Dubai International Financial Centre has become a member of the Global Cross-Border Privacy Rules (CBPR) Forum, positioning Dubai among a small group of jurisdictions shaping international standards for cross-border data protection.
The announcement was made at a Global CBPR Forum workshop in the Philippines. DIFC is the first jurisdiction outside the Asia-Pacific Economic Cooperation (APEC) framework to join the forum. As part of the membership requirements, DIFC has also joined the Global Cooperation Arrangement for Privacy Enforcement (Global CAPE), which supports collaboration among privacy regulators.
The move aligns with the UAE’s Digital Economy Strategy and reflects DIFC’s efforts to strengthen legal and regulatory frameworks governing the international flow of personal data. Membership in the forum is intended to facilitate global trade while maintaining safeguards for secure and transparent data transfers.
His Excellency Arif Amiri, Chief Executive Officer of DIFC Authority, said the membership recognises the centre’s work in data and privacy protection. He noted that the scale and speed of global data exchange, particularly in financial services, require clear and enforceable standards. DIFC’s data protection regime applies to more than 8,000 registered companies operating within the centre.
The CBPR system certifies organisations that meet specified requirements for cross-border transfers of personal data. Originally developed under APEC, the system was expanded in 2022 with the establishment of the Global CBPR Forum, which allows participation by jurisdictions beyond the Asia-Pacific region and aims to promote regulatory interoperability worldwide.
In 2023, DIFC introduced Regulation 10, addressing the processing of personal data through autonomous and semi-autonomous systems, including artificial intelligence and machine learning technologies. The regulation was the first of its kind in the Middle East, Africa and South Asia region and provides a framework for the responsible use of such technologies.
DIFC’s Global CBPR membership follows its participation in the Global Privacy Assembly (GPA) in Seoul in September. During that event, the DIFC Commissioner of Data Protection signed cooperation agreements with privacy authorities in Brazil, the Isle of Man, Uganda and Kenya. DIFC is scheduled to host the GPA conference in Dubai in 2026, following the #Risk GCC event held in December 2025.
Photo credits: Government of Dubai Media Office









