The UAE free-zone registration checklist: DIFC and ADGM

GDPR abolished general notification years ago, so teams coming from Europe are often surprised that both UAE financial free zones bring it back. In the DIFC and the ADGM, registering with the regulator and paying an annual fee is a standing obligation, and a lapsed registration is a contravention in its own right, separate from anything you do with the data. This is a calendar problem as much as a compliance one. Here is the checklist.

DIFC: register and renew (Article 14)

Who: controllers and processors operating in or from the DIFC.

What: notify your processing to the Commissioner, keep the notified particulars current, and pay the fee. The register is public.

When: renew annually; track the renewal anniversary.

Watch for: a lapsed registration is a standing contravention. Fees are category-based, so confirm the current schedule rather than assuming last year's figure.

ADGM: register, notify and pay (section 24)

Who: controllers and processors established in the ADGM, via the Registration Authority Online Registry.

What: file the General Data Processing Notification (name, address, commencement date), keep it accurate, and pay the annual data-protection fee.

When: pay within twelve months of commencement, then renew within one month of each anniversary.

The exemption trap: an establishment with fewer than five employees can be exempt from section 24, but the exemption is lost the moment it carries out high-risk processing. Re-check this whenever your processing changes.

The penalty: fee non-payment is finable up to 150% of the fee and recoverable as a debt through the ADGM Court.

The DPO notification you might forget

Both zones also expect you to tell the regulator about your DPO. In the ADGM, a DPO appointment or resignation is notified to the Commissioner within one month (section 35(4)). In the DIFC, where a DPO is required, an annual assessment of your processing is carried out and filed with the Commissioner (Article 19). These are easy to miss because they are not about the data, they are about the paperwork around the role.

Make it a tracked deadline, not a memory

Every item above is date-driven, and the failure mode is always the same: someone leaves, the renewal slips, and the lapse is discovered during an audit. In Compliance One the DIFC and ADGM frameworks carry reminders for the registration renewal, the fee anniversary and the DPO notifications, so the deadlines surface as alerts rather than as a nasty surprise. Set them once and let the platform watch the calendar.

In the UAE free zones, the cheapest contravention to avoid is also the dumbest to incur: forgetting to renew a registration you already paid for last year.