Dubai, UAE 26 August 2021: Dubai International Financial Centre (DIFC or the Centre), the popular international financial hub in the Middle East, Africa and South Asia (MEASA) region, has formally engaged with the UKs Department for Digital, Culture, Media & Sport Department (DCMS) regarding the Data Protection Law, DIFC Law No. 5 of 2020 (DP Law 2020). The collaboration between DIFC and DCMS comes part of the UKs overall approach to international data transfers, including establishment of an International Data Transfers Experts Council in addition to the aforementioned assessments of DIFC and five other top priority jurisdictions. This process is to determine whether DP Law 2020 is substantially equivalent to the UK General Data Protection Regulation and UK Data Protection Act of 2018 (UK DPA). Adequacy recognition of DIFCs Data Protection Law would mean that it is fair and effective enough to protect UK-originating data being processed by entities in the Centre.

Recognition would strengthen data flows between the jurisdictions, help build better trade relationships and promote high standards of accountability and transparency in businesses that deal with DIFC entities.

At DIFC we are committed to implementing best-in-class regulations and standards across all of our business functions, to ensure the provision of integrated financial services commensurate with the needs of our partners. Data protection and the preservation of privacy are key factors that impact the work done by companies working in the DIFC, therefore we are pleased to cooperate with the UK Digital, Culture, Media and Sport Department with the aim of securing adequacy recognition by the UK and reinforcing DIFCs alignment with international standards. This step would further highlight how DIFCs practical and effective legal infrastructure serves as a model for data protection in the region and contribute to the consolidation of DIFCs position as one of the leading financial centres in the world. said Arif Amiri, CEO of DIFC Authority.

DP Law 2020 DIFCs DP Law 2020 is the updated version of the longest-standing data protection law in the GCC region. The first law was enacted in 2004 and amended in 2007. Based on UK, EU and global data protection principles and best practices, the DP Law 2020 sets out expectations for Controllers and Processors in DIFC regarding several key privacy and security principles. It includes the best practices from a variety of current, world class data protection laws and balances other forward-thinking, technology agnostic concepts with robust protections for individuals privacy rights. Safeguards for shifting data from DIFC to other jurisdictions with no or dissimilar data protection laws creates risk to privacy rights and therefore needs either recognition of the law in a jurisdiction as equivalent or adequate.

DCMS Assessment and Decision The UK has the power to identify other laws under its own national data protection law. Through DCMSs quick review process of DIFC data flows and the unique legal and regulatory framework of DIFC as a free zone, the Centre hopes the DP Law 2020 will be awarded recognition that it is compatible enough with the UK DPA. DCMSs final decision will be made in due course, after the full,

robust assessment process is complete and provided DIFC provides sufficient evidence of the required elements.

Commissioners Adequacy Recognition Decisions It is worth noting that the DIFC Commissioner of Data Protection also has such adequacy decision making powers. Please note the Commissioners statement previously about on-going recognition of the UK, post-Brexit, issued in March 2019, as well as the list of jurisdictions already recognised by the Commissioners Office. Adding on it collaborates with other data protection regulators on promoting data protection and security throughout the UAE and globally, additional adequacy decisions of GCC and other regional laws or cross-border transfer consortia will be declared in due course.