egypt Edition 
Saudi Edition 
MENA <> India Corridor 
Logistics (MENA) 
Climate (MENA) 
Share
Individuals can now directly sue for data breaches at DIFC: New amendments (pdf) to the Dubai International Financial Center’s (DIFC) data protection, insolvency, and security laws, which took effect on 15 July, the authority clarify how individuals can lodge complaints of personal data breaches, as well as rules governing financial collateral arrangements.
The revised Data Protection Law now introduces a private right of action, allowing individuals to directly file claims in DIFC courts if their personal data is processed in breach of the law. Claims can cover material and non-material damage, including emotional distress, and are separate from any enforcement by the Commissioner of Data Protection.
What does this mean for you if you’re a DIFC-registered firm? Tighten your data governance and risk management and oversight or face potential litigation from any individual who claims their personal data was breached in their interactions with you.
PLUS: You could face a new fixed penalty if you fail to submit an annual data processing notification to the DIFC Commissioner.
Broadened scope: The law also now encompasses more data processing scenarios, including any undertaken directly by DIFC-registered entities, regardless of where it occurs, as well as entities processing personal data within the DIFC as part of stable arrangements — even if those entities aren’t registered with DIFC.
Cross-border data transfers will also be getting stricter treatment. Cross-border transfers to public authorities in other countries will require adequacy assessments that consider whether the recipient’s use of data serves a proportionate public interest and whether judicial remedies are available to affected individuals.
Changes to the security and insolvency laws are more for clarification purposes, but the key outcome from both are more simplified procedures when ending and defaulting on a creditor agreement, following clear terms agreed in the initial creditor agreement whenever possible, and including digital assets under both laws.
