Private AI under the UAE PDPL: what the law requires in 2026, and what's still pending

Key takeaways

• The PDPL is law (in force since 2 January 2022), but its executive regulations remain unissued as of August 2026, so detailed procedures and penalty amounts aren’t published.
• The UAE Data Office is the federal regulator.
• DIFC and ADGM have their own data protection laws. DIFC added specific rules for AI and autonomous systems in 2023.
• Practical standard: treat the principles as binding now: lawful basis, minimisation, purpose limits, security, rights and transfer safeguards.
• For AI: mask personal data, prefer private or local models, use zero-retention terms and keep audit logs.

Where the law stands

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) took effect on 2 January 2022. It sets out:

• Consent as the default basis for processing, with listed exceptions such as contract performance and legal obligations.
• Data subject rights: access, correction, erasure, restriction, portability and objection.
• Security and breach notification duties.
• Cross-border transfer conditions.
• Data protection officers in some circumstances.

The detail on all of these (deadlines, thresholds, the list of adequate countries, penalty amounts) was left to executive regulations. As of August 2026, legal commentators report that those regulations still hadn’t been issued. Some figures circulating online, such as specific fines or a 72-hour breach window, can’t be traced to a published UAE source.

What this means: the obligations exist, the procedures are unclear, and enforcement on the mainland has been limited so far. That isn’t permission to ignore the law. When the regulations arrive, businesses with good practices already in place will need the fewest changes.

The free zones are different

• DIFC has its own Data Protection Law (2020) and, since 2023, rules on processing personal data through autonomous and semi-autonomous systems, including AI, such as notice and transparency requirements.
• ADGM has its own Data Protection Regulations (2021), modelled closely on the GDPR.

If you’re licensed in either, their rules apply instead of the PDPL.

Using AI with customer data: a practical standard

1. Map the data. Which personal data enters each AI workflow, and why?
2. Minimise. Send the model only what the task needs.
3. Mask. Replace names, phone numbers, emails and ID numbers with placeholders before text reaches any third-party model; restore them after.
4. Choose the deployment. For sensitive workloads, run open-weight models on infrastructure you control, in the UAE where possible. For others, use enterprise APIs with zero-retention terms.
5. Tell people. Your privacy notice should say that AI is used, for what, and by which providers.
6. Log and limit. Keep audit logs of AI actions, and delete data on a schedule.
7. Plan transfers. If data leaves the UAE, document why and what safeguards apply.

“By default, we do not use data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu…”

OpenAI, Business data privacy, security and compliance

That’s how I build AI lead qualification and other client systems. See the AI & automation service.

If you also serve the EU

Customers in the EU bring the GDPR and the EU AI Act into play (guide). Customers elsewhere bring their own data-protection laws. Designing to the strictest common standard is usually cheaper than running three systems.