What is the UAE PDPL?
The UAE Personal Data Protection Law - Federal Decree-Law No. 45 of 2021 - came into force in January 2022. It establishes the legal framework governing the collection, processing, and transfer of personal data in the UAE, modelled in part on the EU's GDPR but with provisions specific to the UAE's federal and emirate-level governance structure.
For AI deployments, the PDPL has three particularly significant implications: consent requirements, data residency, and the right to explanation when automated decisions are made.
Data residency requirements
The PDPL does not impose an absolute prohibition on cross-border data transfers, but it establishes conditions. Data may only be transferred to countries with "an adequate level of protection" or with appropriate safeguards in place - including contractual clauses equivalent to the PDPL's requirements.
For AI deployments, this means:
- Customer conversation data cannot be processed on servers outside UAE without a legal basis - either adequacy, contractual safeguards, or explicit consent from each individual customer
- US-based AI platforms do not automatically qualify - the US has no adequacy finding under UAE law, and processing customer data on AWS US East without specific safeguards is a compliance exposure
- UAE-hosted deployments on OVHcloud UAE, du, or Etisalat infrastructure satisfy residency requirements without additional legal instruments
- EU adequacy does not extend to UAE requirements - a platform that is GDPR-compliant is not automatically PDPL-compliant
Consent and transparency requirements
The PDPL requires that individuals are informed when their data is being collected and how it will be used. For AI deployments, this has three practical requirements:
- Disclosure that the conversation is AI-handled. Customers should be informed they are interacting with an automated system, not a human. This is good practice and increasingly a legal requirement.
- Accessible privacy information. A privacy notice explaining what data is collected, how it is processed, and how long it is retained must be accessible from the conversation interface.
- Right to human escalation. Where automated decisions materially affect individuals, they must have the option to request human review. Eshal's escalation architecture satisfies this requirement.
Automated decisions - the key compliance question
The PDPL includes provisions on automated decision-making - decisions made solely by automated means that significantly affect individuals. Credit scoring, identity verification, and insurance decisions are the clearest examples.
For customer service AI, the compliance question is: does the AI make decisions, or does it execute workflows that humans have pre-configured?
Vendor evaluation checklist
When evaluating AI vendors for UAE deployment, these are the questions to ask:
- Where are servers located? Only UAE-based infrastructure (OVHcloud UAE, du, Etisalat) guarantees data residency without additional legal instruments.
- Is a Data Processing Agreement (DPA) available covering UAE PDPL? This is a legal requirement when engaging a data processor.
- Is customer data used to train models? Any use of your customers' data to train the vendor's models requires explicit consent - most enterprise contracts prohibit this.
- What is the data retention period and deletion policy? PDPL requires data to be deleted when no longer necessary for its original purpose.
- Is there an immutable audit log? Regulators can request evidence of data processing activities. An audit log that cannot be altered is essential.
- Has the platform undergone a third-party security assessment? Request the penetration test report and ISO 27001 certificate.