DIFC Regulation 10 (AI and personal data): requirements, deadlines and compliance actions
DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 7 sections
In brief
The DIFC Regulation 10 (AI and personal data) is a binding regulation of Dubai (United Arab Emirates), issued by Dubai International Financial Centre Authority. Its current status is in force. Organisations processing personal data in the DIFC free zone. Every record here links to its official source and states its verification status.
- Jurisdiction
- Dubai (United Arab Emirates)
- Instrument type
- Regulation
- Status
- In force
- Legal force
- Binding
- Issuing body
- Dubai International Financial Centre Authority
- Adopted
- 1 September 2023
- Official source
- Regulation 10
- Verification
- Pending review · source-linked, checked 15 Oct 2026
What is the DIFC Regulation 10 (AI and personal data)?
Sets rules for personal data processed through autonomous and semi-autonomous systems in the Dubai International Financial Centre: notice and transparency when such a system is used, the deployer as controller and the operator as processor, limits on purposes, a future certification scheme, and an Autonomous Systems Officer for high-risk processing.
Status note: Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it.
Who does it apply to?
Organisations processing personal data in the DIFC free zone.
Deployers and operators of AI systems processing personal data in the DIFC.
- AI use cases
- AI in finance, credit and insurance
- Risk categories
- High-risk
- AI system types
- Automated decision-making system
When do the requirements apply?
Regulations enacted 1 September 2023; guidance DIFC-DP-GL-23 dated 27 August 2024.
Later amendments were not checked.
Official sources
-
Regulation 10
DIFC Commissioner of Data Protection · 1 Sep 2023 · Tier 1 source
Cite this record
AIPolicyTracker (2026). “DIFC Regulation 10 (AI and personal data)” [AIPT-POL-0002, record version 1, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0002 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0002: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Regulation 10, DIFC Commissioner of Data Protection, https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10.
BibTeX
@misc{aipolicytracker2026_difcregulation10aiandper,
author = {{AIPolicyTracker}},
title = {{DIFC Regulation 10 (AI and personal data)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/ae-difc-data-protection-regulation-10-autonomous-systems}},
url = {https://aipolicytracker.org/policies/ae-difc-data-protection-regulation-10-autonomous-systems},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0002)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0002"><img src="https://aipolicytracker.org/badges/ae-difc-data-protection-regulation-10-autonomous-systems.svg" alt="AIPolicyTracker: DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems, In force · pending review" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Added in the October 2026 sub-national research round. Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the DIFC Regulation 10 (AI and personal data) in force?
Yes. The DIFC Regulation 10 (AI and personal data) is in force.
Is the DIFC Regulation 10 (AI and personal data) legally binding?
Yes. The DIFC Regulation 10 (AI and personal data) is a binding regulation; the obligations it creates are legal requirements for the actors it covers.
Who does the DIFC Regulation 10 (AI and personal data) apply to?
Organisations processing personal data in the DIFC free zone.
When does the DIFC Regulation 10 (AI and personal data) apply?
Regulations enacted 1 September 2023; guidance DIFC-DP-GL-23 dated 27 August 2024.
Where is the official text of the DIFC Regulation 10 (AI and personal data)?
The official text is published by DIFC Commissioner of Data Protection at https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10 (Regulation 10). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.