UAE data protection law (PDPL) and AI

Which data protection law applies to your company?

• Federal PDPL - Federal Decree-Law No. 45 of 2021 on the protection of personal data. The general rule for companies on the mainland and in most free zones.
• DIFC - companies in the Dubai International Financial Centre follow the DIFC Data Protection Law, DIFC Law No. 5 of 2020, instead of the PDPL.
• ADGM - companies in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021.
• Health data - Federal Law No. 2 of 2019 on the use of information and communication technology in health fields governs patient data, including rules on where it may be stored, as a principle inside the UAE.
• Banking and credit data, government data - excluded from the PDPL where their own laws regulate them.

What does this mean for an AI project?

Every AI system that reads customer messages, CVs, invoices or patient requests processes personal data. Before building, these questions need an answer from your side and, where needed, your legal advisor:

• Which personal data does the AI read, and is it needed for the task?
• Where is the data processed and stored: in the UAE, in the EU or elsewhere?
• Which AI provider processes it, under which contract and terms?
• How long are inputs, outputs and logs kept?
• Who can see the results, and how can a person correct or delete data?

How do we design AI systems around data protection?

• Data rules in writing before the build: which data, which purpose, which storage location, who has access.
• Minimal data - personal data is masked or left out when the task works without it.
• Choice of hosting - AI providers and servers chosen by your requirements, for example servers in the UAE or the EU, or an open model on a server you control.
• Logs - every automated action is recorded with input, output and approval.
• Human review for decisions about people, such as job applications.
• Health data for clinics is kept separate and handled by the rules of Federal Law No. 2 of 2019; see AI for clinics in Dubai.

Which other rules matter for AI in the UAE?

Recording calls for an AI voice agent or meeting notes needs the consent of the participants; without consent it can be a criminal offence under Federal Decree-Law No. 31 of 2021, Article 431. AI-supported recruitment must respect the anti-discrimination rule in Article 4 of Federal Decree-Law No. 33 of 2021. Companies that also serve customers in the EU may fall under the GDPR.

We are not a law firm and do not give legal advice; the legal assessment stays with you and your advisor. What we deliver is a system whose data flows are documented, so that assessment is easy. Related: ChatGPT integration for businesses.