Registration by entities is carried out by completing a notification form outlining its activities in relation to the processing of personal data and submitting it to the Data Protection Administrator, along with the appropriate fee. (See registration fees). Registration forms must be renewed annually. If during the year, the manner of processing is changed, a notification reflecting this must be submitted to the Data Protection Administrator. In addition, entities need to apply for a permit if they intend to process sensitive personal data and/or transfer personal data outside the DIFC. A transfer of personal data to a jurisdiction outside the DIFC may take place only if that jurisdiction is deemed to have an adequate level of protection for that personal data. For a list of jurisdictions with adequate data protection regimes please click here.
 
Any entity failing to register and or notify the Data Protection Commissioner of its data processing activities will be subject to fines and penalties.