DIFC opens 30-day consultation on AI and data protection rule changes

Dubai: Dubai International Financial Centre has opened a 30-day public consultation on proposed changes to its Data Protection Regulations, with the amendments aimed at strengthening rules around personal data, artificial intelligence systems and governance standards.

The consultation will run until July 18, 2026, giving stakeholders time to comment on the proposed updates set out in Consultation Paper No. 3 of 2026.

DIFC said the proposed amendments are designed to make the framework clearer and more practical as AI and data-driven systems become more widely used across financial services and other regulated sectors.

AI and data governance in focus

The amendments seek to strengthen requirements for embedding safety into systems that process personal data in what DIFC described as an AI-native jurisdiction.

They also aim to clarify certification obligations, define the role of the Autonomous Systems Officer and introduce new powers for the Commissioner to recognise accreditation and certification schemes.

"As the use of AI and data-driven systems continues to develop, it is important that the regulatory framework remains practical, clear and able to respond to the way these technologies are being used," said Jacques Visser, Chief Legal Officer at DIFC Authority. "These amendments are intended to help provide that clarity, while supporting high standards of accountability and governance across DIFC.”

Building on 2023 update

DIFC last updated the Data Protection Regulations in 2023 to introduce safeguards for the growing use of personal data in advanced and AI-enabled systems.

The latest proposed changes build on that framework by refining Regulation 10, with a stronger focus on safe, ethical and privacy-by-design development. They also introduce a new Regulation 11, which would allow the Commissioner to recognise accreditation and certification frameworks.

DIFC said the amendments are also intended to support stronger data protection governance and provide more clarity for firms operating in the centre.