Skip survey header

Regulation 10 Certification Assessment Tool - 2026

Regulation 10 of the DIFC DP Regulations addresses processing of Personal Data in autonomous or semi-autonomous Systems.  Under specific conditions, such Systems must be certified.  Please use this tool to understand whether your business is required to certify any such Systems that satisfy these conditions as set out in the two (2) basic questions below.

Please note that assessment tool / guidance is for informational purposes only and should not be construed as legal advice provided by the Commissioner’s Office.

Personal data, if any, that is collected as a result of completing this assessment will be handled in accordance with the DIFC Online Data Protection Policy.
 
Question 1

Does your organisation use, operate, provide, offer or otherwise make available a System to engage in High Risk Processing (HRP)** Activities?

**High Risk Processing is defined in the DP Law 2020 as Processing of Personal Data where one (1) or more of the following applies: 
a.   Processing that includes the adoption of new or different technologies or methods, which creates a materially increased risk to the security or rights of a Data Subject or renders it more difficult for a Data Subject to exercise his rights; 
b.   a considerable amount of Personal Data will be Processed (including staff and contractor Personal Data) and where such Processing is likely to result in a high risk to the Data Subject, including due to the sensitivity of the Personal Data or risks relating to the security, integrity or privacy of the Personal Data; 
c.   the Processing will involve a systematic and extensive evaluation of personal aspects relating to natural persons, based on automated Processing, including Profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; or 
d.   a material amount of Special Categories of Personal Data is to be Processed.  NB: Special category data is Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade-union membership and health or sex life and including genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person.
 
*This question is required.
0%