Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Arab Emirates (AE) · Module Detail

United Arab Emirates: Cross-Border & Adequacy

← Full United Arab Emirates overview Build report with United Arab Emirates Request deeper dive

#

Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.

Primary frameworkDIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021
Supervisory authorityDIFC Commissioner of Data Protection
Traffic-light rationale — AmberStrong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending.

Sub-modules (6)

Transfer MechanismsGreen

ADGM Regulations provide transfer mechanisms mirroring GDPR — SCCs, BCRs, derogations, and adequacy assessment criteria.

Claims (1):

  • ADGM Data Protection Regulations provide transfer mechanisms similar to GDPR, including standard contractual clauses, binding corporate rules, derogations, and adequacy assessment criteria, with neither ADGM nor GDPR requiring data localisation or residency.

Adequacy ReceivedRed

The DIFC's 2020 law was explicitly framed to support DIFC's pursuit of adequacy recognition from the European Commission and the UK; the UK DCMS announced an adequacy assessment of DIFC in 2021, but a confirmed outcome was not located in available sources.

Claims (2):

  • The DIFC explicitly stated that enactment of the Data Protection Law and adoption of its Regulations was intended to support DIFC's pursuit of adequacy recognition from the European Commission and the UK.
  • In 2021 the UK's Department for Digital, Culture, Media and Sport announced it would conduct an adequacy assessment of the DIFC; a confirmed final outcome of that assessment was not located in available sources.

Adequacy GrantedGreen

DIFC has declared adequacy toward EU member states, the UK, Canada, Singapore and South Korea, and in August 2023 mutually recognized California, the first US state so recognized.

Claims (2):

  • DIFC has declared adequacy with a number of jurisdictions including EU member states, the UK, Canada, Singapore, and South Korea.
  • On August 9, 2023, the California Privacy Protection Agency and DIFC recognized each other's frameworks, marking the first time DIFC granted this adequacy-type status to a U.S. state.

Sccs And BcrsGreen

The DIFC Commissioner has approved two sets of standard contractual clauses for transfers to non-adequate jurisdictions; ADGM also provides for BCRs and SCCs.

Claims (1):

  • The DIFC Commissioner has approved two sets of standard contractual clauses that may be used for transfers outside the DIFC to a non-adequate jurisdiction.

Transfer Impact AssessmentRed

No AE-specific formal Transfer Impact Assessment requirement (akin to post-Schrems II EU practice) was confirmed for DIFC, ADGM or the federal PDPL in available sources.

Absence provenance: unavailable. Searched: UAE PDPL data subject rights right to access erasure objection cross border transfer adequacy list.

Data LocalisationAmber

Neither the ADGM Regulations nor the GDPR (as comparator) require data localisation or residency; no general federal PDPL localisation mandate was confirmed, though sector-specific health-data storage standards may impose de facto constraints.

Claims (1):

  • Neither the ADGM Regulations nor the GDPR require data localisation or residency for personal data.
Category narrative70 words

Cross-border transfer detail is best documented at the DIFC and ADGM free-zone level: both provide GDPR-style mechanisms (adequacy, SCCs, BCRs, derogations) with no data-localisation mandate, and the DIFC has declared adequacy toward the EU, UK, Canada, Singapore, South Korea and — since August 2023 — California. Federal PDPL-specific transfer-mechanism detail, and confirmation of any reciprocal adequacy determination received by the UAE from the EU/UK, was not located in available sources.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (7)
  1. ProbableOneTrust DataGuidance — ADGM Data Protection Regulations provide transfer mechanisms similar to GDPR, including standard contractual clauses, binding corporate rules, derogations, and adequacy assessment criteria, with neither ADGM nor GDPR requiring data localisation or residency.observed
  2. ProbableOneTrust DataGuidance — The DIFC explicitly stated that enactment of the Data Protection Law and adoption of its Regulations was intended to support DIFC's pursuit of adequacy recognition from the European Commission and the UK.observed
  3. UncertainOneTrust DataGuidance — In 2021 the UK's Department for Digital, Culture, Media and Sport announced it would conduct an adequacy assessment of the DIFC; a confirmed final outcome of that assessment was not located in available sources.observed
  4. ProbableCPPA — DIFC has declared adequacy with a number of jurisdictions including EU member states, the UK, Canada, Singapore, and South Korea.observed
  5. ProbableCPPA — On August 9, 2023, the California Privacy Protection Agency and DIFC recognized each other's frameworks, marking the first time DIFC granted this adequacy-type status to a U.S. state.observed
  6. ProbableDIFC Authority — The DIFC Commissioner has approved two sets of standard contractual clauses that may be used for transfers outside the DIFC to a non-adequate jurisdiction.observed
  7. ProbableOneTrust DataGuidance — Neither the ADGM Regulations nor the GDPR require data localisation or residency for personal data.observed