{"slug":"ae-difc-data-protection-regulation-10-autonomous-systems","id":"AIPT-POL-0002","permanent_url":"https://aipolicytracker.org/id/AIPT-POL-0002","title":"DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems","short_title":"DIFC Regulation 10 (AI and personal data)","jurisdiction":"ae-dubai","instrument_type":"regulation","status":"in_force","is_binding":true,"ai_specific":true,"issuing_body":"Dubai International Financial Centre Authority","summary_plain":"Sets rules for personal data processed through autonomous and semi-autonomous systems in the Dubai International Financial Centre: notice and transparency when such a system is used, the deployer as controller and the operator as processor, limits on purposes, a future certification scheme, and an Autonomous Systems Officer for high-risk processing.","adopted_on":"2023-09-01","in_force_on":null,"applies_from":null,"official_source_url":"https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10","last_verified_at":null,"reviewed_by":null,"content_version":1,"review_status":"pending_review","confidence_level":"medium","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/policies/ae-difc-data-protection-regulation-10-autonomous-systems","status_note":"Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it.","scope_summary":"Organisations processing personal data in the DIFC free zone.","who_it_applies_to":"Deployers and operators of AI systems processing personal data in the DIFC.","key_dates_summary":"Regulations enacted 1 September 2023; guidance DIFC-DP-GL-23 dated 27 August 2024.","penalties_summary":null,"what_organizations_must_do":null,"published_on":null,"date_notes":"Later amendments were not checked.","taxonomy":{"actor":["provider","deployer"],"ai_system_type":["automated_decision_system"],"sector":["cross_sector","financial_services"],"risk_category":["high_risk"],"use_case":["finance_and_credit"]},"sections":[],"obligations":[],"applicability_rules":[],"deadlines":[],"versions":[],"enforcement_events":[],"procurement_rules":[],"sources":[{"title":"Regulation 10","publisher":"DIFC Commissioner of Data Protection","url":"https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10","document_date":"2023-09-01","document_type":"legislation","tier":1,"tier_label":"Official primary source (government, legislature, regulator, court, standards body, intergovernmental)"}],"related_policies":[],"related_frameworks":[],"faq":[],"source":{"official_source_url":"https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10","source_title":"Regulation 10","source_publisher":"DIFC Commissioner of Data Protection","source_document_date":"2023-09-01","source_reference":null,"source_tier":1,"last_checked_at":"2026-10-15","last_verified_at":null,"review_status":"pending_review","confidence_level":"medium","content_version":1,"change_summary":"Added in the October 2026 sub-national research round. Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it.","reviewed_by":null},"second_review":null}