Compliance for Firms

Data Protection for Data Controllers and Data Processors

The QFC Data Protection Regulations 2021 (the Regulations) define detailed principles and obligations for both Data Controllers and Data Processors. The Regulations set out the core principles apply to all processing of Personal Data:

Lawfulness, fairness and transparency
Specific purpose
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality of processing
Accountability

QFC Data Controllers are not required to register with the Data Protection Office (DPO). However, personal data breaches must be reported to the DPO within 72 hours of becoming aware of them - Guidance.

PDF

QFC Data Protection Regulations and Rules Guidance

Data Controller Requirements

Data Controllers have specific obligations under the QFC Data Protection Regulations. The key requirements are outlined below.

Transparency (Articles 13–15)

Data Controllers must be transparent with Data Subjects about how their Personal Data is used. This includes providing clear information on what data is collected, the purpose of processing, the lawful basis relied on, how the data will be used, and who it may be shared with.

Data Subjects must also be informed of their rights under the Regulations, including how to access, correct, or object to the processing of their Personal Data, and their right to make a complaint to the Data Protection Office. Information should be provided in a clear, accessible and timely manner.

Records of Processing Activities (Article 30)

The Regulations require Data Controllers and Data Processors to maintain a written record of the personal data they collect, the purpose of processing, and the lawful basis for that processing.

Clear and complete records accurately reflect processing activities and support compliance and accountability. Maintaining these records also helps firms understand how data is collected, used, shared and stored, and supports transparency requirements under the Regulations.

To assist firms, the DPO has developed a practical Records of Processing Activities (RoPA) template that can be used to meet this requirement.

International Transfers (Articles 23 & 24)

The transfer of any Personal Data outside the QFC must comply with the conditions set out in the Regulations.

Firms are responsible for ensuring that any cross-border transfer of Personal Data is properly protected. To support compliance, the DPO provides:

A list of jurisdictions deemed adequate under the Regulations
A set of Standard Contractual Clauses (SCCs) for use when adequacy is not established

The Regulations also provide limited derogations that allow international transfers in special circumstances.

Firms may use these tools to ensure lawful and secure overseas transfers.

Data Protection Impact Assessments (Article 27)

Certain processing activities carry higher risks to individuals' rights and freedoms. Article 27 sets out the situations in which a Data Protection Impact Assessment (DPIA) is required before engaging in such activities.

The DPO has published a list of processing activities that require a DPIA prior to the processing of Personal Data.

Personal Data Breach Reporting (Article 31)

Data Controllers must notify the Data Protection Office of Personal Data breaches that are likely to result in a risk to individuals' rights and freedoms. Notification must be made without undue delay and in accordance with the requirements set out in the Regulations.

Data Controllers must also consider whether to notify affected Data Subjects, taking into account the risk to their rights and legitimate interests, and provide appropriate information where notification is made.

Data Controllers can report Personal Data breaches via the Client Portal (under Legal and Compliance), or directly to the Data Protection Office using the designated form.

How the DPO Supports Compliance

QFC Data Protection Guidance

The QFC Data Protection Guidance is a comprehensive document that supports the application of the QFC Data Protection Regulations and Rules. It provides detailed explanations of key provisions, along with practical examples and clarifications to help Data Controllers and Data Processors understand and meet their obligations.

The Guidance is intended to assist firms in implementing effective data protection practices and ensuring that Personal Data is handled in accordance with the Regulations.

Data Protection Artificial Intelligence Training

The DPO has developed a training document to support firms when developing, deploying and monitoring AI systems in a way that respects individuals' data protection rights in accordance with the Regulations. The framework covers:

AI Lifecycle – Stages of AI and where data protection applies
Data Protection Principles – Core obligations under the Regulations
Governance and Accountability – Roles, oversight and organisational responsibility
Design and Development – Building AI with data protection from the outset
Third-Party Processors – Managing vendors, contracts and transfers
Training and Testing – Data quality, anonymisation and bias controls
Deployment and Operation – Monitoring, audits and incident handling
Risks of AI – Key legal, technical and ethical risks
Updating and Decommissioning – System updates and secure retirement
Review and Improvement – Ongoing audits, reviews and feedback

The DPO publishes tools and supporting documents on a regular basis to assist firms. These resources can be found on the QFC Data Protection Resources page. Firms should check this page regularly for updates.