CyphrQ
Menu

UAE Data Protection Law (PDPL) and AI Tools: What It Means in Practice

What the UAE Data Protection Law (PDPL) means for a business using AI tools: scope, consent, transfers, DIFC and ADGM, and a 7-question checklist.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

12 min read

Does the UAE data protection law apply when your business uses AI tools? Yes, if those tools touch personal data. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, usually called the PDPL) treats pasting a customer's details into a chatbot as processing personal data. That means consent or another lawful basis, a contract with the vendor, and care about where the data ends up.

This is not legal advice. What follows is an everyday-language take on the PDPL, written by CyphrQ.ai without a lawyer. Use the primary-source links to confirm each point with your own legal adviser.

What is the UAE PDPL and who does it apply to?

The PDPL is the UAE's first federal data protection law. The UAE government's own summary says it applies to "the processing of personal data, whether in full or part through electronic systems, inside or outside the country", and that it came into force on 2 January 2022 (u.ae). The official English text, titled "Federal Decree by Law Concerning the Protection of Personal Data" and issued on 20 September 2021, is on the UAE Legislation portal.

In practice: if your company is established in the UAE, or you handle personal data of people in the UAE, assume the law applies to you.

There are carve-outs. Law-firm summaries list government data, purely personal use, health data covered by the ICT in Health Fields law, banking and credit data under sector laws, and free zones with their own data protection legislation (Clyde & Co). The government's page confirms the separate health law (Federal Law No. 2 of 2019) covers the health sector "including its free zones" (u.ae).

Do DIFC and ADGM follow the same law?

No. Both financial free zones run their own regimes.

  • DIFC has the Data Protection Law, DIFC Law No. 5 of 2020, enforced by an independent Commissioner of Data Protection, with its own adequacy list and model clauses for exporting data (DIFC). Its Regulation 10, enacted on 1 September 2023, covers personal data processed through "autonomous and semi-autonomous systems", which DIFC describes as artificial intelligence (DIFC Regulation 10). If you are in DIFC and using AI on personal data, read that first. The technical section below summarises what it asks for.
  • ADGM has the Data Protection Regulations 2021 and an independent Office of Data Protection. Entities that process personal data must register as Data Controllers, and ADGM follows the European Commission approach of naming "adequate jurisdictions" for transfers (ADGM).

A company with a mainland entity and a DIFC entity can have two sets of rules. Map which entity owns the data before you pick a tool.

Mainland UAE (PDPL) DIFC ADGM
Governing law Federal Decree-Law No. 45 of 2021 DIFC Law No. 5 of 2020 Data Protection Regulations 2021
Regulator UAE Data Office Commissioner of Data Protection Office of Data Protection
Default lawful basis Consent, with listed exceptions; no legitimate-interests basis Several bases, GDPR-style (check the DIFC law) Several bases, GDPR-style (check the ADGM regulations)
Transfer mechanism Adequacy expected from the Data Office; exceptions otherwise; details awaited Adequacy list plus model clauses Named "adequate jurisdictions", EU-style
AI-specific rule None confirmed Regulation 10 (autonomous and semi-autonomous systems) None confirmed

What counts as a lawful basis under the PDPL?

Consent, mostly. The government summary says the law "prohibits processing personal data without the owner's consent", with exceptions such as where processing is necessary to protect a public interest (u.ae). A November 2021 Clyde & Co note lists further exceptions, including performing a contract and meeting a legal obligation, and points out that there is no "legitimate interests" basis, which is the one many companies lean on under GDPR.

DLA Piper's UAE handbook, last revised in January 2025, reads the law the same way: processing is prohibited without consent "except in the following cases", and legitimate interests is not among them (DLA Piper). This post does not quote article numbers; your adviser should read the exact wording on the government legislation portal.

Why this matters for AI: "we're just summarising support tickets with a chatbot" is a new purpose. If the customer consented to you handling their data to deliver a service, check whether that consent stretches to feeding it to a third-party AI vendor. Often the cleaner answer is to strip the personal data out first.

In practice: lawful basis is where European regulators have pressed AI vendors hardest. In December 2024 Italy's data protection authority, the Garante, announced a €15 million fine on OpenAI under GDPR. Its reasons were that OpenAI trained ChatGPT on users' personal data without an adequate legal basis, fell short on transparency, didn't notify a March 2023 breach, and lacked age checks. It also ordered a six-month public information campaign (Garante). The Garante's page now notes that the decision was temporarily removed after the Rome Tribunal accepted OpenAI's challenge (judgment no. 4153/2026, published 18 March 2026). It's EU law, not the PDPL, but the regulator's question is the one to ask yourself: on what basis does this data go into an AI system?

What are the cross-border transfer rules?

The PDPL sets requirements for transferring personal data outside the UAE (u.ae). The November 2021 Clyde & Co note describes a two-track approach: transfers to countries with an adequate level of protection, and transfers without adequacy that rely on exceptions such as the person's express consent or performance of a contract (Clyde & Co).

DLA Piper's January 2025 revision adds that the Data Office "is expected to approve certain territories" as adequate, and that for the other exceptions "further details are awaited from the Data Office" (DLA Piper). In other words, the adequacy list does not exist yet.

Most AI tools are hosted outside the UAE. If a vendor processes your prompts in the US or EU, you are making a cross-border transfer every time someone presses enter. You need to know where the data goes and on what basis.

What rights do customers have over their data?

The government summary names the right to correct inaccurate data and the right to restrict or stop processing (u.ae). Law-firm summaries add access, portability, erasure, and objection to direct marketing and to automated processing (Clyde & Co).

The practical test: if a customer asked you to delete their data tomorrow, could you also delete it from the AI tool? If the vendor keeps chat history for months, or used it for training, the honest answer may be no.

Who enforces the PDPL, and have the Executive Regulations been issued?

The regulator is the UAE Data Office, set up under Federal Decree-Law No. 44 of 2021 and affiliated with the UAE Cabinet. Its listed duties include preparing policies and legislation, setting monitoring standards, handling complaints, and issuing implementation guidelines (u.ae; founding decree).

The law leaves a lot to Executive Regulations: the breach notification period, exemptions for small-scale processing, and penalties. Law-firm summaries say organisations get six months from the regulations' issuance to comply (Clyde & Co).

As of 24 October 2026, neither the regulations nor an announcement of them appeared on u.ae, the UAE Legislation portal or a Data Office page. DLA Piper's handbook said the same as of 6 January 2025: "those have not yet been published" (DLA Piper). If someone quotes you a fine or a deadline, ask for the gazette reference.

What should you check before putting customer data into an AI tool?

Three things, in this order.

  1. A data processing agreement (DPA). The PDPL expects a vendor that handles personal data for you to follow your instructions under a contract (Clyde & Co). Consumer plans typically don't come with a data-processing agreement; check the vendor's business terms.

Anthropic's Commercial Terms, for example, incorporate its Data Processing Addendum but state that they are "not for consumer use" and that Claude.ai consumer accounts fall under separate Consumer Terms. OpenAI's equivalent wording was not checked for this post, so ask them directly. If the vendor can't show you a DPA, that's your answer. 2. Where the vendor stores and processes data. Ask for the region, the retention period, and who can see it (including human reviewers). This is the input to your cross-border analysis. 3. The vendor's training and retention settings. They differ by plan and by assistant. The settings for ChatGPT, Claude, Gemini and Copilot are covered in Is It Safe to Use ChatGPT at Work?.

Why vendor checks deserve the effort: IBM's 2025 Middle East findings cover organisations in Saudi Arabia and the UAE, with breaches between March 2024 and February 2025. They put the average breach at SAR 27.00 million, down about 18% from SAR 32.80 million the year before. Third-party vendor and supply chain compromise was the most common way in, at 17% of incidents. Only 38% of organisations in the region had formal AI governance policies, and another 24% were developing them (IBM). An AI vendor is a third party like any other.

A 7-question PDPL checklist for business owners using AI

  1. Which legal entity owns this data: mainland, DIFC, ADGM, or another free zone? That decides which law applies.
  2. Does the personal data need to go in at all? Can we replace names and numbers with placeholders?
  3. What is our lawful basis for this new use? Did the customer consent to it, or does an exception cover it?
  4. Do we have a signed data processing agreement with the AI vendor?
  5. Where is the data stored and processed, and for how long? If it leaves the UAE, what is our transfer basis?
  6. If a customer asks us to delete their data, can we delete it from the tool too, given the vendor's retention period?
  7. Who is accountable: do we have a data protection officer or a named person, and do they know we're using this tool?

Start with question 1 this week. Most of the others get easier once you know which regulator you'd be answering to.

Going deeper: for security and IT teams

To a data protection officer (DPO), an AI tool is a new processing activity, a new processor and, almost always, a new transfer. The legal failure modes are concrete: purpose creep beyond what customers agreed to, a transfer with no valid basis, an erasure request you can't fulfil, and a breach at a vendor you can't see into.

DIFC Regulation 10 in more detail. Clyde & Co's September 2023 summary sets out how it works (Clyde & Co):

  • Scope: a "System" is "any machine-based system operating in an autonomous or semi-autonomous manner".
  • Roles: the deployer, who authorises or benefits from the system, carries controller-like accountability. The operator, the technical provider building it on the deployer's instructions, is closer to a processor.
  • Notice: due at first use. It covers the human-defined purposes, the design principles and safeguards, and any codes or certifications relied on, with audit or certification evidence on request.
  • Register: on request, deployers and operators must produce one. It covers necessity and proportionality, how people access their data, whether decisions are solely automated, and where third parties sit, with export safeguards.
  • High-risk use: commercial use is barred unless four conditions are met. The Commissioner has set audit and certification requirements, the system meets them, it serves only human-defined or human-approved purposes, and an Autonomous Systems Officer has been appointed.

DIFC now runs a Regulation 10 certification scheme. It has published guidance (DPC-GL-31) and lists three accredited certification bodies: Eversheds Sutherland, Middle East Privacy and White Label Consultancy (DIFC). Check the current text before relying on the summary.

DIFC exports and notification. DIFC's data protection page points to:

  • its list of adequate regimes (Article 26);
  • model clauses, also called standard contractual clauses (Article 27(2)(c));
  • an EDMRI and EDMRI+ due diligence assessment.

DIFC entities must also file a data protection notification at incorporation and when details change (DIFC). A new AI vendor is a good prompt to check yours.

Mainland transfers. This section does not quote PDPL article numbers for transfers. The two-track model described earlier comes from the Clyde & Co and DLA Piper summaries. Until the Data Office publishes an adequacy list, record which exception you rely on for each region a vendor uses.

A processing record for one AI tool. Write one entry per use case, not per vendor. It should cover:

  • the purpose, for example "summarise support tickets";
  • the categories of people and data;
  • the lawful basis;
  • the vendor and every sub-processor;
  • storage and processing regions, with the transfer basis for each;
  • retention for each data type: chats, logs and backups;
  • security measures and a named owner.

If the use case is new, uses personal data at scale or makes decisions about people, run a data protection impact assessment (DPIA), even where the legal threshold is unclear.

The evidence a DPO will ask IT for:

Evidence What good looks like
Data flow diagram Device, identity provider, vendor tenant, processing region, storage region and sub-processors, with trust boundaries marked
Data location Storage and processing regions, confirmed in writing by the vendor
Retention Per data type, including deleted chats and safety-review copies
Sub-processors The vendor's current list with locations, and how changes are announced
Access Who at the vendor can see content, including human reviewers
Deletion proof How one person's data is erased on request, and the admin log entry that shows it

The per-assistant settings, admin consoles and audit logs that produce most of this evidence are in the ChatGPT-at-work guide.

Key takeaways

  • The PDPL has been in force since 2 January 2022 and applies to personal data processed inside or outside the UAE.
  • DIFC and ADGM have their own regimes and regulators. DIFC's Regulation 10 adds AI-specific duties.
  • Consent is the default lawful basis. There is no general "legitimate interests" basis like the one in GDPR.
  • Breach deadlines, exemptions and penalties sit in Executive Regulations that no primary government source shows as issued. Treat any specific deadline or fine you read online with caution.
  • Before customer data goes into an AI tool, confirm at least a data processing agreement, a known storage location, and a basis for any transfer outside the UAE.

Sources