In short: On 18 June 2026 DIFC Authority published a consultation on amending the DIFC Data Protection Regulations. The draft would update Regulation 10 for AI-native systems, detail the Autonomous Systems Officer role and add a Regulation 11 on certification. Comments closed on 18 July 2026. The changes are a draft, not yet enacted.
Key facts
| Authority | DIFC Authority (DIFCA), Dubai International Financial Centre; the Data Protection Commissioner administers the Regulations |
|---|---|
| Instrument | Consultation Paper No. 3 of 2026, Updated Data Protection Regulations, with Annex A (proposed text of the DIFC Data Protection Regulations) |
| Issue date | 18 June 2026 |
| Effective date | None set. The paper says the Regulations would be enacted to come into force on a date specified and published |
| Applies to | Persons doing or planning to do business in the DIFC, especially technology firms, vendors of AI-native Systems and bodies seeking certification roles |
| Status | Consultation closed, not enacted Comments closed 18 July 2026; no enactment notice found on 14 October 2026 |
| Official source | https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations |
| Last verified | 14 October 2026, against the DIFC news release, the consultation paper, Annex A and the DIFC legal database |
What did DIFC propose?
-
Regulation 10 updated for AI-native systems
DIFCA says the Regulations were updated in 2023 to add safeguards for personal data processed by AI-enabled systems. The paper builds on that and links it to DIFCA’s April 2026 announcement of an intention to become the world’s first AI-native financial centre (para 17). Regulation 10.2.2(b)(v) would refer to “policy frameworks” rather than the narrower “principles” in the notices given to users (para 18(a)).
-
A new concept of “Safety”
Draft Regulation 10.3.1(f) would add Safety as a design concept alongside the existing ones (ethical, fairness, transparent, secure, accountability). In the draft, a System must be “designed, developed, and operated with safeguards to identify the use of personal data, assess and mitigate risks of harm to individuals”, and to prevent discriminatory or biased outcomes through oversight, testing and controls.
-
Privacy by design and default where no recognised code exists
The draft notice requirements would add a description of the privacy by design and default measures used where codes, certifications or policy frameworks are still in development or do not exist for that type of System. In those cases the Commissioner could request an impact assessment or convene a review and audit body.
-
Autonomous Systems Officer (ASO)
Updated Regulation 10.3.3 would give detailed ASO obligations and skills, benchmarked against the Commissioner’s own work and criteria from other jurisdictions (para 19). The draft says an ASO must have, at a minimum, similar competencies and level of organisational authority to those required of a Data Protection Officer, plus further regulatory, technical and organisational expertise to oversee the System and its certification.
-
New Regulation 11: recognising accreditation and certification
The Commissioner would be able to recognise accreditation and certification frameworks by publication on the Commissioner’s section of the DIFC website (draft 11.1.1). The Commissioner could also recognise and accredit certification bodies by publication, a Direction or another valid mechanism (draft 11.1.2). DIFCA asked whether this fits frameworks such as the Global Cross Border Privacy Rules and Privacy Recognition for Processors (Question 4).
What does the draft text say?
Annex A is a consolidated mark-up of the whole Regulations, so it cannot be read as a list of new rules alone. Some of its text restates provisions that already exist.
Its Regulation 10 text includes a bar on commercial use of a System to process personal data unless the System can process only for human-defined or human-approved purposes, has been tested for safety verification, and meets design and any certification requirements the Commissioner sets (draft 10.3.2). For high risk processing, a System could be used only if the Commissioner has first set audit and certification requirements, the System meets them and the Deployer or Operator has appointed an ASO (draft 10.3.3). The draft does not itself set those requirements; its guidance notes anticipate that the Commissioner will set them in future guidance (notes 10 and 11).
The change marks show what is actually new. The opening bar in 10.3.2, the conditions in 10.3.3(a) to (c) and the ASO appointment requirement carry no change marks, and neither do the Deployer, Operator and Provider definitions (draft 10.1.1) or the Controller and Processor deeming rule (draft 10.3.5, renumbered). Marked as new are the safety verification test in 10.3.2(b), the ASO’s additional qualifications in 10.3.3(d)(ii) and the allocation duty in 10.3.4, shown in the table below.
| Role | How the draft would treat it | Reference |
|---|---|---|
| Deployer | Would be treated as a Controller of a System. Where no ASO is required, the Deployer would still have to allocate responsibility for oversight and compliance and give the Commissioner details of the people responsible on request. | Draft 10.3.5; draft 10.3.4 |
| Operator | Would be treated as a Processor. Where no ASO is required, the Operator would still have to allocate responsibility for oversight and compliance and give the Commissioner details of the people responsible on request. | Draft 10.3.5; draft 10.3.4 |
| Provider | Defined as a person that develops, or procures the development of, a System to supply to Operators or Deployers. The draft does not deem a Provider itself a Controller or Processor. A Provider that operates or supervises a System for a Deployer is an Operator, and would be treated as a Processor. Separately, draft 10.3.2 bars anyone from providing a System for commercial use unless it meets that paragraph's conditions. | Draft 10.1.1(c) and (d); draft 10.3.2; draft 10.3.5 |
Who is affected?
DIFCA names persons doing or planning to do business in the DIFC. In particular: innovation and technology companies, vendors and suppliers of Systems supporting AI-native activities, organisations seeking an accreditation or certification role, and legal advisers (para 2).
For a bank or financial firm in the DIFC, the practical question is whether any system it uses or sells processes personal data with some autonomy. If so, it may be a Deployer or an Operator under the draft definitions.
What should firms do next?
Treat the steps below as practical advice, not requirements of the paper:
- Map your systems.List tools that process personal data autonomously or semi-autonomously, and note whether you would be a Deployer, an Operator or a Provider (draft 10.1.1).
- Compare your notices.Check user-facing notices against the draft Regulation 10.2.2 wording, including the “policy frameworks” reference.
- Identify high risk processing.Decide who could serve as an ASO, or who would hold oversight responsibility if no ASO is required (draft 10.3.3 and 10.3.4).
- Ask vendors about certification.Find out which frameworks they follow and whether they expect to seek recognition under Regulation 11.
- Watch for the enactment notice.DIFCA says it will post a notice on its website when the Regulations are enacted, with a published commencement date (paras 7 to 8).
Status and timing
- IssuedConsultation Paper No. 3 of 2026 issued.
- Comments closedThe deadline for comments; DIFC described it as a 30-day public consultation.
- Not enactedNo enactment notice or commencement date found.
The paper says that, once DIFCA considers the changes to be in a suitable form, the Proposed Regulations will be enacted “to come in to force on a date specified and published” (para 7). Annex A shows only a bracketed placeholder for the in-force date.
The DIFC legal database now lists the paper under Past Consultation Papers, and the Data Protection Law page lists no 2026 enactment notice.
Frequently asked questions
Are the amended DIFC Data Protection Regulations in force?
No. The paper says the Proposed Regulations are in draft form and should not be acted on until formally enacted, with a notice on the DIFC website when that happens. The consultation closed on 18 July 2026, and the DIFC pages checked on 14 October 2026 show no enactment notice.
What is an Autonomous Systems Officer?
The ASO is a role in Regulation 10. The draft text says that, for high risk processing, the Deployer or Operator of a System would have to appoint one, with, at a minimum, similar competencies and organisational authority to those required of a Data Protection Officer, plus further qualifications. DIFCA expects to develop an ASO certification separately.
What would new Regulation 11 do?
It would let the Commissioner of Data Protection recognise accreditation and certification frameworks by publishing them on the Commissioner's section of the DIFC website, and recognise and accredit certification bodies by publication, a Direction or another valid mechanism.
How does the draft treat a Provider of an AI system?
It defines a Provider as a person that develops, or procures the development of, a System to supply to Operators or Deployers (draft 10.1.1(d)). The draft does not deem a Provider a Controller or Processor. A Provider that operates a System for a Deployer is an Operator and would be treated as a Processor (draft 10.1.1(c) and 10.3.5). Draft 10.3.2 also bars anyone from providing a System for commercial use unless it meets that paragraph's conditions.
Sources (official, verified 14 October 2026)
- DIFC news release, “DIFC Announces Consultation of amended DIFC Data Protection Regulations”, 18 June 2026 https://www.difc.com/whats-on/news/difc-consultation-amended-data-protection-regulations
- Consultation Paper No. 3 of 2026, Updated Data Protection Regulations (PDF) https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws–regulations/consultation-paper.pdf
- Annex A: proposed Data Protection Regulations (PDF) https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws–regulations/annex-a—proposed-changes.pdf
- DIFC Legal Database (Consultation Papers and Past Consultation Papers) https://www.difc.com/business/laws-and-regulations/legal-database
- Data Protection Law, DIFC Law No. 5 of 2020 (DIFC legal database page) https://www.difc.com/business/laws-and-regulations/legal-database/difc-laws/data-protection-law-difc-law-no-5-2020
- DIFC Commissioner of Data Protection https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection
- AI governance
- Data protection
- DIFC Data Protection Regulations
- Autonomous Systems Officer
- Certification and accreditation
- AI-native financial centre
- Regulation 10
Book a demo to see how each regulatory change becomes an executable action list, with immediate, safer compliance as well.
Agentic AI Built Exclusively for BFSI
Neurasix delivers rule-aligned agentic workflows – from regulatory intelligence to audit-ready outputs