The Dubai International Financial Centre (DIFC), a self-governing jurisdiction, has a very common problem. Its businesses want to export personal data to the US, including to California (soon to be the world’s fourth largest economy), but the DIFC Data Protection Law (DP Law(1)) requires that personal data is only exported to a place which “ensures an adequate level of data protection”. It provides that “the Commissioner may determine from time to time that a Third Country, a territory or one … or more specified sectors within a Third Country … ensures an adequate level of data protection”.(2)