UAE Personal Data Protection Law and automated processing

What it is

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, known as the PDPL, is the UAE’s federal data protection law. It took effect on 2 January 2022. It sits alongside the separate data protection regimes of the Dubai International Financial Centre and Abu Dhabi Global Market, which govern companies in those free zones.

The PDPL does not mention artificial intelligence. It reaches AI because AI systems process personal data, and because it contains a rule aimed at decisions made by automated processing. That rule, in Article 18, is the closest thing in onshore UAE law to a binding AI rule for private organisations.

Many operational details, such as the timing of breach notification and the penalties for breaches of the law, are left to executive regulations and Cabinet decisions. Check the UAE legislation portal for the current position before relying on any detail that depends on them.

Who it applies to

The PDPL applies to processing of personal data, in whole or in part through electronic systems, of data subjects in the UAE. It covers controllers and processors established in the UAE, and those outside the UAE that process the personal data of people in the UAE.

Article 2 excludes several kinds of data and processing. Government data and government entities that control or process personal data fall outside it, as do security and judicial authorities and personal data processed for personal purposes. Health data and banking and credit data that have their own legislation are excluded. Companies in free zones with their own data protection law, notably the DIFC and ADGM, follow those laws instead.

An organisation that uses a vendor’s AI system to screen applicants, score customers or flag fraud is still the controller for those decisions. The vendor is usually a processor acting on its behalf.

What it requires

Article 18, automated decisions. A data subject may object to decisions based on automated processing, including profiling, that have legal consequences for them or seriously affect them. Commentary on the law describes a right to ask the controller to bring in human review of the decision. Exceptions apply where the processing is required under a contract with the data subject, is required by other UAE legislation, or is based on the data subject’s prior consent.

For an AI system, that turns into three practical questions. Which systems make or materially shape decisions about people with legal or serious consequences? Is a person genuinely involved before those decisions take effect? And can the organisation receive an objection, route it to someone able to review the decision, and record the outcome?

Article 21, impact assessment. The controller must assess the impact of processing on the protection of personal data before it starts processing that is likely to pose a high risk to privacy and confidentiality, including through modern technologies. Automated processing that evaluates people, and large-scale processing of sensitive data, are the cases most AI systems fall into.

Article 10, data protection officer. A data protection officer is required in some cases, including where processing involves systematic profiling or automated processing that presents significant risks.

Article 9, breach notification. A controller must notify the UAE Data Office of a breach that may affect the privacy, confidentiality or security of personal data, and inform the data subjects concerned. The timing is left to the executive regulations.

Articles 22 and 23, transfers. Personal data can leave the UAE to countries with adequate data protection legislation or under bilateral or multilateral agreements, and in a set of listed cases, including with the data subject’s express consent and where the transfer is needed to perform a contract.

Key dates

• 20 September 2021. Date of Federal Decree-Law No. 45 of 2021. It was published in the Official Gazette later that month.
• 2 January 2022. The law takes effect.
• 14 June 2026. The UAE announces a federal Artificial Intelligence and Data Authority reporting to the Cabinet. It brings together the UAE Data Office, the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, and the digital government sector of the Telecommunications and Digital Government Regulatory Authority.

How it relates to other frameworks

Article 18 resembles GDPR Article 22 in what it targets, decisions based on automated processing with legal or similarly serious effects. It is framed as a right to object and to obtain human involvement, rather than a general prohibition. Its impact assessment duty works like a GDPR data protection impact assessment, and an AI impact assessment that covers the people affected, the purpose of processing and the risks to them usually supplies most of what it needs.

Inside the DIFC, Regulation 10 sets more detailed rules for personal data processed by autonomous and semi-autonomous systems. Across the country, the UAE AI Charter sets non-binding national principles. Organisations without a local AI standard to follow often structure their work on ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of the PDPL and published commentary on it. It is not legal advice and it is not the law itself. Read the official text on the UAE legislation portal, check the status of the executive regulations, and take advice on how the law applies to your organisation.