Licence and client trust
Regulated firms rely on their free zone standing. Failures in data protection or cyber risk invite regulator attention and client questions.
Board and leadership view
Why DIFC and ADGM rules matter to your board
The work is technical. The consequences of getting DIFC and ADGM wrong show up in revenue, liability and reputation, which is why we report on it in the language of the boardroom first.
Liability and enforcement
The DIFC amendments reportedly allow individuals to bring claims, and regulators can fine. Documented, tested controls help you show reasonable measures.
Reputation
Clients choose DIFC and ADGM firms for trust. A public breach damages that quickly.
Deadlines and ownership
Amendments, inspections and client reviews arrive on fixed dates. Name an executive owner for data protection and cyber risk.
Fit
Who usually needs this
Banks, asset managers and brokers
Authorised firms face both the data protection law and regulator expectations for technology and cyber risk.
Fintechs and payments firms
Free zone licences are popular with fintechs, and regulators expect proportionate, tested security.
Technology and SaaS providers in the zones
Customers in the zones will ask for security evidence and data processing terms.
Professional services and family offices
Any entity processing personal data in the zone falls under the data protection regime.
Scope of work
What Summit delivers for DIFC and ADGM
One accountable team takes you from scoping to retest. The people who test your systems are the people who explain the findings to your leadership.
Gap analysis
Your practices measured against the data protection law and your regulator's expectations, with a prioritised fix list.
Penetration testing
Manual testing of systems and applications that hold personal data or client assets.
Control validation
We check that your controls work as described.
Evidence pack
Dated test reports, remediation logs and control evidence organised for regulators and clients.
Remediation support and retest
Guidance while your team fixes findings, then a retest to confirm closure.
Board-ready report
A plain-English summary for directors, with technical detail behind it.
Fixed scope, one team, no hand-offsYou get a named lead, a clear scope document before work starts and a report your leadership, customers and reviewers can read without a translator. We stay with you through your review to answer questions about what we tested and found.
How it works
A realistic preparation roadmap
Timelines are typical ranges, not promises. Yours depends on scope, team size and how much is already in place.
- 1
Confirm your regime
Week 1Decide whether you fall under DIFC, ADGM or both, and which regulator rules apply.
- 2
Run a gap analysis and close gaps
Weeks 2 to 12Compare policies, records and technical controls with the data protection law and your regulator's expectations, then update notices, records, agreements and controls.
- 3
Test your systems
Month 2 to 3Manual penetration testing of systems handling personal data and client assets, with clear findings.
- 4
Remediate and retest
Month 3 to 4Fix findings and retest, so the record shows issues found and closed.
- 5
Brief the board
OngoingGive leadership a clear report on status, residual risk and decisions required.
Deliverables
What your leadership team receives
Every engagement ends with material written for two audiences: a plain-language view for executives and the board, and full technical detail for the engineers who fix things.
Which regime and which regulator apply?
Confirm DIFC, ADGM or both for every entity in the group.
Do we know where personal data goes?
Transfers and vendors are where gaps hide.
Have we tested a breach?
A rehearsed response saves days under pressure.
Who owns data protection?
A named executive keeps accountability clear.
What would we show a regulator tomorrow?
If the answer is unclear, build the evidence now.
The detail
What DIFC and ADGM expect
The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) are financial free zones with their own legal systems. Each has its own data protection regime, separate from the federal UAE law. In the DIFC it is Data Protection Law, DIFC Law No. 5 of 2020, with supporting regulations, enforced by the DIFC Commissioner of Data Protection. In the ADGM it is the Data Protection Regulations 2021, overseen by the ADGM Office of Data Protection.
The DIFC law was amended by Amendment Law No. 1 of 2025, effective 15 July 2025. Reported changes include a private right of action in the DIFC Courts, broader scope over processing in the DIFC and clearer expectations on international transfers. Review the current text for the details that apply to you.
Financial services firms also face technology and cyber expectations from their sector regulator: the Dubai Financial Services Authority (DFSA) in the DIFC and the Financial Services Regulatory Authority (FSRA) in the ADGM. These cover governance, technology and cyber risk management, outsourcing and incident handling. Firms outside financial services still follow the data protection laws.
Key terms in plain English
- Controller and processor
- The controller decides why and how personal data is used; the processor handles it on the controller's behalf.
- DPIA
- Data protection impact assessment: a documented review of high-risk processing.
- International transfer
- Sending personal data outside the free zone, which requires a recognised legal basis and documented safeguards.
- Authorised firm
- A financial services firm authorised by the DFSA or FSRA, subject to that regulator's systems and controls expectations.
Requirements
What the rules ask of you
This is a plain-English summary, not legal advice. Read the current laws, regulations and regulator rulebooks for the obligations that apply to you.
1
Accountability and governance
Both regimes expect you to be able to show how you comply. That usually means records of processing, policies, a data protection officer where required, and impact assessments for high-risk processing.
What it looks like in practice
- Records of processing activities
- Documented DPIAs for high-risk processing
- A named person responsible for data protection
- Privacy notices that match real practice
2
Security of processing
Controllers and processors must apply appropriate technical and organisational measures. Regulators judge that against the risk, so testing evidence matters.
What it looks like in practice
- Encryption and access control for personal data
- Regular penetration testing with findings closed
- Logging and monitoring
- Staff training and clear responsibilities
3
Breach response and notification
Both regimes require breaches to be assessed and, where required, notified to the regulator, and in some cases to affected individuals. Preparation is what makes this workable under pressure.
What it looks like in practice
- A written incident response plan
- A tested process for assessing and reporting breaches
- Contact points and decision owners agreed in advance
4
International transfers and vendors
Personal data leaving the free zone needs a documented basis and safeguards. The DIFC amendments reportedly emphasise documented assessments of recipient jurisdictions. Vendors should be under written terms.
What it looks like in practice
- A register of transfers with their legal basis
- Data processing agreements with vendors
- Evidence of vendor security reviews
5
DFSA and FSRA expectations
Authorised firms are expected to manage technology and cyber risk under their regulator's systems and controls rules. Expect questions on governance, resilience, outsourcing and incident handling.
What it looks like in practice
- Board and senior management oversight of technology risk
- Tested business continuity and recovery arrangements
- Outsourcing controls and exit plans
Where testing fits
How penetration testing supports DIFC and ADGM
Neither regime requires one named test, but security of processing is a core duty and sector regulators expect technology risk to be tested. A manual penetration test with a retest gives you evidence of reasonable measures.
Data protection
Security of processing
Testing of systems that hold personal data shows whether safeguards work against a real attacker.
Breach readiness
Attack path validation
Shows what an intruder could reach, which feeds incident response planning.
Sector regulator
Technology risk
Test reports support governance and risk reporting to senior management.
Vendors
Third-party exposure
Testing integrations and APIs reveals data exposure between you and your vendors.
Avoid these
Common DIFC and ADGM mistakes, and how to avoid them
!
Assuming federal UAE law covers you
The free zones have their own regimes. Confirm which apply before building policies.
!
Reusing a GDPR template unchanged
Many principles overlap, but each regime has its own specifics.
!
Ignoring transfers
Data sent to group companies and vendors abroad needs a documented basis and assessment.
!
Testing without a closure record
Findings with no owner, date or retest are hard to defend.
FAQ
DIFC and ADGM questions, answered
What is the DIFC Data Protection Law?
It is DIFC Law No. 5 of 2020, the data protection law of the Dubai International Financial Centre, supported by regulations and enforced by the DIFC Commissioner of Data Protection.
Was the DIFC law amended?
Yes. Amendment Law No. 1 of 2025 took effect on 15 July 2025. Reported changes include a private right of action, broader scope and clearer transfer requirements. Read the current text for exact details.
What is the ADGM Data Protection Regulations 2021?
They are the data protection rules of Abu Dhabi Global Market, in force since 14 February 2021 and overseen by the ADGM Office of Data Protection.
Do DIFC and ADGM follow federal UAE data protection law?
Each free zone has its own regime. The federal law applies elsewhere in the UAE, so your location and activities decide which rules matter.
What do the DFSA and FSRA expect on cyber?
Authorised firms are expected to manage technology and cyber risk under their regulator's systems and controls rules, covering governance, resilience, outsourcing and incident handling.
Do I need a penetration test?
Neither data protection regime names one, but security of processing is a core duty. Regular manual testing is a common way to evidence it.
Who is in scope?
Entities established in the free zones, and processing connected to them as the laws set out. Check the scope provisions for group companies and cross-border processing.
Related frameworks
Often assessed alongside DIFC and ADGM
Privacy lawUAE PDPLThe UAE federal data protection law in plain language, with honest notes on its implementation status and how it sits beside DIFC and ADGM.Privacy lawGDPRSeven principles, six lawful bases and the 72-hour breach clock. See how Article 32 security testing fits your obligations.Security assuranceISO 27001The international standard for an information security management system. Clauses, the 93 Annex A controls, and how certification works.
Browse all 23 security and compliance frameworks or see our penetration testing services.
Helpful resources
ChecklistPre-launch security checklistKeep reading on the Summit resources hub.ReportSample VAPT reportKeep reading on the Summit resources hub.GlossarySecurity glossaryKeep reading on the Summit resources hub.
Last reviewed October 2026. Requirements change; confirm current texts and dates before you commit to a plan.