Clyde & Co advises the DIFC on its new data protection law

Global law firm Clyde & Co has advised the Dubai International Financial Centre (DIFC) Authority on the new DIFC Data Protection Law*, which will come into force on 1 July 2020. Because of the limited time before the effective date, the DIFC Commissioner of Data Protection is expected to announce that a transition period will be provided to businesses and the new requirements of the law will be enforced only from 1 October 2020.

The new DIFC Data Protection Law replaces the existing DIFC data protection law and brings the DIFC more closely into-line with internationally-accepted data protection laws, such as the General Data Protection Regulation ("GDPR") and other similar laws. The law will supplement data protection compliance for DIFC businesses which are already subject to such laws, and for those that are not, it will provide a solid foundation for ethical data management in an advancing tech environment.

Key changes include direct obligations on data processors, enhanced provisions dealing with processing on the basis of consent and legitimate interests, and enhanced accountability requirements. The law also imposes obligations on controllers and processors to appoint a data protection officer if certain criteria are met as well as enhanced obligations where a controller appoints a processor.  It brings new clarification regarding international transfers and removal of the permit-to-transfer process under the previous law. 

Where there are differences between certain features of emerging technology and traditional data protection principles, the new law attempts to reconcile these by affording flexibility to controllers wishing to use such technologies, provided certain safeguards are implemented.  For example, the use of blockchain potentially creates tensions with the data subject legal right to have data erased.  Under the new law it may be possible for controllers to manage this tension, provided that enhanced information provision requirements are complied with at the outset.

Jacques Visser, Chief Legal Officer, DIFC Authority, said: "The DIFC is the leading financial hub for the Middle East, Africa and South Asia region and this is reflected in the continuous enhancement of our legal infrastructure. Data protection is of particular significance to the banking and financial services sector. The Data Protection Law aims to enable better business practices and aligns the Centre’s regulatory framework more closely with international data protection best practice.  We worked alongside Clyde & Co from the start of this process on the drafting of the Data Protection Law, the development of the public consultation paper and liaising with key stakeholders."

Dino Wilkinson, Partner and head of the Technology, Media and Telecommunications (TMT) team at Clyde & Co in the Middle East, comments: "The new law should further establish the DIFC as an attractive environment in which to work and do business, and position it as a safe and top-tier jurisdiction when it comes to data protection issues. In our view, this is a landmark law for the entire Middle East region."

Clyde & Co's core team of Dino Wilkinson and Ben Gibson (Senior Associate) supported the DIFC Authority project lead Lori Baker, Director of Data Protection, on the development of the law and will also work closely with the DIFC Authority on outreach sessions for DIFC businesses as part of the introduction of the new regime.

With three partners and more than 30 legal professionals, Clyde & Co's TMT and intellectual property practice is one of the very few in the Middle East to have a dedicated team of specialist lawyers advising on the complex issues arising from the rapidly expanding technologies in the region. Our TMT experts assist clients across a broad range of work including regulatory analysis and compliance, practical data protection issues, technology procurement and outsourcing.

Clyde & Co has the largest presence and is one of the most experienced international law firms in the Middle East with over 40 partners and 300 staff, based full time in Abu Dhabi and Dubai in the UAE, Doha in Qatar,  and Riyadh in Saudi Arabia, providing a full-service commercial offering of local specialists across most business sectors and practice areas.

* DIFC Law No. 5 of 2020