The UAE PDPL deadline is 1 January 2027. What it means if you use AI

If your staff paste customer data into AI tools, that is processing under the federal data protection law. Here is what to have in place before the grace period ends.

The UAE's federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) has been on the books for a while. For most onshore businesses, the practical deadline to be fully compliant is 1 January 2027. After that, "we were getting round to it" stops being a defence.

Most PDPL checklists focus on websites, marketing lists and HR files. Very few mention the place where a lot of personal data now goes every day: AI tools.

Why AI use is a PDPL question

When someone on your team pastes a customer email, a CV or a patient note into a chatbot, three things happen at once. Personal data is being processed. It is being shared with a third party. And depending on the tool, it may be stored outside the UAE and used to improve someone else's model.

Each of those has a PDPL consequence. You need a lawful basis for the processing, an agreement with the processor, and a view on cross-border transfer.

The five things to have in place

An inventory. Which AI tools are in use, by whom, touching which categories of data. You cannot govern what you cannot list.
A short usage policy. What staff can and cannot paste, into which approved tools. Ten pages at most, with a one-page version people will actually read.
Approved tools, configured properly. Business tiers with training on your inputs switched off, retention set, and access tied to company accounts rather than personal ones.
Processor terms. A data processing agreement with each AI vendor, and a documented view on where the data is stored.
A record you can show. If a client or regulator asks how you govern AI, a same-day answer backed by documents.

What about DIFC and ADGM?

If you are registered in a free zone with its own regime, different rules apply. DIFC's Data Protection Law and its Regulation 10 on autonomous and semi-autonomous systems are already enforced. ADGM has its own data protection regulations. We cover the differences in which UAE AI rules apply to you.

A realistic timeline

For a business of 20 to 500 people, getting from nothing to a defensible position takes three to four weeks of focused work, not a year-long programme. The longest part is usually discovering what is already in use.