My company works in the UAE. What does the law ask of us when an AI agent reads our data?
The short answer
The federal Personal Data Protection Law, Decree-Law 45 of 2021, has been in force since 2 January 2022. Consent is the default basis, people may object to decisions made only by automated processing that seriously affect them and ask for a human to review them, and transfers abroad are allowed only on the grounds the law sets. Many of its details wait for executive regulations, which I found no official publication of as of October 2026. Free zones such as DIFC and ADGM have their own laws.
The law that applies
Federal Decree-Law 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022. It covers people living or doing business in the UAE, companies in the UAE wherever they process data, and companies outside the UAE that process the data of people in the UAE. A foreign model provider is within its reach.
The law does not cover everything. It excludes government data, health data and banking data that have their own laws, and companies in free zones that have their own data protection laws. Dubai International Financial Centre, DIFC, and Abu Dhabi Global Market, ADGM, are the best-known examples. If your company sits in one of them, its own law is the one to read.
Who enforces it
The law named the UAE Data Office as the regulator. On 14 June 2026 the Cabinet announced a new federal Artificial Intelligence and Data Authority, which brings together the AI Office, the UAE Data Office and the digital government sector of the telecoms regulator. I have not found an official text that says how the new authority will enforce this law.
Many of the law’s details are left to executive regulations: the deadline for reporting a breach, the controls on transfers abroad, and the start of a 6-month window for companies to comply. I found no official publication of these regulations as of October 2026. The law is in force, but parts of it cannot yet be applied in full.
Can the agent read personal data at all?
The default rule is that personal data may not be processed without the person’s consent, and you must be able to prove that consent. The law lists exceptions, among them performing a contract with the person, obligations under employment law, and meeting another legal obligation.
Sensitive data includes health, biometric and genetic data, religious beliefs, political opinions, ethnic origin and criminal records.
Decisions made by machine
This is the article that speaks most directly to AI agents. A person may object to a decision based only on automated processing, including profiling, meaning assessing a person automatically from their data, where the decision has legal consequences for them or seriously affects them. The company must then let a human review the decision. The right does not apply where the person agreed to it in a contract or gave prior consent, or where another law requires the processing.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider acts as your processor and must process the data on your instructions. You must protect the data with suitable security measures, which the law says may include encryption and replacing names with codes. For processing that carries high risk, for example processing that uses new technologies, you must assess its impact first, and you may need a data protection officer.
The law allows transfers abroad in two ways. The first is to a country that has a data protection law and an authority to enforce it. The second, where the destination has no such protection, is on one of a set of grounds, such as a contract that binds the recipient to the standards of UAE law, or the person’s explicit consent.
Sector rules
Two sector rules are stricter than the general law:
- Health data. Federal Law 2 of 2019 on the use of ICT in health fields says health data may not be stored, processed or transferred outside the UAE, unless the health authorities allow it. It applies in free zones too.
- Banks. The Central Bank’s outsourcing regulation for banks keeps the master record of confidential data inside the UAE, and allows confidential data to be shared abroad only with the Central Bank’s approval and the client’s prior written consent.
What the UAE says about AI itself
The UAE adopted its National Strategy for AI 2031 in 2019, and issued the UAE Charter for the Development and Use of AI in June 2024. The charter sets out 12 priorities, among them data privacy, human oversight and transparency. Both are guidance. I found no federal AI law as of October 2026.
What this means for you
- First find out which law applies to you: the federal law, a free zone’s law, or a sector law.
- Record the legal basis for each kind of data the agent reads, and be able to prove consent where you rely on it.
- If the agent decides anything about a person, build in a way for a human to review the decision on request.
- Check the sector rule before you send health data or banks’ confidential data to a provider abroad.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- UAE Legislation, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- UAE Government portal, Data protection laws
- UAE Cabinet, Mohammed bin Rashid approves establishing the Artificial Intelligence and Data Authority, June 2026
- UAE Ministry of Justice, Federal Law No. 2 of 2019 on the Use of ICT in Health Fields
- Central Bank of the UAE, Outsourcing Regulation for Banks, Article 6
- UAE Cabinet, UAE Cabinet adopts National Artificial Intelligence Strategy 2031
- UAE Legislation, The UAE Charter for the Development and Use of Artificial Intelligence
- ADGM, Data Protection Regulations 2021 Update, August 2021