DIFC data protection law requires business action