UAE Data Protection & AI
The UAE, nationwide: the PDPL
What it is
The UAE's national data protection law, built on principles familiar from Europe's GDPR.
Does it apply to me?
Yes, if you operate a business in the UAE outside the financial free zones. It also reaches companies abroad that handle the personal data of people inside the UAE.
What it asks of you
A lawful reason to use personal data, usually consent, with a limited set of exceptions; clear privacy notices; letting people access, correct and delete their data; keeping data secure; reporting serious breaches; and care when sending data abroad.
The catch
The law is in force, but the executive regulations that set the operational detail, such as exact breach deadlines, when a data protection officer is required, and fine levels, are not yet published. The shape is clear; some of the specifics are still pending.
Where to start
Know what personal data you hold and why, make sure your privacy notices are honest, and have a plan for the day someone asks for their data or a breach happens.