UAE PDPL and AI: A Compliance Checklist for AI Projects (2026)

To use AI with personal data in the UAE, you need a lawful basis for each use, the minimum data needed, sensitive numbers masked before they reach an outside AI model, a check on where the data goes, and a record of what the AI did. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL) has applied since 2 January 2022, and it covers AI processing the same way it covers any other processing (UAE Government portal).

This checklist is written by an AI implementation company, not a law firm. Use it to prepare your project, then confirm your position with a UAE data protection lawyer.

Which data protection law applies to you?

Start here, because the answer changes the rules:

Where you operate	Main law
Mainland UAE and most free zones	PDPL, Federal Decree-Law No. 45 of 2021
Dubai International Financial Centre (DIFC)	DIFC Data Protection Law, DIFC Law No. 5 of 2020
Abu Dhabi Global Market (ADGM)	ADGM Data Protection Regulations
Health data anywhere in the UAE	Federal Law No. 2 of 2019 on ICT in health fields, in addition

The UAE Data Office, set up under Federal Decree-Law No. 44 of 2021, is the federal data regulator (UAE Government portal). Under Article 29 of the PDPL, organisations get up to six months from the issue of the Executive Regulation to bring their processing into line, a period the Cabinet can extend (summary of the articles). Check the UAE Legislation portal for the current status, and do not wait for it to design your AI system well.

What should the checklist cover before you start?

Work through these ten points for every AI use case:

1. Purpose. Write one sentence on what the AI does with personal data and why. "Qualify new property leads on WhatsApp" is a purpose. "Improve customer experience" is not.
2. Lawful basis. Consent is the main basis under the PDPL, with exceptions such as performing a contract or complying with UAE law. Lead follow-up on an enquiry the customer started is easier to justify than cold outreach.
3. Minimisation. Send the AI only the fields it needs. A support agent that checks order status does not need the customer's date of birth.
4. Masking. Replace card numbers, IBANs, Emirates ID and passport numbers with tokens before any request reaches an outside model. We do this automatically in every system we build.
5. Vendor terms. Check whether your AI provider uses business data for training (most business plans do not), how long it keeps prompts, and where it processes them.
6. Cross-border transfers. The PDPL allows transfers to countries with adequate protection, with appropriate safeguards, or under specific exceptions. Document which one you rely on.
7. Transparency. Tell people when they are talking to an AI agent and how to reach a person.
8. Data subject rights. Make sure you can find, correct and delete a person's data across the AI system, the CRM and the logs.
9. Security and logs. Role-based access, single sign-on where possible, and a log of every AI run: who, when, what data, what action.
10. Breach response. Know who notifies the UAE Data Office and affected people if something goes wrong, and test it once.

What does this look like for a real AI agent?

Take a common case: an AI agent that replies to new property enquiries on WhatsApp and qualifies them before a broker calls.

• Purpose: respond to enquiries the customer started and collect budget, area and timing.
• Lawful basis: the customer asked for information; the agent tells them it is an AI assistant and how to reach a broker.
• Minimisation: the agent collects only name, phone, budget range, preferred areas and timing. It never asks for Emirates ID or passport numbers on WhatsApp.
• Masking: if a customer sends an ID number anyway, it is replaced with a token before the message reaches the AI model.
• Vendor terms: the AI model is used through a business plan that does not train on your data.
• Records: every conversation, qualification score and hand-over is logged in the CRM with a timestamp.
• Rights: a customer who asks to be forgotten is deleted from the CRM, the agent's memory and the logs within the period your policy sets.

The same pattern works for clinics, schools and retailers: write down what the agent collects, why, where it goes and who can see it.

Who should own AI compliance in your company?

In small companies, the owner or general manager signs off each AI use case and keeps the checklist on file. In larger companies, three people share it: the business owner of the process, the person responsible for data protection, and IT or security for the technical controls. Whoever it is, the key is that each AI agent has one named person who answers for it.

What extra rules apply to health data?

Clinics, pharmacies, insurers and health tech firms face stricter rules. Federal Law No. 2 of 2019 requires health data to be stored and processed inside the UAE, subject to exceptions set by ministerial decision, and records to be kept for at least 25 years (IBA). The Dubai Health Authority issued its AI policy in 2021 and Abu Dhabi's Department of Health issued its first AI policy in 2018, followed by a Responsible AI Standard in 2025 (same source). If an AI agent books appointments or answers patients, keep clinical content out of outside models unless your hosting meets these rules. See AI for clinics in the UAE.

How do you show compliance, not just claim it?

Regulators, auditors and enterprise buyers increasingly ask to see evidence. Build it into the system:

• Approval gates for anything sent outside the company, so a person is accountable for each outbound message.
• Run logs with time, tools used, data touched and cost for every task.
• Owners and budgets per agent, with a pause switch.
• A data map that lists every system the AI reads from or writes to.

These are the same controls we describe on the enterprise page and use in government projects.

What about using AI to draft legal or court documents?

In the DIFC, the courts published guidance in December 2023 asking parties to disclose AI-generated content early, check it against independent sources and protect client confidentiality (DIFC Courts PGN 2/2023). Law firms should treat that as the minimum standard. See AI for law firms.

What is the next step?

Pick one AI use case and run the ten-point checklist on it with your team. If you want help, our 5-day AI Audit includes a data and PDPL readiness check, and book a demo to see masking, approvals and logs working on a real scenario.