DIFC Data Protection Law: The IT Checklist for Firms

DIFC firms get plenty of advice about the Data Protection Law from lawyers and consultants, and almost none about the part their IT actually has to do. Compliance is partly a legal exercise, best left to your data protection officer and counsel, and partly a set of practical IT settings: who can see which files, how long data is kept, whether a deleted record can be restored, and how fast you can find everything you hold about one person. This is the IT half of the job, in plain terms.

What the Data Protection Law actually asks of your IT

The DIFC Data Protection Law (Law No. 5 of 2020) is overseen by the DIFC Commissioner of Data Protection. It gives individuals rights over their personal data and expects firms to hold only what they need, keep it accurate and secure, not retain it longer than necessary, and respond properly to requests and breaches. The legal interpretation of all this belongs to your data protection officer and counsel, and the official position is set out in DIFC's laws and regulations.

What this guide covers is the other half: the IT configuration that turns those obligations into working settings. Your DPO decides what counts as personal data and on what lawful basis you hold it; IT makes the systems enforce those decisions. The table below maps each expectation to the IT control behind it, and the rest of the article works through them in order.

Step 1: Map what personal data you hold, and where it lives

You cannot protect, retain or produce what you have not mapped. For a typical DIFC firm, personal data lives in more places than people expect: Microsoft 365 mailboxes, SharePoint and OneDrive, Teams chats, laptops, a CRM or practice-management system, HR and payroll tools, and the backups of all of it. Candidate CVs, client files and staff records are all personal data.

Write down each store once: what personal data it holds, whose it is (clients, staff, candidates), who administers it, and where it physically sits. This single record is the foundation for every other step, and it is the first thing an auditor or your DPO will ask to see. Most of it, for a professional-services firm, sits inside Microsoft 365, which is covered in our Microsoft 365 guide for DIFC firms and set up through our Microsoft 365 and cloud service.

The map is not a one-off. New tools get adopted, staff move between teams, and a document store that held nothing sensitive last year can quietly fill with client data this year. Treat it as a living record that someone owns and reviews, rather than a document written once for an audit and never opened again. The firms that stay compliant are the ones where adopting a new system includes a line in the data map, not the ones who rebuild it in a panic before every review.

Step 2: Control who can see what (access and identity)

The single biggest compliance lever is access, because most data protection failures are not clever attacks but the wrong person seeing something they should not. Three settings do most of the work: multi-factor authentication on every account without exception, least privilege so each person can reach only what their role needs, and prompt removal of access the day someone leaves rather than weeks later.

Beyond that, review how files are shared. Open SharePoint and OneDrive links and external guest access accumulate quietly and are a common way personal data leaks outside the firm. Microsoft's Conditional Access can require a managed device or block risky sign-ins before they reach your data. This is ordinary office-IT hygiene, and it is covered under our cybersecurity service.

Pay particular attention to administrator accounts, because they can see everything and are the most valuable target. Keep day-to-day work off admin logins, use separate privileged accounts protected by MFA, and keep the number of people with that access small and written down. A single shared admin password that three people know is both a security risk and an answer you do not want to give when someone asks who could have reached a record.

Step 3: Keep data only as long as you need it (retention)

The law expects personal data not to be kept longer than necessary, which is hard to honour when everything lives forever in inboxes and shared drives. The IT answer is a retention policy: records are kept for a defined period that matches a business or legal need, then disposed of consistently, rather than left to pile up until someone remembers to delete them.

In Microsoft 365, retention policies apply these rules automatically across mail, SharePoint and OneDrive. The important point is who decides the periods: your DPO and counsel set how long each kind of record should be kept, and IT configures the system to enforce it. Retention set by IT alone, without that legal input, is a guess.

Step 4: Be able to recover it (backup and restore)

Retention is not backup, and confusing the two is one of the most common and expensive mistakes a firm makes. Retention governs how long records live on purpose; backup is a separate copy you restore when a record is deleted by accident, by a departing employee, or by ransomware. Both are needed, and one does not replace the other.

Microsoft 365's own recycle bins and retention are not a restorable backup of last resort, as Microsoft's own guidance on Microsoft 365 Backup makes clear. A separate backup, with a restore that has actually been tested rather than assumed, is what lets you recover personal data after a loss. We set this up under our backup and storage service. For a DIFC firm, the records you would least want to lose, client files and engagement history, are exactly the ones a tested restore protects.

Step 5: Secure it to a recognised baseline

The law requires appropriate security without prescribing exact products, which leaves firms guessing what appropriate means. The honest answer is to harden to a recognised, published baseline rather than to one provider's opinion, so your reasoning can be checked. The CIS Critical Security Controls are a sensible starting point: device encryption, endpoint protection, patching, and the access controls already covered.

A word on scope. This is office-IT security, the baseline a professional firm needs. If your firm requires a formal DFSA-aligned security audit, 24/7 monitoring or a security operations centre, that is specialist work and we would bring in a security partner rather than claim to be one. Our IT security guide for DIFC firms sets out where that line sits.

Do not over-buy either. A twelve-person DIFC advisory firm does not need the security stack of a bank, and a provider that sells one is not helping. The baseline should match the firm's size and the sensitivity of what it holds, which for most professional-services firms is real but not extreme. Right-sizing is itself part of appropriate security: controls nobody maintains, because they were built for a larger organisation, protect less than simpler ones that are actually kept current.

Step 6: Be ready for a data subject request or a breach

Two events start a clock, and both are easier to survive if the IT groundwork is already done. The first is a data subject request, where someone asks what personal data you hold about them. The second is a personal data breach. In either case, IT's job is the same: find everything about one person quickly, export it in a usable form, and keep access logs so you can see who did what and when.

This is exactly why the data map in Step 1 matters. A firm that has mapped its data and set up search can answer a request in hours; a firm that has not will spend days hunting through inboxes and drives, often missing some. Agree the process with your DPO before you need it, because the time to design a response is not during an incident.

Logging is the quiet part that only matters after something goes wrong. If you cannot show who accessed a file, when, and from where, you cannot answer the question that follows a suspected breach. Switch on audit logging across Microsoft 365 and your other systems from day one, because logs are only useful if they were already running when the event you care about happened. Turning them on after an incident tells you nothing about the incident.

Where IT ends, legal begins, and how Listonics helps

It is worth being clear about the boundary, because firms sometimes buy IT expecting it to deliver compliance on its own. Your data protection officer and legal counsel own the legal questions: what counts as personal data, the lawful basis for holding it, registration where required, contracts with processors, and what must be told to the Commissioner and when. A good IT provider works alongside them, not instead of them.

Listonics sets up and secures office IT for DIFC firms so the technical side of all this is in place and documented: Microsoft 365 configured with MFA, least privilege, retention and a tested backup, hardened to a recognised baseline, with the network diagram, access list and configuration written down so your DPO and any auditor can see how it is set. For the service details see IT support for DIFC firms, or book a free assessment to review your current setup against this checklist.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Oct 21, 2026 · Last reviewed October 24, 2026 · 2093 words