AI and personal data in the UAE: what the PDPL means for your AI projects

Most useful AI projects touch personal data: customer emails, claim forms, employee records, patient reports. In the UAE, that brings the Personal Data Protection Law (PDPL) into scope from day one.

The PDPL in brief

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been in force since 2 January 2022. It applies to processing the personal data of people in the UAE, including by organisations based outside the country. Its executive regulations, which are expected to set out details such as cross-border transfer mechanisms, had still not been issued as of mid-2026, but the law's core principles already apply.

Some areas sit outside the PDPL. The DIFC and ADGM financial free zones have their own data protection laws, and health data, banking and credit data, and government data are covered by separate rules. Other free zones are not exempt.

Health data has stricter rules

Federal Law No. 2 of 2019 on the use of information and communication technology in health fields restricts storing, processing and transferring health data outside the UAE. Ministerial Decision No. 51 of 2021 allows limited exceptions, mostly with conditions such as patient consent, encryption and keeping a copy in the UAE. For hospitals, clinics and insurers, where an AI model runs is therefore a compliance question, not only a technical one.

Practical steps for AI projects

• Map the data. List the personal data each AI use case needs, where it comes from and where it will be processed.
• Use less of it. Remove or mask fields the model does not need.
• Control where it goes. Check whether prompts, documents or outputs leave the UAE, including through cloud AI services. For sensitive data, consider running models on your own infrastructure.
• Set clear terms with vendors. Make sure contracts cover storage location, security, retention and whether your data can be used to train models.
• Keep people in the loop for decisions that affect individuals, and record how AI outputs are reviewed.
• Align with the UAE AI Charter. Its principles include data privacy, transparency, human oversight, and governance and accountability.

The Federal Authority for Artificial Intelligence and Data, announced in June 2026, is expected to set national standards and guidelines for data and AI, so more detailed guidance is likely. Organisations that build privacy into AI projects now will have less to change later.

This article is general information, not legal advice. Please consult a qualified UAE legal adviser about your specific situation.