1. Title and repeal
(1) This Law may be cited as the “Data Protection Law 2020”.
(2) This Law repeals and replaces the Data Protection Law, being Law No. 1 of 2007, as it was in force immediately prior to the commencement of this Law ("the Previous Law"), and all Regulations made under the Previous Law from commencement of this Law.
(3) Except where otherwise provided in this Law, anything done or omitted to be done pursuant to or for the purposes of the Previous Law is deemed to be done or omitted to be done pursuant to or for the purposes of this Law.
(4) Without limiting the generality of Article 1(3) and Article 4, and subject only to Article 1(5), such repeal and replacement shall not affect:
(a) any right, privilege, remedy, obligation or liability accrued to or incurred by any person; or
(b) any investigation, legal or administrative proceeding commenced, or to be commenced, in respect of any such right, remedy, obligation or liability,
under the Previous Law, and any such legal proceeding shall be instituted, continued or enforced, including any penalty, fine or forfeiture, under this Law.
(5) Where there is no equivalent provision in this Law to a provision in the Previous Law, a relevant provision of the previous Law is deemed to survive the repeal and replacement under this Article 1 until such time as necessary for the purpose of any investigation, legal or administrative proceedings specified in Article 1(4)(b).
(6) Unless otherwise provided, any reference to the Previous Law includes Regulations made under the
Previous Law.2. Legislative authority
This Law is made by the Ruler.
3. Date of enactment
This Law is enacted on the date specified in the Enactment Notice in respect of this Law.
4. Commencement
This Law comes into force on 1 July 2020.
5. Purpose of this Law
The purpose of this Law is to:
(a) provide standards and controls for the Processing and free movement of Personal Data by a Controller or Processor; and(b) protect the fundamental rights of Data Subjects, including how such rights apply to the protection of Personal Data in emerging technologies.
6. Application of the Law
(1) This Law applies in the jurisdiction of the DIFC.
(2) This Law applies to the Processing of Personal Data:(a) by automated means; and
(b) other than by automated means where the Personal Data forms part of a Filing System or is intended to form part of a Filing System.
(3) This Law applies as follows:
(a) This Law applies to the Processing of Personal Data by a Controller or Processor incorporated in the DIFC, regardless of whether the Processing takes place in the DIFC or not.
(b) This Law applies to a Controller or Processor, regardless of its place of incorporation, that Processes Personal Data in the DIFC as part of stable arrangements, other than on an occasional basis. This Law applies to such Controller or Processor in the context of its Processing activity in the DIFC (and not in a Third Country), including transfers of Personal Data out of the DIFC.
(c) For the purposes of this Article 6(3), Processing "in the DIFC" occurs when the means or personnel used to conduct the Processing activity are physically located in the DIFC, and Processing "outside the DIFC" is to be interpreted accordingly.
(4) This Law does not apply to the Processing of Personal Data by natural persons in the course of a purely personal or household activity that has no connection to a commercial purpose.
(5) This Law is without prejudice to agreements entered into between one (1) or more DIFC Bodies and:
(a) Third Country governments or governmental authorities;
(b) regulatory bodies or public authorities established under the law of a Third Country; or
(c) International Organisations, that address regulating the transfer of Personal Data and include appropriate safeguards for the relevant Data Subjects.7. Schedules
Schedule 1 contains:
(a) interpretative provisions that apply to this Law; and
(b) a list of defined terms used in this Law.8. Administration of the Law
This Law and any Regulations made under it are administered by the Commissioner.