Regulator page
Who it applies to: Firms authorised by the DFSA in the Dubai International Financial Centre.
DFSA Rulebook, General Module (GEN) - outsourcing rules
The DFSA rulebook site blocked some automated fetches, so the current consolidated version could not be fully confirmed. CP170 proposes critical business services, impact tolerances, dependency mapping (including third parties), scenario testing and immediate notice of material disruptions; comments closed 26 May 2026.
DFSA Rulebook, GEN - Cyber Risk Management rules
The rule text was not reachable (robots-blocked). The 72-hour figure and the start date come only from secondary sources. Penta cites 5.5.6-5.5.14 (testing), 5.5.14 (training) and 5.5.17(4) (review); these are unverified.
DIFC Data Protection Law, DIFC Law No. 5 of 2020 (as amended by DIFC Amendment Law No. 1 of 2025)
The text reviewed is the 2020 version; the article numbers after the 2025 amendment were not re-checked. The timing for notifying data subjects (Art. 42) was not verified.
Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.
Outsourcing does not remove regulatory obligations. The outsourced function is treated as carried out by the firm itself, including for group outsourcing.
Do due diligence when choosing providers, supervise the outsourced work effectively, and deal with any provider act or failure that could breach DIFC law.
Third-party cyber risk should be covered in the framework; the exact sub-rule was not verified. To be confirmed
Inform the DFSA of any material outsourcing arrangement.
Processing for a controller needs a legally binding written agreement with set contents: subject matter, duration, nature and purpose, data types, data subject categories, and processor commitments.
The written contract must require the provider to supply information, give access to its premises, and deal openly and cooperatively with the DFSA.
Sub-processors need the controller's prior written authorisation. A general authorisation is allowed if the processor gives notice of changes and considers objections.
For material outsourcing, keep outsourcing policies, contingency plans and risk management programmes.
Controllers and processors keep written records of processing.
Notify the DFSA of a material cyber incident through the ePortal form. Secondary source
The controller notifies the Commissioner of a personal data breach.
The processor notifies the controller of a breach.
Transfers out of the DIFC are allowed to adequate jurisdictions; otherwise use safeguards (BCRs, Commissioner SCCs, codes, certification) or listed derogations. A documented assessment of the recipient jurisdiction is required since the 2025 amendments.
Do a DPIA before high-risk processing. A DPO is mandatory for high-risk processing done systematically, with an annual DPO assessment filed with the Commissioner.
Keep a cyber risk management framework approved by the governing body and consistent with recognised standards (e.g. NIST CSF, ISO 27000, CIS), with senior management oversight. Secondary source
Mapped from the built-in summary. Each line shows whether the feature is live in the product today.
This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.
