The Dubai International Financial Centre urges companies to protect personal data when using artificial intelligence.

By Brian A. MeenaghKsenia Koroleva, and Lucy Tucker 

On 18 April 2023, the Dubai International Financial Centre (DIFC), a financial free zone with its own data protection laws, published a consultation paper (the Consultation Paper) regarding amendments to DIFC Data Protection Regulations (the Regulations) for a 30-day public consultation.

The Consultation Paper acknowledges that AI systems are important and useful but carry risks to personal data processing. The DIFC’s proposed approach urges all companies using AI systems to adopt and reinforce technical and organisational means to protect personal data when using AI.

United Arab Emirates (UAE) free zones are attractive jurisdictions for early and growth-stage companies. Free zones are designed to encourage startups and foreign investors through simpler processes and procedures, permiting 100% foreign ownership. However, the more than 45 free zones in the UAE each have their own  rules and regulations, so choosing the right free zone can be a complicated decision.

Latham & Watkins, in partnership with VentureSouq, has developed the UAE Free Zone Navigator, an innovative online resource to

By Brian Meenagh

On October 26, 2015, Raja Al Mazrouei, the Commissioner for Data Protection for the Dubai International Financial Centre (the DIFC), issued guidance on the adequacy of US Safe Harbor for the purpose of exporting personal data from the DIFC. The guidance is significant for organisations that transfer personal data from the DIFC to the US and such organisations should urgently review the basis upon which they transfer personal data from the DIFC to the US to ensure that they continue to comply with the DIFC Data Protection Law (No 1 of 2007).

The guidance follows the decision of the European Court of Justice (the ECJ) in Case C-362/14 – Maximillian Schrems v Data Protection Commissioner that Decision 2000/520 of the European Commission, which stated that Safe Harbor-certified US companies provide adequate protection for personal data transferred to them from the EU (the Safe Harbor Adequacy Decision), is invalid.

The key message from the guidance is that:

“the invalidation of the Adequacy Decision by the ECJ provides cause for the Commissioner to reconsider the adequacy status previously afforded under the Law to US Safe Harbor Recipients. However, the Commissioner also understands that there are ongoing negotiations between Europe and US authorities towards an improved Safe Harbor framework and that these negotiations are well advanced.

DIFCWhile the Dubai International Financial Centre (the DIFC) remains primarily focused on the financial services industry, its stable and sophisticated legal and regulatory regimes have increasingly attracted organisations in the culture and arts, retail, leisure and — more recently — the non-profit sectors.

To date, only a handful of non-profit entities have been established in the DIFC.  Yet, the more recently introduced regulations allowing the creation of the Non-Profit Incorporated Organisations (NPIOs) may lead to increased interest. Nonetheless it