What Are the Fines for DIFC Regulation 10 Non-Compliance?

Fines for DIFC Regulation 10 non-compliance range from USD 25,000 to USD 50,000 per violation, under the DIFC Data Protection Law as amended by Amendment Law No. 1 of 2025 (in force 15 July 2025). The USD 50,000 maximum applies to failure to conduct a Data Protection Impact Assessment before high-risk AI processing and to improper data sharing with public authorities under Article 28. A separate USD 25,000 fine applies to failure to complete the mandatory annual DPO assessment. Since January 2026, data subjects can also bring civil claims directly in the DIFC Courts without prior Commissioner involvement.

These are per-violation figures, not annual caps. A firm operating three AI systems without DPIAs for any of them faces three separate USD 50,000 exposures.

The previous maximums were USD 20,000 for missing DPIAs and USD 10,000 for Article 28 breaches. Both were substantially increased by Amendment Law No. 1 of 2025. The DPO assessment fine is new — it did not exist before the 2025 amendments.

The fine schedule targets procedural failures with the highest risk to data subjects. The three named breaches are:

Failure to conduct a DPIA before high-risk processing. A DPIA is mandatory before deploying any AI system that processes personal data in the DIFC. For high-risk systems specifically, the DPIA must address the risks the system poses to individuals' rights and freedoms, document bias and discrimination controls, and record human oversight mechanisms. Failure to complete one before operating the system attracts a fine of up to USD 50,000.

Failure to comply with Article 28 on data sharing with public authorities. Controllers and processors must verify that any request from a public authority to share personal data is valid and proportionate before sharing it. The 2025 amendments inserted the word "after" into the provision, making verification a condition precedent to disclosure, not a best-efforts obligation. Breach carries a fine of up to USD 50,000.

Failure to complete the mandatory annual DPO assessment. Controllers must complete and submit to the Commissioner an annual assessment of whether they are required to appoint a Data Protection Officer. Failure to do so now attracts a fine of up to USD 25,000, a breach category that did not exist before July 2025.

Beyond these named fines, the Commissioner retains powers to issue remedial directions and decision notices across the full range of Regulation 10 obligations, including failures around transparency notices, audit trail documentation, and human oversight controls.

Yes. Since 15 July 2025, Article 64A of the amended DIFC Data Protection Law gives data subjects a direct right of action in the DIFC Courts. They can file civil claims without first lodging a complaint with the Commissioner or waiting for enforcement action.

Claims can cover financial loss and non-financial damages including distress. Article 64A also clarifies that joint controllers and processors can each be named. Courts are empowered to issue compensatory orders.

This creates a second enforcement track that runs independently of the Commissioner's fine schedule. A customer who received an incorrect automated credit decision, and can show the firm lacked a compliant DPIA or audit trail, can litigate that directly. The administrative fines are the floor of the exposure, not the ceiling.

Regulation 10 was introduced in September 2023. The DIFC indicated that full enforcement of its AI-specific obligations was planned for January 2026, giving firms time to assess systems, work towards compliance, and prepare for certification. Full enforcement commenced on that schedule.

The updated fine schedule — with the higher USD 50,000 maximums and the new USD 25,000 DPO assessment fine — came into force earlier, on 15 July 2025, as part of Amendment Law No. 1 of 2025.

No decision notices specific to Regulation 10's AI obligations have been published yet. The Commissioner's office has issued decision notices under the broader data protection framework since 2022. AI-specific enforcement decisions are a matter of when, not whether.

Yes. The Commissioner can open investigations without a complaint. The 2025 amendments explicitly extended this power to cover unfair or deceptive privacy practices, including inaccurate statements of compliance with certification standards.

A firm that overclaims Regulation 10 compliance in a privacy notice, investor document, or product description — before the relevant certification standard has been established and met — is exposed to proactive investigation on that basis alone.

For a DIFC-licensed financial institution running multiple AI systems that process personal data, the exposures stack:

• USD 50,000 per AI system deployed without a completed DPIA
• USD 50,000 for each improper public authority data disclosure
• USD 25,000 for a missing annual DPO assessment
• Civil damages at the DIFC Courts' discretion, plus litigation costs, for any data subject who brings a claim under Article 64A
• Reputational exposure from a published decision notice

The USD 50,000 fines are per violation. Volume matters. A firm with five in-scope AI systems and no DPIAs for any of them has USD 250,000 of administrative fine exposure before any civil claims are considered.

A standard data protection DPIA template does not satisfy Regulation 10. The DPIA must specifically address:

• The risks the AI system poses to individuals' rights and freedoms
• The potential for unfair or discriminatory outcomes
• Controls — including algorithmic triggers — for human intervention when discriminatory processing is detected
• Mitigation strategies for each identified risk
• Evidence that the system processes personal data only for human-defined or human-approved purposes

The DPIA must be retained and producible on request from the Commissioner or from parties affected by the system's decisions.

Complete DPIAs for every in-scope AI system. The USD 50,000 fine applies per system without one. The DPIA is also the foundation for audit trail documentation and the evidence base for any civil claim defence. It is the single highest-leverage compliance action under Regulation 10.

Verify that existing DPIAs are AI-specific. A DPIA completed for general data protection purposes and then extended to cover an AI system does not satisfy the requirement. If it does not address bias controls, human oversight triggers, and AI-specific risk scenarios, it needs to be redone.

Magpie generates the DPIA evidence records, audit trails, and observability documentation that Regulation 10 requires, stored in your own infrastructure. Request a demo.