Do DIFC and ADGM firms register for data protection?

Yes, in both. In the DIFC, controllers and processors register by filing a notification of processing with the Commissioner of Data Protection (Article 14(7)), renewed every year. In the ADGM, an entity that processes personal data registers as a data controller and pays a data protection fee on incorporation, then a renewal fee every year.

The DIFC notification is due within 30 days of starting processing, again on each anniversary, and within 30 days of any change. The DIFC Data Protection Regulations set the fees by category: USD 1,250, USD 750 or USD 250 to register, and USD 500, USD 250 or USD 100 to renew, with retail entities in the lowest category. Failing to register carries a fine of up to USD 25,000.

In the ADGM, the amounts are set in the Data Protection Regulations 2021 (Fees) Rules 2021, and the renewal is paid through the Registration Authority’s platform; not paying can bring a fine of up to 150% of the fee. Companies under the federal UAE PDPL have no data protection registration requirement.