Dubai International Financial Centre (DIFC), the leading global financial centre in the Middle East, Africa and South Asia (MEASA) region, today announced its membership of the Global Cross-Border Privacy Rules Forum (Global CBPR Forum).
The announcement was made at a recent workshop of the Global CBPR Forum held in Philippines. This is a first among countries outside of the Asia-Pacific Economic Cooperation (a forum that promotes free trade among certain countries in the Pacific Rim). As a requirement for Membership, the Centre also joined the Global Cooperation Arrangement for Privacy Enforcement (the Global CAPE)
The move reinforces DIFC’s commitment to advancing interoperable, inclusive, responsive and trusted privacy frameworks in line with the evolving needs of businesses and individuals worldwide. Additionally, it strengthens the Centre’s contribution to building the digital economy globally as well as in Dubai and the UAE, in line with the UAE Digital Economy Strategy.
The membership facilitates further global trade, while safeguarding trust arising out of secure and more transparent cross-border data flows.
His Excellency Arif Amiri, Chief Executive Officer of DIFC Authority, commented: “Becoming the first jurisdiction in the region to receive Global Cross-Border Privacy Rules membership recognises DIFC’s initiatives to advance data and privacy protection. The digital age, fuelled by global connectivity and technology, means information is ubiquitous and instantly shareable. This results in businesses, particularly in finance, handling unprecedented volumes of individual data electronically and internationally every day. DIFC has established effective laws, regulation and compliance for more than 8,000 registered companies within the Centre, reflecting Dubai’s ongoing commitment to world class standards and its vision to be at the forefront of the digital economy.”
The Cross-Border Privacy Rules (CBPR) System certifies organisations’ compliance with certain programme requirements for the cross-border transfer of personal data. The CBPR System has operated under Asia-Pacific Economic Cooperation (APEC) since its inception. In 2022, the declaration of the establishment of the Global CBPR Forum – a framework that is not limited to jurisdictions in the APEC region, but open to those all over the world – was published for the purpose of facilitating cross-border transfer of personal data over a wider area and the promotion of interoperability of regulations among jurisdictions.
In 2023, DIFC enacted the ground-breaking Regulation 10 in the MEASA region on the processing of personal data via autonomous and semi-autonomous systems such as artificial intelligence (AI) or generative, machine learning technology. This paved the way for more collaborative, transparent platform for interoperability of the many and varied guidelines and principles issued by sovereign governments and non-governmental organisations. Creating a plug and play space for application of ‘best fit’ principles to AI technology development is fundamental, responsible and ethical processing of personal data in such systems.
DIFC’s recent Global CBPR membership follows its participation in the Global Privacy Assembly (GPA) in September this year in Seoul, South Korea. The event was the backdrop for the DIFC Commissioner’s Office signing cooperation agreements with the data protection authorities of Brazil, the Isle of Man, Uganda and Kenya. These agreements are significant as DIFC recently hosted #Risk GCC event on 8 and 9 December 2025, which helped set the stage for DIFC hosting the GPA conference in Dubai the same week in 2026. The GPA is a network of more than 130 privacy and data protection authorities and serves as a global standard-setting and cooperation platform for regulators across jurisdictions.
