# DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems

- **Record type**: Policy instrument
- **Jurisdiction**: Dubai (United Arab Emirates)
- **Instrument type**: Regulation
- **Status**: In force
- **Binding**: Yes
- **Issuing body**: Dubai International Financial Centre Authority
- **Adopted**: 2023-09-01

## In brief

The DIFC Regulation 10 (AI and personal data) is a binding regulation of Dubai (United Arab Emirates), issued by Dubai International Financial Centre Authority. Its current status is in force. Organisations processing personal data in the DIFC free zone. Every record here links to its official source and states its verification status.

## Summary

Sets rules for personal data processed through autonomous and semi-autonomous systems in the Dubai International Financial Centre: notice and transparency when such a system is used, the deployer as controller and the operator as processor, limits on purposes, a future certification scheme, and an Autonomous Systems Officer for high-risk processing.

## Scope

Organisations processing personal data in the DIFC free zone.

## Who it applies to

Deployers and operators of AI systems processing personal data in the DIFC.

## Key dates

Regulations enacted 1 September 2023; guidance DIFC-DP-GL-23 dated 27 August 2024.

## Notes on dates

Later amendments were not checked.

## Provenance

- **Permanent id**: AIPT-POL-0002 (https://aipolicytracker.org/id/AIPT-POL-0002; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/ae-difc-data-protection-regulation-10-autonomous-systems
- **Official source**: https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10
- **Source document**: Regulation 10
- **Published by**: DIFC Commissioner of Data Protection
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "DIFC Data Protection Regulations, Regulation 10: personal data processed through autonomous and semi-autonomous systems" [AIPT-POL-0002, record version 1, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0002 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.