Jurisdiction inserts
Each insert names an entity, an activity, a source date, and the facts that change the answer. None of them recommends a jurisdiction, a court, or a filing.
DIFC Commissioner of Data Protection
A personal data breach under Articles 41 and 42 of DIFC Data Protection Law 2020, where the breach compromises confidentiality, security, or privacy.
Notify the Commissioner as soon as practicable in the circumstances. Communicate to the individual as soon as practicable if the risk is high, and promptly if there is an immediate risk of damage. The FAQ says it is not legal advice and does not warrant accuracy for a particular firm.
What would change the answer. Whether DIFC data protection law applies to this entity and this processing, and whether the breach compromises confidentiality, security, or privacy. This is not a blanket 72-hour rule.
Regulatory Commissioner of Data Protection: FAQs and glossary FAQ checked 14 October 2026. A direct request was rate-limited. A second fetch returned the FAQ text.
ADGM Office of Data Protection
A personal data breach by a Data Controller under Article 32 of the ADGM Data Protection Regulations 2021. The page describes a Data Controller as an ADGM registered entity that determines the purposes and means of processing.
Notify without undue delay and, where feasible, not later than 72 hours after becoming aware.
What would change the answer. Whether the entity is an ADGM Data Controller, and whether notice within 72 hours is feasible. The 72 hours are not a clock for every UAE startup.
Regulatory Data breach notifications Page checked 14 October 2026.
Dubai Financial Services Authority
Anti-money laundering, counter-terrorist financing, and sanctions compliance.
The supervisory regime applies to Authorised Firms other than a Credit Rating Agency, Authorised Market Institutions, DNFBPs, and Registered Auditors. The page calls these Relevant Persons.
What would change the answer. Whether this entity is a Relevant Person. Raising equity does not by itself put a startup inside the AML module.
Regulatory AML, CTF and sanctions compliance: summary Summary page checked 14 October 2026.
UAE federal bankruptcy, Federal Decree-Law No. 51 of 2023, Article 3
A possible inability to pay debts, and whether a federal process is even in scope.
Article 3 applies to companies subject to the Commercial Companies Law, a natural person with the capacity of a trader, and a licensed civil company of a professional nature. It does not apply to government companies whose own laws or documents set special settlement or bankruptcy rules, free-zone companies and businesses that follow their own special rules, banks, financial institutions and insurance companies licensed by the Central Bank and governed by separate laws, or personal, family, and consumption debts, including a home for personal or family residence. The u.ae page also says the law does not apply to natural individuals. That sentence is broader than the trader limb in Article 3. Ask counsel which sentence governs, and follow Article 3.
What would change the answer. The legal form, whether a free zone has its own rules, whether a person has the capacity of a trader, and whether the debt is personal, family, or consumption. Nothing here recommends a jurisdiction or a process.
Regulatory UAE law on bankruptcy u.ae page updated 11 August 2026 and checked 14 October 2026. The legislation portal blocked a direct request. A second fetch returned Article 3.