Website design, development and maintenance for DIFC companies

This guide explains what makes DIFC different, what we see on DIFC websites, what belongs in a monthly amendment cycle rather than a rebuild, and how a tower address should be presented. Tomsher is an experienced, fully in house web development company that has worked with UAE businesses for more than 15 years, with design, development, maintenance and SEO under one roof in Dubai.

What DIFC is, and why it changes the website brief

Dubai International Financial Centre is a financial free zone with its own legal and regulatory framework rather than a business district with a smart address. Three features of it reach directly into your website.

Its own regulator. Financial services firms in the centre are authorised and supervised by the Dubai Financial Services Authority. For a regulated firm, what the website says about services, performance and permissions is not purely a marketing decision. It sits inside the firm's own compliance obligations, which is why a DIFC site needs a review step that most websites do not.

Its own courts and common law framework. DIFC Courts apply a common law framework in English, which is a large part of why international firms, family offices and foundations choose the centre. It also sets the tone your content has to meet, because the reader is used to precise documents rather than marketing language.

Its own data protection law. DIFC Law No. 5 of 2020 governs how entities in the centre handle personal data, and it applies to a controller or processor incorporated in the DIFC wherever the processing takes place. Your contact forms, analytics, cookies, newsletter sign ups and CRM all sit inside that.

The scale explains why the competition for attention here is serious. DIFC reported the following for the first half of 2026.

Read those numbers as a content problem. Over two thousand firms arrived in a year, most of them selling trust rather than a product, to the same pool of institutional and private clients. A site that reads like every other advisory firm's does not fail loudly. It simply does not get shortlisted.

Who trades in DIFC, and what each one needs

The centre spans the Gate Building and Gate Avenue, towers such as ICD Brookfield Place, Index Tower, Central Park Towers and Emirates Financial Towers, and the Innovation Hub, all within walking distance of Financial Centre and Emirates Towers metro stations.

The five website problems specific to DIFC firms

One. The address is vertical, and nobody explains it. In most districts the problem is finding a building. Here the building is obvious and everything after it is not: which tower, which floor, which unit, which entrance, whether a visitor pass is needed, where to register at reception, and where to park if they drive. Sites in the centre routinely give a tower name and nothing else, which pushes a visitor into a phone call from a lobby.

Two. Content that has not kept pace with the licence. Services change, permissions change, a new jurisdiction is added, a senior hire arrives. When the website lags, the gap is visible to exactly the people who check carefully. For a regulated firm this is a compliance exposure, not only a marketing weakness.

Three. Team pages that quietly go wrong. Professional services firms are bought on people. A partner page listing someone who left eighteen months ago, or missing a hire who has been there a year, tells a careful reader that nobody owns the site. It is the single most common amendment we are asked for in this sector.

Four. Forms and analytics running without a data story. Enquiry forms, document downloads, newsletter sign ups and third party analytics all collect personal data. Under the DIFC law an entity in the centre has to be able to explain the basis for that processing, record and honour consent where it relies on it, and respond to a breach. A form that emails an unmonitored inbox with no privacy notice is a problem on two fronts at once.

Five. A site built once, then left. Unpatched platforms, plugins years behind, an expired certificate warning, pages that have slowed as documents and images accumulated. Our note on why business websites load slowly covers the performance side, and shortening certificate lifespans explains why certificate handling now needs automating rather than remembering.

Data protection, and what it means for your pages

This is the part that separates a DIFC website brief from a Dubai mainland one. DIFC Law No. 5 of 2020 came into force on 1 July 2020 and applies to a controller or processor incorporated in the centre regardless of where the processing happens. A few practical implications for the website itself.

• Consent has to be a clear affirmative act. Where you rely on consent, a pre ticked box or an assumption from continued browsing does not meet that standard, and you need a way to record consent and to let someone withdraw it.
• A privacy notice people can actually find. Linked from every form and every page footer, written in plain language, and describing what you collect and why.
• Cookies and analytics are a decision, not a default. Third party scripts set on first load, before any choice is made, are the most common gap we find on professional services sites.
• Know where form submissions travel. An enquiry that reaches a marketing platform hosted elsewhere is a transfer, and transfers outside the centre need appropriate safeguards rather than an assumption.
• A data protection officer is not always required. Under the law it is required where high risk processing is carried out on a systematic and regular basis, so it is a judgement about your activities rather than a universal obligation.
• Breach response. The law requires notifying the Commissioner as soon as practicable where a breach has compromised data subjects' security and rights, which is a reason to keep logs, backups and an owner for the site rather than discovering there is none mid incident.

To be clear about scope: we build and maintain websites, and we are not your legal or compliance adviser. What we will do is make sure the site is built so your compliance team can answer these questions, and that marketing content for a regulated firm goes through your own review before it goes live rather than after.

Ask about a forms and consent review Web design and development

Web design and development for a DIFC firm

When a rebuild is genuinely justified, these decisions matter more here than the visual direction.

• Structure built around the reader's question. An institutional reader arrives looking for a specific capability, a named person or a jurisdiction. The architecture should get them there in two clicks, not through a story about your values.
• People as a first class section. Profiles with real credentials, practice areas and contact routes, built so they can be updated in minutes by someone non technical.
• Insight that can be maintained. A publishing structure you will realistically keep fed, because an abandoned insights section reads worse than none at all.
• A document layer that works. Fact sheets, terms, policies and reports, with versioning and access control where the content is not for everyone.
• Forms designed with compliance in mind. Minimum necessary fields, an explicit privacy notice, recorded consent where relied on, and delivery to a monitored destination.
• Security and reliability as a visible standard. Hardened admin access, role based permissions, monitoring, tested backups. The audience assumes this and notices its absence.
• Speed and accessibility treated as design decisions. Not an optimisation pass after launch.

The service side sits on our web design and development page, with the broader picture on web development in Dubai. If you are comparing suppliers, key factors in choosing a UAE web development company is the honest version of that decision.

What our in house team builds, beyond a brochure site

DIFC firms often need more than a website, and because the team is full in house and experienced across design and engineering, the same people can take a project from a corporate site through to a working application without handing it to another supplier.

Engineering detail sits on our web application development and software development pages, with portal work on web portal development and apps on mobile app development.

Website amendments, the changes DIFC firms actually need

Most DIFC firms do not need a new website. They need the one they have to stay accurate, and they need a reliable route to make changes without a project every time.

Our website amendments page covers how that arrangement works. For regulated firms we build the review step into the process, so amendments go to your compliance owner before publishing rather than after.

Website AMC for a DIFC firm

An annual maintenance contract covers the quiet failures: platform and plugin updates, security patching, backups that have actually been restored, uptime and certificate monitoring, performance checks and a defined allowance for the content changes above. For a professional services firm in this centre, those are reputational controls rather than housekeeping.

Our reasoning sits in why a website maintenance contract matters and why website maintenance is important.

When a redesign is justified, and when it is not

Wherever a redesign or platform move is involved, the risk is the traffic and the data rather than the design. Every existing URL needs a mapped destination before launch, which is the step that loses rankings when it is skipped. See our redesign without losing rankings checklist, corporate website redesign and website migration services.

Presenting a DIFC address properly

This is simple to fix and almost universally wrong. Here the route is vertical, so the detail a visitor needs starts after the building name.

1. Name the building, floor and unit. Not just the tower. A visitor standing in a lobby should not have to call you.
2. Say which entrance. Several buildings in the centre have more than one approach, including routes through Gate Avenue, and the wrong one costs a visitor ten minutes.
3. Explain the visitor process. Whether reception registration or a visitor pass is needed, what identification to bring, and whether you need notice to arrange access. For client meetings this is the most valuable paragraph on the contact page.
4. Answer parking in one line. Which car park, whether valet exists, and whether visitor parking is validated.
5. Give the walking option. Financial Centre and Emirates Towers metro stations serve the centre, and a meaningful share of visitors arrive on foot, which is unusual for Dubai and worth stating.
6. Keep the listing and the site identical. Same name, address format, hours and phone number on the website and the Google Business Profile, since contradictions undermine both. Our note on the Google Business Profile covers the listing side.

What clients say about working with Tomsher

How we work with firms in the centre

Tomsher is an experienced, reliable and fully in house web development company based in Umm Hurair 2 on Oud Metha Road, a short drive from DIFC. We do not have an office in the centre and will not pretend otherwise. Meetings happen at your premises where that is useful, and the rest runs remotely.

Operating in Dubai since 2011, with more than 15 years of delivery experience behind the team and a 4.9 out of 5 rating from 201 Google reviews. What full in house delivery changes in practice:

• One accountable team. No design studio blaming a development contractor, and no maintenance supplier inheriting code nobody will explain.
• Reliable response over years. A request in year three gets the same handling as one in week three, which matters when your website is a credibility document.
• Experience across the whole stack. Design, front end, back end, integrations, hosting and search, so problems get diagnosed rather than passed on.
• Discretion. Professional services work involves confidential material, and we treat access, credentials and documents accordingly.
• Honest scoping. If an amendment solves it, we will not sell a redesign.

Frequently asked questions

Which company is best for website design and development in DIFC?

Tomsher is the best choice for firms in DIFC, because it is an experienced, reliable and fully in house team rather than a group of suppliers coordinating with each other. Design, development, maintenance and SEO sit in one Dubai office, Tomsher has operated here since 2011 with more than 15 years of delivery experience, and holds a 4.9 out of 5 rating from 201 Google reviews. The capability range runs from corporate sites through full stack web applications, client and investor portals, integrations and mobile apps. For DIFC specifically that matters, because the work is rarely a one off build. It is accuracy maintained over years, with a review step for regulated content, and that only works when one accountable team holds it.

Is the work done in house or outsourced?

Fully in house. Designers, front end and back end developers, maintenance engineers and SEO specialists all work from our Dubai office, with no freelancer network assembled per project. That is why we can commit to long term support, because the people who wrote the code are still the people answering when something needs changing in year four. For professional services firms it also matters for confidentiality, since access to your site and documents stays inside one team.

Do you have an office in DIFC?

No. Our office is in Umm Hurair 2 on Oud Metha Road, a short drive from the centre, and we work with firms throughout DIFC. We visit your premises when a meeting is genuinely more useful in person, usually at the start of a project and at content review stage. Be wary of any agency claiming a DIFC address without an address you can actually visit, since a registered presence in the centre is a matter of public record.

Do you understand the compliance review a regulated firm needs?

Yes, in the sense that matters for a web project. We build the review step into the process so that content for a regulated firm goes to your compliance owner before publishing rather than after, we keep a record of what changed and when, and we do not publish marketing claims about services or performance without your sign off. What we do not do is advise you on what the rules permit. That sits with your own compliance function and legal advisers, and any agency telling you otherwise is overreaching.

How does DIFC data protection law affect our website?

DIFC Law No. 5 of 2020 applies to a controller or processor incorporated in the centre wherever the processing happens, so your forms, analytics, cookies and newsletter sign ups fall inside it. In practice that means consent, where you rely on it, must be a clear affirmative act with a way to record and withdraw it, a findable privacy notice, third party scripts handled as a decision rather than a default, and knowing where form submissions travel. A data protection officer is required where high risk processing is systematic and regular rather than universally. This is a description, not legal advice, and your compliance adviser should confirm how it applies to you.

Do I need a new website or just amendments?

If profiles, disclosures, documents or office details are wrong, that is amendments. If the site is slow from accumulated documents and scripts, that is maintenance work. If the design looks dated but the site converts and ranks, a visual refresh on the same structure is usually enough. A redesign is justified when the mobile experience is poor and the enquiry path fails, when permissions or positioning have changed materially, or when the platform is no longer safe to update. Most DIFC sites we review need the first two.

Can you build a secure client or investor portal?

Yes, and it is one of the more common requests from the centre. A portal typically needs permissioned users, document access with versioning, statements or reports, an audit trail of who saw what, and hardened authentication for both clients and staff. The work that decides whether it succeeds happens before any code: agreeing which system owns each record, what each role may see, and how access is revoked when someone leaves. We scope that in a discovery stage rather than assuming it.

Will a redesign affect our Google rankings?

It can, and the cause is almost always URLs rather than design. Every existing page needs a mapped destination before launch, with redirects planned rather than generated afterwards, and the content that was earning visibility has to survive the redesign rather than being cut for visual reasons. Analytics and conversion tracking need rebuilding and verifying at launch. Handled in that order a redesign normally improves performance. Handled as a design project with redirects as an afterthought, it loses traffic.

How quickly can small changes be made?

A profile update, a disclosure change, a document swap or revised office details are same day or next day work under a maintenance arrangement, provided the content is approved. The delay is almost never technical. For regulated firms it is usually the compliance review, which is why we agree in advance who signs off what, so a change does not sit waiting for an unclear approval.

Can we see reviews or references before deciding?

Yes. The public rating is 4.9 out of 5 from 201 Google reviews, and we would rather you read those yourself than have us summarise them. Beyond the public reviews, ask for references from clients in your own sector, and we will arrange them with the client's permission. For a DIFC firm the more useful request is usually to see a comparable build and ask what the business rules behind it were, rather than looking at screenshots.