Terms & Privacy generatorUAE · DIFC
Website Privacy Policy (DIFC)
A website/app privacy policy for a DIFC-established controller under DIFC Data Protection Law No. 5 of 2020, covering data-subject rights, lawful bases, transfers, and the DIFC Commissioner.
What is a Website Privacy Policy?
A Website Privacy Policy (DIFC) is a website/app privacy policy for a DIFC-established controller under DIFC Data Protection Law No. 5 of 2020. It covers data-subject rights, lawful bases, transfers, and the DIFC Commissioner.
A DIFC-established business collecting personal data through a website or app that must publish a privacy notice compliant with DIFC Data Protection Law No. 5 of 2020 (not the onshore UAE PDPL, Federal Decree-Law No. 45 of 2021).
Website Privacy Policy template, current for 2026
Built on DIFC DP Law No. 5 of 2020 terminology (Controller, Processing, lawful basis, data-subject rights, the Commissioner of Data Protection, Article 26 international-transfer conditions), which is distinct from GDPR and from the onshore UAE PDPL.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Website Privacy Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Who is the Controller (the DIFC establishment that determines how personal data is processed)? This is the entity legally responsible for your data processing and the 'we' throughout the policy. It must be a DIFC-established entity to fall under DIFC Data Protection Law No. 5 of 2020.
- What is the Controller's DIFC entity type? The Controller table names the entity type (for example a DIFC private company limited by shares, a Recognised Company, or a foreign branch). Collecting it here prevents that row from rendering blank.
- What is the Controller's DIFC Registrar of Companies registration number? The registration number issued by the DIFC Registrar of Companies identifies the entity on the public register and populates the Controller table.
- Is the Controller registered (notified) with the DIFC Commissioner of Data Protection? Controllers processing Personal Data in the DIFC generally file an annual notification with the Commissioner and pay the registration fee. This lets the policy state the registration position accurately.
- What is the Controller's data-protection registration or notification number with the Commissioner (if issued)? If the Commissioner has issued a registration or notification reference, we cite it as an accountability signal.
- What brand or trading name do you present to the public (if different from the legal name)? Users recognize you by your brand. If your website and legal entity names differ, we surface both so the policy reads naturally.
- Which properties and services does this policy cover? Defines what the policy applies to, so a visitor knows whether their interaction is governed by it.
- What is the primary website URL this policy is published on? Names the exact property the policy governs and where users will find it.
- What is the effective date of this policy? Data protection law requires transparency about when terms take effect; this is the date the current version applies from.
- What is the 'last updated' date to display? Shows users how current the policy is and anchors your change-log obligations.
- Have you appointed a Data Protection Officer (DPO)? Under DIFC DP Law Art. 16, a DPO is mandatory where you perform High Risk Processing Activities; many controllers appoint one voluntarily. This decides whether we name a DPO or a general privacy contact.
- DPO / privacy contact details Data subjects and the DIFC Commissioner must be able to reach the person accountable for privacy. This is the named point of contact for rights requests.
- What email should data subjects use for privacy questions and rights requests? This is the operative channel for exercising DIFC data-subject rights; it must be monitored.
- Who or what mailbox handles data-breach and security-incident reports? Data subjects and processors need a route to report a suspected breach so you can meet the Commissioner-notification timeframe. This can be the same as your privacy contact or a dedicated security mailbox.
- What response window will you commit to for data-subject rights requests? The DP Law sets a one-month baseline (extendable). You can state that statutory position or commit to a tighter service standard. This controls the wording of the response-time promise.
- What categories of personal data do you collect? DIFC transparency rules require you to tell people exactly what data you process. Select everything that applies across your properties.
- Do you process Special Categories of Personal Data (e.g., health, biometrics, racial/ethnic origin, political opinions, religious beliefs, criminal records)? DIFC DP Law Art. 11 imposes stricter conditions on Special Category data. This switches the heightened-protection section on or off.
- Which special categories do you process and why? Art. 11 requires a specific lawful condition for each special category; describing them lets us document the basis honestly.
- How do you collect personal data? Transparency requires disclosing the sources of the data you hold, including data not provided directly by the individual.
- Which lawful bases do you rely on to process personal data? DIFC DP Law Art. 10 requires at least one lawful basis for each processing activity. Select all you rely on across your operations.
- If you rely on legitimate interests, what are they? Legitimate interests must be specified and balanced against data-subject rights; naming them satisfies the transparency requirement.
- For what purposes do you use personal data? (List the main ones.) Purpose limitation (Art. 9) requires that you state, and stick to, specific purposes. Give a plain-language list.
- Do you send direct marketing communications? Direct marketing carries specific consent and opt-out obligations under DIFC law; this decides whether we include the marketing and opt-out section.
- On what basis do you send direct marketing? The DP Law direct-marketing rules turn on whether you rely on consent or on the soft opt-in for existing business contacts. This tailors the marketing section to your actual basis.
- Does your site use cookies or similar tracking technologies? If you set cookies, the policy must explain them and how users can control them. This toggles the cookies section.
- Which types of cookies do you use? Users need to know which categories operate so they can make informed choices; strictly-necessary cookies are treated differently from optional ones.
- Which analytics or advertising providers do you use (if any)? Naming third-party trackers is part of transparency and lets users understand onward data flows.
- How long does a stored cookie-consent choice remain valid before you re-prompt? If you run a consent management platform, the usual practice is to re-request consent after a set period. Stating the lifespan shows users their choice is not permanent.
- Which categories of third-party processors / service providers receive personal data? DIFC law requires you to disclose recipients or categories of recipients. List the types of vendors that process data on your behalf.
- Do you share personal data with affiliates, sister firms, or a partner network? Intra-group and partner-network sharing must be disclosed, especially where it crosses borders. Relevant to a firm with a multi-jurisdiction network.
- Describe the affiliate / partner-network sharing. Explains who else in your network may see the data and why, satisfying the recipients-disclosure requirement.
- Do you transfer personal data outside the DIFC? DIFC DP Law Arts. 26 and 27 govern transfers out of the DIFC. This decides which transfer-safeguards section applies.
- Which safeguards do you rely on for transfers outside the DIFC? Under Art. 26 (adequate jurisdictions) and Art. 27 (appropriate safeguards / derogations), you must identify the mechanism relied upon.
- If you rely on contractual clauses, which set do you use? Art. 27 lets you rely on clauses adopted or approved by the Commissioner, or other recognised standard clauses. Naming the specific set makes the transfer basis auditable.
- Which countries or regions do you typically transfer data to? Naming likely destinations helps users understand where their data may travel; important for a firm with UAE, UK, US and global operations.
- How do you want to express data retention periods? Storage limitation (Art. 9) requires that data not be kept longer than necessary. You can state a general standard or specify periods.
- Specify your key retention periods. Concrete periods increase trust and demonstrate compliance with storage limitation.
- Describe, at a high level, the security measures you take. Art. 14 requires appropriate technical and organizational measures; a high-level description reassures users without exposing vulnerabilities.
- Do you carry out solely automated decision-making or profiling that produces legal or similarly significant effects? DIFC DP Law Art. 37 gives data subjects rights regarding automated decisions; this decides whether that section is included.
- Describe the automated decision-making / profiling. You must explain the logic involved and the significance and consequences for the individual.
- Are your services directed at, or knowingly used by, children? Where children's data may be processed, additional protections and disclosures are expected. This toggles the children's section.
- Below what age do you treat a user as a child who cannot consent on their own behalf? The DP Law does not fix a single age, so you set the threshold your services apply for parental-consent purposes. Naming it removes ambiguity in the children's section.
- What law and forum govern this policy? For a DIFC controller this is ordinarily DIFC law and the DIFC Courts; we confirm rather than assume.
- How should users first raise a privacy complaint with you before going to the Commissioner? Good practice (and the Commissioner) expects you to offer an internal complaint route first.
Frequently asked
About the Website Privacy Policy and how HDAi works.
What is a Website Privacy Policy (DIFC)? +
A Website Privacy Policy (DIFC) is a website/app privacy policy for a DIFC-established controller under DIFC Data Protection Law No. 5 of 2020. It covers data-subject rights, lawful bases, transfers, and the DIFC Commissioner. It is for a DIFC-established business collecting personal data through a website or app that must publish a privacy notice compliant with DIFC Data Protection Law No. 5 of 2020 (not the onshore UAE PDPL, Federal Decree-Law No. 45 of 2021).
Is HDAi's Website Privacy Policy (DIFC) legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it; how far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Website Privacy Policy (DIFC)? +
You can generate and download the Website Privacy Policy (DIFC) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Website Privacy Policy (DIFC) current for 2026? +
Built on DIFC DP Law No. 5 of 2020 terminology (Controller, Processing, lawful basis, data-subject rights, the Commissioner of Data Protection, Article 26 international-transfer conditions), which is distinct from GDPR and from the onshore UAE PDPL.
How long does the Website Privacy Policy (DIFC) take? +
Estimated time about 22 min (44 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Website Privacy Policy (DIFC) work in the DIFC? +
Yes. This version is drafted for DIFC law and terminology. It is not a relabeled U.S. form. A licensed attorney coordinates with locally admitted counsel where required.
Other jurisdictions
The same document, drafted for another jurisdiction’s law.