DIFC Data Protection for Websites: What to Fix First

The DIFC Data Protection Law (DIFC Law No. 5 of 2020) applies to firms registered in the Dubai International Financial Centre, and for most of them the website is where personal data first enters the business. Fix the privacy notice, the enquiry forms, cookie consent and the systems behind them first, because those are the gaps a visitor, a client or the Commissioner of Data Protection can see. This guide is a technical starting point, not legal advice; have your data protection officer or counsel confirm the final position.

Why DIFC firms need a separate website checklist

Most UAE businesses look to the federal Personal Data Protection Law. DIFC registered entities sit under their own regime, written by the DIFC and supervised by the DIFC Commissioner of Data Protection. The federal checklist in the UAE PDPL website guide is still a useful reference for structure, but the legal reference points, the regulator, the notification process and some of the terminology are different.

In practice that means three things for a DIFC firm's website:

• Your privacy notice should refer to the DIFC law and the Commissioner, not only to federal law.
• Your internal records, notifications and breach process run through the DIFC regulator.
• Group websites shared with onshore UAE or overseas entities need clear statements about which entity is the controller for which data.

Who the controller is on a shared site

Many DIFC firms run one brand site for several entities: a DIFC regulated company, an onshore sister company and sometimes a parent abroad. The site must make clear who decides why and how each piece of data is processed. If the DIFC entity receives investor enquiries but the onshore entity receives job applications, say so in the notice and route the forms accordingly. Ambiguity here is one of the most common gaps in group sites.

Fix first: a priority order under the DIFC Data Protection Law

Not every issue carries the same weight. This order starts with what is public and works inwards.

Step 1: rewrite the privacy notice for a DIFC audience

The privacy notice is often a copied template that mentions GDPR or federal law and nothing else. Under DIFC data controller obligations, people should be told clearly what you collect and why. A practical notice for a DIFC firm covers:

• The legal name of the controller and its DIFC registration details.
• Contact details for privacy questions, and for the data protection officer where one is appointed.
• Each purpose of processing, matched to a lawful basis, for example responding to an enquiry, onboarding a client or sending updates.
• Categories of recipients, including group companies, service providers and regulators.
• Whether data leaves the DIFC and on what basis.
• How long each category is kept.
• The rights people have and how to use them, including the right to complain to the Commissioner.

Write it for the reader, not the lawyer

Plain language matters. Use short sections and headings that match what visitors want to know, such as "What we collect when you contact us". Put a short summary at the top and the full detail below. If the site is bilingual, make sure the Arabic and English versions say the same thing and are updated together.

Step 2: tighten every form

Forms are where DIFC website privacy is won or lost. Audit each one: contact, callback, newsletter, event registration, careers, investor enquiries and any gated download.

Form checklist

• Minimum fields. If a phone number is not needed to answer the enquiry, make it optional or remove it.
• Notice at the point of collection. A short line under the submit button with a link to the relevant section of the privacy notice.
• Separate marketing consent. An unticked box for marketing, never bundled with the enquiry itself.
• No hidden extras. Remove hidden fields that pass data to third parties without a clear reason.
• Secure transport and storage. HTTPS everywhere, and submissions not left sitting in a plugin table or an email inbox indefinitely.
• Careers forms. CVs often contain sensitive information. Limit who receives them and set a retention period.

Hypothetical example: a DIFC advisory firm's contact form sends every submission to a shared inbox, a spreadsheet and the CRM. Three copies means three places to secure, search when someone asks for their data, and delete when the retention period ends. Sending submissions straight to the CRM, with a short notification email that contains no personal details, cuts that to one.

Step 3: cookie consent in the DIFC

Cookie consent in the DIFC is not set out in a dedicated cookie rule in the way some European laws are, so firms usually apply the general consent and transparency principles of the DIFC Data Protection Law to tracking. The Commissioner has published guidance on consent; read it before configuring your banner. A defensible setup looks like this:

• Strictly necessary cookies load by default and are described in the cookie notice.
• Analytics, advertising and session recording tags wait until the visitor makes a choice.
• Accept and reject options are equally easy to find.
• The choice is stored, can be changed later from a link in the footer, and is respected by your tag manager.

Test it, do not assume it

Open the site in a private window, refuse cookies and check the network requests. If advertising pixels still fire, the banner is decorative. Browser developer tools make this quick to confirm.

Step 4: map the systems behind the website

The website is the front door. Behind it sit the CMS, hosting, CRM, email platform, analytics, chat widget and any integration tool. For each one, record:

• What personal data it receives from the site.
• Who the vendor is and whether a written processing agreement is in place.
• Where the data is stored and processed.
• Who inside the firm has access, and whether that access is still needed.
• How long data is kept and how it is deleted.

Transfers out of the DIFC

Many website tools store data outside the UAE. The DIFC law sets conditions for transfers outside the centre, including recognised jurisdictions and other safeguards. Check the current list and the mechanism that applies to each vendor with the Commissioner's published material or your counsel. Hosting choices also affect this; the article on AWS or Azure for UAE enterprise websites covers regional options, and the piece on cheap hosting risk explains why unclear hosting arrangements are hard to defend.

Step 5: requests and incidents

Visitors may ask to access, correct or delete their data. Decide in advance who receives these requests, how identity is confirmed and how the CRM, email platform and backups are searched. A form or a dedicated mailbox named in the privacy notice is enough, provided someone owns it.

For incidents, the Commissioner provides a breach reporting route. Your website plan should cover how a compromised form, plugin or admin account would be detected, who decides whether it is reportable, and how quickly the site can be patched or taken offline. Confirm the current reporting timelines with the Commissioner's guidance rather than relying on summaries.

Notification to the Commissioner

The DIFC states that entities submit a data protection notification at incorporation and when there are changes. A new website that introduces new processing, such as a client portal or a chatbot, may be one of those changes. Check with your compliance team whether the notification needs updating.

Step 6: AI features and automated processing

The DIFC amended its Data Protection Regulations to add Regulation 10, which addresses personal data processed through autonomous and semi autonomous systems such as AI tools. Published summaries describe obligations around transparency to individuals and extra steps for high risk processing. If your website has a chatbot that collects personal details, lead scoring, or AI generated responses to client queries, treat it as a governance question before launch. Confirm how Regulation 10 applies to your use case with the Commissioner's official text or counsel, since commentators differ on the detail and dates.

The wider approach to oversight, logs and review is covered in the guide to AI governance for business websites.

How the DIFC regime differs from the federal checklist

Firms in ADGM have a third regime. Group websites that serve entities in more than one jurisdiction should state clearly which law applies to which data.

Working with your web team

Most of these fixes are technical: form changes, consent configuration, tag manager rules, CRM routing and access control. A short brief to your developers should include the priority table above, the list of forms, the vendor map and a named reviewer from compliance. For an investor facing site, the article on IPO ready investor relations websites shows how disclosure and privacy requirements meet on the same pages.

Get the website side of DIFC compliance done properly

Codeeo designs and builds corporate websites from its Dubai office, where DIFC clients can meet the team in person. The team of 80+ handles website development and WordPress development, including form rebuilds, consent configuration, CRM integration and secure hosting setups that your compliance team can review. A website audit is a practical first step to list what your current site collects and where it goes. To discuss a review or rebuild, contact Codeeo.