Material Applicability

The DIFC Data Protection Law's material scope is determined by four key factors: Automated Means Criterion, Filing System Criterion, Prospective Filing System Inclusion, and Government and Public Agency Exemption.

Automated Means Criterion

DIFC DPL Art.6(2)(a):

"This Law applies to the Processing of Personal Data: (a) by automated means"

The law applies to all processing of personal data that involves automated processing methods, regardless of the extent of automation. This covers digital processing systems, electronic databases, and any technology-driven data processing activities.

Filing System Criterion and Prospective Filing System Inclusion

DIFC DPL Art.6(2)(b):

"This Law applies to the Processing of Personal Data: (b) other than by automated means where the Personal Data forms part of a Filing System or is intended to form part of a Filing System"

DIFC DPL Schedule 1 Art. 3:

"Filing System means any structured set of Personal Data that is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographic basis."

The law covers manual processing when personal data is:

• Part of a structured filing system
• Intended to be included in such a system
• Organized in a way that allows retrieval based on specific criteria

Government and Public Agency Exemption

DIFC DPL Art.65(2):

"Articles 26, 29, 30, 32, 33, 34, 35, 37, 38, 39 and 42 shall not apply to a DIFC Body, where such DIFC Body acts as a Controller"

DIFC Bodies are exempt from certain provisions when compliance would interfere with their regulatory or enforcement functions, particularly in:

• Financial sector supervision
• Public protection against malpractice
• Criminal investigation and prosecution

Territorial Applicability

The territorial scope of the DIFC DPL is established through three main factors: Processing by Local Establishment, Processing in Context of Local Establishment, and Processing by Entity Registered or Incorporated in Jurisdiction.

Processing by Local Establishment

DIFC DPL Art.6(3)(a):

"This Law applies to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC, regardless of whether the Processing takes place in the DIFC or not."

The law applies to:

• All DIFC-incorporated entities
• Their data processing activities worldwide
• Transfers of personal data out of DIFC

Processing in Context of Local Establishment

DIFC DPL Art.6(3)(b):

"This Law applies to a Controller or Processor, regardless of its place of incorporation, that Processes Personal Data in the DIFC as part of stable arrangements, other than on an occasional basis."

The law covers:

• Regular processing activities within DIFC
• Stable business arrangements
• Non-occasional processing operations