Onshore, DIFC or ADGM: which AI rules actually apply to you
Where your company is registered decides which data protection regime you answer to. Here is a plain-language map.
The UAE does not have one data protection law. It has a federal law for onshore businesses and separate regimes in the two financial free zones. Sector regulators can add requirements on top.
| Registered in | Main regime | AI-specific points |
|---|---|---|
| Onshore UAE | Federal PDPL (Decree-Law 45/2021) | AI tools that process personal data are processors. Full compliance expected by 1 Jan 2027. |
| DIFC | DIFC Data Protection Law 2020 | Regulation 10 covers autonomous and semi-autonomous systems, already enforced. |
| ADGM | ADGM Data Protection Regulations 2021 | Close to GDPR. Transparency and automated decision rules apply. |
Sector rules on top
Healthcare providers answer to the health authorities (DHA in Dubai, DoH in Abu Dhabi). Financial institutions answer to the Central Bank. Critical infrastructure and government suppliers face national cybersecurity requirements. If you are in one of these sectors, the sector rules are usually stricter than the general law.
What this means in practice
The controls are similar whichever regime applies: know which tools are used, restrict what goes into them, choose vendors with proper terms, keep records. The difference is mostly in documentation, notification and how you justify transfers outside the UAE.
If you host models and data in-country, for example on UAE-based GPUs, the cross-border question gets much simpler.
General information only, not legal advice.
