A key principle borrowed from the GDPR is the consent of the data subject. Companies are required to obtain specific and informed consent to process information. This means that the customer must understand what data is being collected, for what purposes, and how it will be used. The UAE Regulation establishes the principles of legality, fairness, and transparency of the information processing process for the data subject.

Compliance with the Regulation is mandatory for all organizations, regardless of their size or legal form, that process the personal data of citizens and residents of the Emirates. This applies to government agencies, private companies operating in the UAE, and international corporations.

Certain categories of personal information (race, political views, religious beliefs, genetic data) are considered high risk. In such cases, organizations must appoint a Data Protection Officer (DPO).

Requirements for DPOs include: residence in the Emirates, high qualifications and experience in data protection, and close cooperation with the DIFC Commissioner, who plays an important role in overseeing compliance with the Regulation. Specific requirements for the qualifications and experience of DPOs are likely to be clarified in subsequent regulations.

The UAE Regulation, like the GDPR, provides for certain exceptions, for example, for data processing for medical purposes, national security, or law enforcement. However, these exceptions are strictly regulated and must be justified.