Staying compliant
Data protection officer
Notification, DPO appointment and privacy framework
In short
We handle the annual notification to the Commissioner, appoint a DPO where the entity's processing requires one, and build the underlying framework: records of processing, privacy notices, transfer mechanisms and a breach response plan that works at three in the morning.
What you get
- Initial notification and annual renewal with the Commissioner
- Assessment of whether a DPO is mandatory
- DPO appointment and notification
- Records of processing activities
- Privacy notices for employees, clients and website visitors
- Transfer assessments and standard contractual clauses
- Breach response plan and incident support
Timeline: Framework in 3 to 6 weeks. Notification ongoing annually
The intra-group transfer problem
The DIFC is a separate jurisdiction for data protection purposes, so sending personal data to a parent or affiliate outside the Centre is an international transfer, including to an affiliate elsewhere in the UAE. Groups that run a shared HR system or a central CRM are transferring data continuously and often without a mechanism in place.
Fixing it is straightforward: identify the flows, check whether the destination is on the DIFC adequacy list, and put standard contractual clauses in place where it is not.
Questions
Does my DIFC company need a DPO?
Only if it carries out high risk processing, which includes large scale processing of special categories of data, systematic monitoring on a significant scale, or processing likely to result in high risk to individuals. Every entity still has to notify the Commissioner whether or not a DPO is required.
What happens if the annual notification lapses?
It is a contravention in its own right and the Commissioner can act on it. It also surfaces at licence renewal, which is usually how firms discover the lapse.
Not sure which DIFC licence you need?
Answer eight questions and we will tell you the licence route, the likely cost and the realistic timeline. It takes about two minutes and there is no obligation.