Most people who read Obiter Dictum are not in the Gulf, and have no immediate plans to be, which files the UAE's data laws somewhere between "mildly interesting" and "someone else's problem". They are worth a few minutes even so. The region is investing heavily in artificial intelligence, and the UAE has arranged its data laws in a way that catches people out.
The first thing to know is that there is no single UAE data protection law. There are three, and which one governs you depends entirely on where in the country your business sits. Two of them cover almost no ground at all: single financial districts, each with its own courts and its own rulebook, each binding only the companies registered inside it. Small on the map, and larger than their size in practice. Here is who each one catches.
Nationwide
The UAE
Where it appliesAcross the country generally, plus companies abroad handling the personal data of people in the UAE.
The lawFederal Decree-Law No. 45 of 2021 (the "PDPL").
RegulatorThe UAE Data Office, consolidated in 2026 into the federal Artificial Intelligence and Data Authority.
In a lineGDPR-style and consent-based; its detailed rulebook is not yet published, so parts are not fully operational. No dedicated AI rules yet.
Read more →
Free zone · Dubai
DIFC
Where it appliesOnly to companies registered inside the DIFC, a single financial district in Dubai with its own courts and laws. Small in area, it concentrates much of the region's financial business.
The lawDIFC Data Protection Law No. 5 of 2020, plus "Regulation 10" on AI.
RegulatorThe DIFC Commissioner of Data Protection.
In a lineA mature, GDPR-style regime, and the one with a dedicated AI rulebook, including a named Autonomous Systems Officer. Further changes proposed in 2026.
Read more →
Free zone · Abu Dhabi
ADGM
Where it appliesOnly to companies registered inside the ADGM, a financial free zone on Al Maryah Island, Abu Dhabi. Small in area, it hosts a large share of Abu Dhabi's international financial activity.
The lawADGM Data Protection Regulations 2021.
RegulatorThe ADGM Office of Data Protection.
In a lineClosely modelled on the EU GDPR (it points users to UK guidance), so it feels familiar to anyone who knows European rules. No dedicated AI regime.
Read more →
Two things worth knowing
You can be caught by more than one. A company with a UAE trading business and a separate DIFC-registered finance entity is dealing with two rulebooks at once. And "the Gulf" is not one rulebook: Saudi Arabia (through its Data & AI Authority, SDAIA), Qatar, Bahrain and others each have their own national laws. This page covers the UAE.
