The short version
A new DIFC entity has six obligations that begin immediately: notify the Commissioner of Data Protection, register for UAE corporate tax, file the beneficial ownership register, enrol employees in DEWS, issue compliant employment contracts within one month, and plan for the first audit. Each sits with a different body and none of them is prompted automatically.
Data protection notification
Every DIFC entity that processes personal data notifies the Commissioner of Data Protection and renews annually. Having employees means processing personal data, so this applies to essentially everyone.
It is the single most commonly missed obligation in the Centre, because nothing in the incorporation process flags it. Firms discover it at their first licence renewal, or when a client's due diligence questionnaire asks for the notification reference.
Corporate tax registration
Registration with the Federal Tax Authority is mandatory, with deadlines tied to the licence issue date. Late registration attracts a penalty on its own, before any question of tax due arises.
The assumption that catches holding companies is that no income means no obligation. It does not. A dormant Prescribed Company registers and files like everyone else.
Beneficial ownership
The register is filed at incorporation, and then it has to be maintained. Every share transfer, every change in the ownership chain above the DIFC entity, every change of control triggers an update within 14 days.
Groups restructure abroad without thinking about the DIFC subsidiary's filing. Two years later a bank asks for the current UBO record and it names someone who sold out eighteen months ago.
DEWS and employment contracts
Employees must be enrolled in DEWS from the start of employment, with monthly contributions on basic salary. A written contract meeting the requirements of DIFC Law No. 2 of 2019 has to be in place within the first month.
The contract point matters more than it sounds. A contract drafted for another jurisdiction and lightly adapted usually fails on notice periods, leave entitlements and the end of service provisions, and those failures only become visible during a termination dispute.
The first audit
Accounts under IFRS, audited by a DIFC-registered auditor, filed with the Registrar. Appoint the auditor early rather than in month eleven, and keep books in a form an auditor can work with from the beginning.
There is now a second reason to take this seriously. Audited financial statements are a condition of claiming Qualifying Free Zone Person status for corporate tax, so a delayed audit puts the 0 per cent rate at risk as well as generating a filing penalty.
The pattern in one sentence
None of these obligations is difficult, all of them have deadlines, and nobody sends a reminder. Firms that put the six items into a single calendar in week one do not have a compliance problem. Firms that deal with each one as it surfaces spend the following year in a permanent state of catching up.
Questions
What happens if I never filed the DIFC data protection notification?
It is a contravention and the Commissioner can act on it. In practice it usually surfaces at licence renewal or during a client's due diligence. Filing late is straightforward, and better done before someone else finds it.
Does a dormant DIFC company have annual obligations?
Yes. Licence renewal, accounting records, beneficial ownership confirmation and corporate tax registration and filing all continue. Dormancy reduces the work, not the obligations.