--- title: "United Arab Emirates — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-arab-emirates/cross-border-and-adequacy/ source_html: /jurisdictions/united-arab-emirates/cross-border-and-adequacy/index.html description: "United Arab Emirates — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 7 claims Amber ▾ # Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer deta" generated_at: 2026-10-25T04:46:50Z content_sha256: 80ffa4f0dadec12510d23da4288663c6dc53a1ed67b220b44d230369149e224b generator: "fe-fleet/md-twin@1.0" --- # United Arab Emirates — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacy6 sub-modules7 claimsAmber▾# Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending. Primary framework DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021 Supervisory authority DIFC Commissioner of Data Protection Traffic-light rationale — Amber Strong DIFC/ADGM evidence on transfer mechanisms and adequacy granted; federal PDPL transfer detail and adequacy received status are unconfirmed/pending. #### Sub-modules (6) #### Transfer MechanismsGreen ADGM Regulations provide transfer mechanisms mirroring GDPR — SCCs, BCRs, derogations, and adequacy assessment criteria. Claims (1): - ADGM Data Protection Regulations provide transfer mechanisms similar to GDPR, including standard contractual clauses, binding corporate rules, derogations, and adequacy assessment criteria, with neither ADGM nor GDPR requiring data localisation or residency. #### Adequacy ReceivedRed The DIFC's 2020 law was explicitly framed to support DIFC's pursuit of adequacy recognition from the European Commission and the UK; the UK DCMS announced an adequacy assessment of DIFC in 2021, but a confirmed outcome was not located in available sources. Claims (2): - The DIFC explicitly stated that enactment of the Data Protection Law and adoption of its Regulations was intended to support DIFC's pursuit of adequacy recognition from the European Commission and the UK. - In 2021 the UK's Department for Digital, Culture, Media and Sport announced it would conduct an adequacy assessment of the DIFC; a confirmed final outcome of that assessment was not located in available sources. #### Adequacy GrantedGreen DIFC has declared adequacy toward EU member states, the UK, Canada, Singapore and South Korea, and in August 2023 mutually recognized California, the first US state so recognized. Claims (2): - DIFC has declared adequacy with a number of jurisdictions including EU member states, the UK, Canada, Singapore, and South Korea. - On August 9, 2023, the California Privacy Protection Agency and DIFC recognized each other's frameworks, marking the first time DIFC granted this adequacy-type status to a U.S. state. #### Sccs And BcrsGreen The DIFC Commissioner has approved two sets of standard contractual clauses for transfers to non-adequate jurisdictions; ADGM also provides for BCRs and SCCs. Claims (1): - The DIFC Commissioner has approved two sets of standard contractual clauses that may be used for transfers outside the DIFC to a non-adequate jurisdiction. #### Transfer Impact AssessmentRed No AE-specific formal Transfer Impact Assessment requirement (akin to post-Schrems II EU practice) was confirmed for DIFC, ADGM or the federal PDPL in available sources. Absence provenance: unavailable . Searched: UAE PDPL data subject rights right to access erasure objection cross border transfer adequacy list. #### Data LocalisationAmber Neither the ADGM Regulations nor the GDPR (as comparator) require data localisation or residency; no general federal PDPL localisation mandate was confirmed, though sector-specific health-data storage standards may impose de facto constraints. Claims (1): - Neither the ADGM Regulations nor the GDPR require data localisation or residency for personal data. Category narrative 70 words Cross-border transfer detail is best documented at the DIFC and ADGM free-zone level: both provide GDPR-style mechanisms (adequacy, SCCs, BCRs, derogations) with no data-localisation mandate, and the DIFC has declared adequacy toward the EU, UK, Canada, Singapore, South Korea and — since August 2023 — California. Federal PDPL-specific transfer-mechanism detail, and confirmation of any reciprocal adequacy determination received by the UAE from the EU/UK, was not located in available sources. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Evidence 7 Sources and claims (7) - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — ADGM Data Protection Regulations provide transfer mechanisms similar to GDPR, including standard contractual clauses, binding corporate rules, derogations, and adequacy assessment criteria, with neither ADGM nor GDPR requiring data localisation or residency.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/opinion/difc-difc-announces-enactment-data-protection-law) — The DIFC explicitly stated that enactment of the Data Protection Law and adoption of its Regulations was intended to support DIFC's pursuit of adequacy recognition from the European Commission and the UK.observed 2026-07-29 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/uae-difc-announces-adequacy-assessment-uk-dcms) — In 2021 the UK's Department for Digital, Culture, Media and Sport announced it would conduct an adequacy assessment of the DIFC; a confirmed final outcome of that assessment was not located in available sources.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2023/20230809.html) — DIFC has declared adequacy with a number of jurisdictions including EU member states, the UK, Canada, Singapore, and South Korea.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2023/20230809.html) — On August 9, 2023, the California Privacy Protection Agency and DIFC recognized each other's frameworks, marking the first time DIFC granted this adequacy-type status to a U.S. state.observed 2026-07-29 - Probable[DIFC Authority](https://www.dataguidance.com/sites/default/files/data_protection_regualtions_final.pdf) — The DIFC Commissioner has approved two sets of standard contractual clauses that may be used for transfers outside the DIFC to a non-adequate jurisdiction.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._adgm.pdf) — Neither the ADGM Regulations nor the GDPR require data localisation or residency for personal data.observed 2026-07-29