Onshore UAE firms using AI agents must meet the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. It requires a lawful basis, usually consent, honours rights including objection to significant automated decisions, and demands security, impact assessment, breach notification and controlled transfers abroad. Free zones such as the DIFC have their own laws.
What does the PDPL require, in plain words?
The federal Personal Data Protection Law sets the general rules for processing personal data in the UAE. In substance:
- Lawful processing: processing generally needs the person's consent, unless an exception applies, such as performing a contract with them, meeting a legal obligation, or protecting their vital interests.
- Processing principles: data is processed fairly, transparently and lawfully, for specific and clear purposes, limited to what is needed, kept accurate, kept securely, and not retained longer than necessary.
- Rights: people can obtain information about processing, access and correct their data, request erasure or restriction in certain cases, and object to processing, including to decisions based on automated processing that have legal consequences for them or seriously affect them.
- Controller duties: appropriate security measures, records of processing, an impact assessment where processing uses new technologies or is likely to pose a high risk to privacy, a data protection officer in specified cases, and notification of breaches that affect privacy.
- Cross-border transfers: permitted to countries with adequate protection, and otherwise only in defined circumstances.
Implementing regulations and guidance fill in detail; check their current status for your processing.
Who does it apply to?
Controllers and processors handling personal data of people in the UAE, and those established in the UAE processing data of people elsewhere. It does not apply in free zones with their own data protection laws, such as the DIFC and ADGM, and it carves out certain categories already governed by their own legislation, which can include some health and banking data. For DIFC-based firms, see the DIFC Data Protection Law and AI agents. Banks also answer to the Central Bank of the UAE; our overview of which UAE rules apply to AI agents in financial services shows the full picture.
What does the PDPL mean when an agent processes the data?
Consent must cover what the agent does. Where a firm relies on consent, it must be specific and clear. A customer who consented to account servicing has not necessarily consented to an agent analysing their messages to profile them. Tie each agent capability to its basis.
Automated decisions can be objected to. An agent that declines an application, cancels a service or flags a customer as high-risk on its own is making the kind of decision people can object to. The firm needs a route for that objection to reach a person who can reconsider.
Agents are likely to be high-risk processing. An agent built on a language model is a new technology processing personal data at scale, often making or shaping decisions. That points to an impact assessment before deployment. Our answer on whether AI agents need a data protection impact assessment sets out the reasoning in general terms.
The model provider is a processor, often abroad. Prompts containing personal data go to a model provider. The firm needs a contract that binds the provider to process only on instructions and keep data secure, and, where the provider processes outside the UAE, a valid basis for the transfer.
Accuracy and retention reach agent records. Agents should change records only on reliable sources, and conversation histories and logs need retention limits.
Take an illustrative case. A Dubai-based consumer finance company onshore deploys an agent in its app to answer questions and pre-screen applications. Its PDPL review records consent for pre-screening within the application flow, runs an impact assessment, and builds a route for applicants to object to an automated pre-screening outcome and have a credit officer review it. The model provider contract covers processing on instructions and security, and the transfer to the provider's data centre abroad is assessed against the law's transfer conditions.
How do you meet the PDPL for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful basis | Consent or exception recorded per agent capability | Basis register; consent records |
| Purpose limitation | Agent blocked from uses outside its capability's purpose | Capability configuration |
| Data minimisation | Retrieval scoped to the fields the task needs | Data map |
| Right to object to automated decisions | Route to a person who can reconsider | Objection log and outcomes |
| Information and access | Records of data used per agent decision | Per-decision records |
| Impact assessment | Assessment before deploying agents that pose high privacy risk | Signed assessment |
| Security | Least-privilege access; protected logs; output checks | Security configuration; tests |
| Processor contracts | Model provider and platform bound to instructions and security | Contracts |
| Cross-border transfers | Basis assessed for each transfer abroad | Transfer assessments |
| Breach notification | Agent incidents included in breach response | Breach register |
What will a regulator or auditor ask?
- On what basis does each agent process personal data?
- Which agent decisions can people object to, and how?
- Did you assess the agent's privacy impact before deployment?
- Where does the model provider process data, and on what transfer basis?
- How quickly would you learn of a breach at the model provider?
What does the PDPL not cover?
It does not regulate AI design or set sector conduct rules; for banks and insurers, the Central Bank of the UAE's requirements apply too. It does not govern free zone entities under their own laws, or data categories carved out to sector legislation. For the full regulatory map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does the PDPL apply to a DIFC-based firm's agents?
Generally not for its DIFC operations, which fall under the DIFC Data Protection Law. A group with both onshore and DIFC entities may need to apply both, depending on which entity processes the data.
Is consent always required for agent processing under the PDPL?
No. The law allows processing without consent in defined cases, such as performing a contract with the person or meeting a legal obligation. Many service tasks an agent performs can rest on these; profiling and marketing usually cannot.
Can a UAE firm use a model provider outside the country?
The law permits transfers to countries with adequate protection, and in other defined circumstances. Assess each provider's location and the applicable condition before sending personal data.