The UAE has a general personal data protection law — Federal Decree-Law No. 45 of 2021 — and most of the AI projects I see were scoped as though it did not exist. Not out of contempt for it. It simply was not in the room when the process was chosen.
That is an expensive place to discover a constraint. Data handling is an architectural decision: it determines which model you can use, where it runs, what you can log, and whether the thing can go live at all. Retrofitting it means rebuilding.
What follows is not legal advice, and I am not a lawyer. It is the set of questions I put to a client before anything gets connected, because the answers change the design. It sits alongside the four reasons most UAE AI pilots never reach production.
1. Does personal data touch the model at all?
Start here, because a surprising number of useful projects can be arranged so the answer is no. Summarising internal policy documents, drafting from templates, classifying tickets by topic rather than by customer — none of these need a name attached.
Where the answer is yes, ask whether it needs to be. Pseudonymising before the call, and re-attaching identity afterwards inside your own systems, removes most of the exposure at very little cost in quality.
2. Where does the processing physically happen?
Sending data to a hosted model is a transfer. Depending on your sector and your contracts, that may be entirely fine, may require specific terms, or may be unacceptable. Regulated sectors and government-adjacent work tend to have the tightest expectations, and those expectations are increasingly about where the data physically sits.
Practically, this splits your options into three: a public API, a private deployment in a region you have chosen, or a model you run yourself. They differ enormously in cost and capability. Choosing between them after the pilot is built is the expensive path.
3. What is the provider doing with it?
Read the actual terms of the tier you are on, not the marketing page. Consumer and business tiers of the same product often differ on training use, retention period and human review. A team that signed up with a corporate card is usually on the wrong one.
4. What are you keeping, and for how long?
Logs are where good intentions go to die. Prompt and response logs are genuinely useful for debugging and quality, and they are also a store of personal data nobody assessed, usually with no retention period and broader access than anyone intended.
Decide what is logged, who can read it, and when it is deleted — before the first log line is written.
5. Can you explain it to the person it is about?
If a customer asks why a decision was made, or asks you to delete their data, can you answer? “It is in the model” is not an answer. In practice this means keeping the reasoning trail in your own systems rather than assuming you can reconstruct it later.
The awkward part
The executive regulations that put detail behind the law have taken time to land, and I have watched several organisations treat that delay as permission to postpone thinking about it. That is a mistake with a specific shape: the design decisions above are the ones that are expensive to reverse, and they are needed at the start regardless of what the regulations eventually say. Getting them right is not compliance theatre — it is the difference between a system you can extend and one you have to rebuild.
What this looks like in practice
One page, agreed before build: what data is involved, whether it needs to be, where it is processed, what the provider may do with it, what is logged and for how long, and who can answer a subject’s question. It takes an afternoon, and it is the first document I produce on any AI engagement. It has saved every project I have used it on from at least one late and unpleasant surprise.
The law itself is published at uaelegislation.gov.ae, and the UAE government portal keeps a plain-language summary of the data protection laws. Verify the current position with counsel before you rely on any of this. Regulations move, and this is a summary of how I scope work rather than a statement of law.