Laws and data licensing
United Arab Emirates: privacy laws and AI data licensing
Short answer
If your records include people in United Arab Emirates, the main rules are: Federal PDPL plus free-zone laws (DIFC, ADGM).
In short
- Country
- United Arab Emirates
- Main privacy laws
- Federal PDPL plus free-zone laws (DIFC, ADGM).
- Note
- Which law applies depends on where the business sits.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Which law applies depends on where the business sits.
For suppliers#
- SourceX works with businesses based in United Arab Emirates when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Which UAE regime covers your records: federal PDPL, DIFC or ADGM?#
It depends on where the business that holds the records is established and what kind of data it is. Federal Decree-Law No. 45 of 2021 (the PDPL) is the default federal law and came into force on 2 January 2022, but it carves out companies in free zones that have their own data protection legislation, health data governed by its own law, and banking and credit data governed by its own law.
Two financial free zones have full data protection regimes of their own: the Dubai International Financial Centre (DIFC Data Protection Law No. 5 of 2020) and Abu Dhabi Global Market (ADGM Data Protection Regulations 2021). A business registered in either one usually answers to that free zone's Commissioner of Data Protection rather than the federal UAE Data Office.
| Regime | Who it covers | Regulator | Main transfer routes |
|---|---|---|---|
| Federal PDPL (Decree-Law 45/2021) | Onshore businesses processing personal data, inside or outside the UAE | UAE Data Office | Adequate protection (Article 22), or Article 23 cases such as a binding contract or explicit consent |
| DIFC Data Protection Law 2020 | Controllers and processors in the DIFC | DIFC Commissioner of Data Protection | Adequacy decision, appropriate safeguards such as DIFC standard clauses, or listed derogations |
| ADGM Data Protection Regulations 2021 | Controllers and processors in ADGM | ADGM Commissioner of Data Protection | Adequacy decision, appropriate safeguards such as Commissioner-adopted clauses, or listed derogations |
| Sector carve-outs from the PDPL | Health data and banking or credit data with their own legislation | The sector regulator under that law | Set by the sector law; check it before any transfer |
Can records collected for operations be reused for AI work?#
Under the federal PDPL, usually only with consent. The PDPL prohibits processing without the data subject's consent except in listed cases, such as protecting the public interest, data the person made public, or legal claims and judicial procedures, and none of these is written for licensing records to a third party.
Where consent is the basis, the controller must be able to prove it, it must be clear, simple and unambiguous, and it must tell the person they can withdraw it. Withdrawal does not affect processing that took place before it.
The free zones look more like the GDPR. ADGM lists legitimate interests as a lawful basis, which its guidance says should be balanced against data subjects' interests and documented in a legitimate interest assessment. ADGM's guidance treats truly anonymised data as outside its rules, and the DIFC Commissioner warns that proper anonymisation is difficult and the law keeps applying until data is anonymised.
The PDPL separates pseudonymisation, where data can be re-linked with separately kept information, from anonymisation, where the person can no longer be identified. Only the second leaves the person unidentifiable, so pseudonymised records should be handled as personal data. Separately, DIFC Regulation 10 adds notice duties for deployers and operators of AI or other autonomous systems that process personal data in the DIFC.
How can records lawfully leave the UAE under each regime?#
Each regime allows transfers to places with adequate protection and gives fallback routes when protection is not adequate. Under the PDPL, Article 22 covers transfers where an adequate level of protection exists, including countries covered by a data protection agreement the UAE has joined. Article 23 allows other transfers in listed cases, including a contract that binds the recipient, or the data subject's explicit consent where the transfer does not conflict with the UAE's public or security interest.
In the DIFC, the Commissioner can find a jurisdiction adequate (it has, for example, issued an adequacy decision for California's consumer privacy law). Otherwise exporters use appropriate safeguards such as the DIFC standard data protection clauses or binding corporate rules, or a narrow derogation; limited, non-repetitive transfers based on compelling legitimate interests must be reported to the Commissioner.
In ADGM, section 42 allows transfers without an adequacy decision only with appropriate safeguards and enforceable data subject rights and remedies, for example standard clauses adopted by the Commissioner. When EU-origin personal data goes from ADGM to a non-adequate country, ADGM's Addendum must be used with the EU standard contractual clauses.
What should be checked before UAE records are shared?#
A short pre-release check settles most UAE questions before any record moves. Counsel should confirm each answer against the current law, executive regulations and regulator guidance.
SourceX can consider companies in the UAE when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
- Confirm where the holding entity is licensed: onshore (federal PDPL), DIFC, ADGM or another free zone with its own law
- Flag health records and banking or credit records, which follow their own sector legislation
- Record the lawful basis for reuse: documented consent under the PDPL, or the free-zone basis relied on, with a written assessment where legitimate interests is used
- Decide whether the released set is anonymised or only pseudonymised, and treat pseudonymised records as personal data
- Pick the transfer route for the recipient's country and keep the contract, clauses or consent records on file
- In the DIFC, keep the notification to the Commissioner current and renewed each year; in ADGM, keep the annual data protection fee and notification up to date
Sources for this section
- Federal Decree-Law No. 45 of 2021 excludes free-zone companies with their own data protection law and health and banking data under their own legislation, requires provable, clear and withdrawable consent, defines anonymisation and pseudonymisation, and sets cross-border rules in Articles 22 and 23. Source
- The UAE government portal states the PDPL came into force on 2 January 2022, prohibits processing without consent except listed cases, and that the UAE Data Office issues guidelines for implementing it. Source
- The DIFC Commissioner explains transfers out of the DIFC by adequacy, appropriate safeguards such as DIFC standard clauses, or derogations. Source
- DIFC Data Protection Law No. 5 of 2020 sets adequacy (Article 26), appropriate safeguards and derogations (Article 27), including notifying the Commissioner of limited transfers based on compelling legitimate interests. Source
- The DIFC Commissioner's guide says truly anonymising personal data is difficult and the law applies until data is anonymised. Source
- The DIFC Commissioner's FAQs say controllers notify the Commissioner of processing and renew the notification each year. Source
- DIFC Regulation 10 covers personal data processed by autonomous and semi-autonomous systems such as AI, including notice duties for deployers and operators. Source
- ADGM Data Protection Regulations 2021 section 42 permits transfers without an adequacy decision only with appropriate safeguards, enforceable data subject rights and effective remedies, including Commissioner-adopted standard clauses. Source
- The consolidated ADGM Data Protection Regulations 2021 list legitimate interests as a lawful basis (section 5(1)(f)) and require controllers to pay a data protection fee and notify the Commissioner (section 24). Source
- ADGM guidance says truly anonymised data is not subject to the Regulations and recommends documenting a legitimate interest assessment. Source
- ADGM's Office of Data Protection published an Addendum to be used with the EU standard contractual clauses for EU-origin personal data sent from ADGM to non-adequate jurisdictions. Source
Frequently asked questions
Which privacy laws apply to records about people in United Arab Emirates?
Federal PDPL plus free-zone laws (DIFC, ADGM). Which law applies depends on where the business sits.
Can a company based in United Arab Emirates license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in United Arab Emirates?
Records tied to United Arab Emirates are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.