Is it safe to put customer data into AI tools? A UAE business guide to the PDPL
What the UAE law says, briefly
The UAE's federal Personal Data Protection Law is Federal Decree Law No. 45 of 2021. According to the UAE government portal, it came into force on 2 January 2022 and covers processing of personal data done wholly or partly by electronic means, inside and outside the UAE. The portal highlights that:
- Processing personal data without the owner's consent is prohibited, with limited exceptions.
- Companies holding personal data must keep it secure and confidential.
- Transfers of personal data outside the UAE have specific requirements.
- People have rights, including to correct their data and to restrict or stop its processing.
The portal names the UAE Data Office as the federal data regulator.
What is still unclear
Legal guides published in 2026 describe the PDPL as still a work in progress. They report that the implementing regulations, which would settle many practical details, had not been issued, and that the regulator was not yet fully operational. Practical details such as the exact rules for transfers abroad and breach notification timelines were reported as uncertain. Check the current position, because this can change quickly.
Free zones are separate. The DIFC has its own Data Protection Law, DIFC Law No. 5 of 2020, and the ADGM has its own Data Protection Regulations 2021. If your company is licensed there, those rules apply to you instead.
The sensible response to uncertainty is to follow good practice now rather than wait.
Seven practical rules for AI tools
- Minimise. Many tasks work without names, phone numbers or ID details. Remove what the task does not need.
- Use business accounts. Do not paste customer data into a personal or consumer AI account. Use plans with written business data terms.
- Know where data goes. Find out where the tool processes and stores data, since transfers abroad have requirements.
- Have a lawful basis. Usually consent, or another basis your lawyer confirms, and say in your privacy notice that you use automated tools.
- Control access. Only the people who need the data should see it, in the tool and in the outputs.
- Set retention. Delete what you no longer need, in the AI tool as well as your CRM.
- Keep a person accountable. Someone owns each automation and checks its outputs.
Six questions to ask any AI vendor
| Question | Why it matters |
|---|---|
| Where is our data processed and stored? | Transfers outside the UAE have requirements |
| Is our data used to train your models, and can we turn that off? | Customer data should not leave your control by default |
| Who at your company can access our data? | Fewer people means less risk |
| How long do you keep it, and can we delete it? | Retention you cannot control is a liability |
| What happens if there is a breach? | You need to know how and when you will be told |
| Is there a written agreement covering our customers' data? | Without one, your obligations rest on trust |
A safer setup for automation
The safest pattern is for the business to own the accounts its automation runs on, with business data terms, rather than routing customer data through a supplier's personal account. Test new automations with sample data before real customer data, document what data flows where, and give access only to the people who run it.
Marketing messages are a separate question
Consent for processing data is not the same as permission to market. The UAE introduced telemarketing rules in Cabinet Resolutions No. 56 and 57 of 2024, as reported in published summaries, covering promotional calls and reportedly some other promotional messages. WhatsApp also requires opt in permission under its own policy. If you plan promotional messages, take legal advice first. For WhatsApp specifics, see WhatsApp automation for real estate in Dubai.
Questions people ask
Does the PDPL apply to my business?
If you process personal data of people in the UAE and you are not covered by a free zone regime such as the DIFC or ADGM, it likely applies. Some government and specific sectors have exclusions. Confirm your position with a lawyer.
Can I paste customer details into ChatGPT, Claude or similar tools?
Avoid doing it in personal or consumer accounts. Use business plans with written data terms, share only what the task needs and check whether data is used for training and where it is stored.
Do I need consent to use AI on customer data?
The PDPL is built around consent, with limited exceptions and other lawful bases. Tell customers in your privacy notice that you use automated tools, and confirm the right basis with your lawyer.
Are DIFC and ADGM companies covered by the PDPL?
Published guides report that companies in the DIFC and ADGM follow their own data protection laws instead of the federal PDPL. Data moving between a free zone and the mainland can count as a transfer.
This guide is general information, not legal advice. Data protection rules in the UAE are developing. Take advice from a qualified lawyer for your situation.
Sources and further reading
- UAE government portal: data protection laws (official summary of Federal Decree Law No. 45 of 2021).
- Chambers Data Protection and Privacy 2026: UAE (law firm guide on enforcement status, free zones and obligations).
- Middle East Briefing: UAE telemarketing rules (secondary summary of Cabinet Resolutions No. 56 and 57 of 2024).