GCC / Middle East (GCC) / revised 28 Oct 2026

UAE PDPL and AI Data Residency: Mainland, DIFC and ADGM

The UAE has three overlapping privacy regimes: the federal PDPL for the mainland and most free zones, and separate laws in the DIFC and ADGM financial free zones. None imposes blanket localisation for ordinary personal data, but transfers need an adequacy basis or a recognised exception, and health data is subject to a separate in-country storage rule.

Test a sovereign route Talk to a sovereign architect

Citation: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 22 and 23; DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021
Regulator: UAE Data Office (mainland); DIFC Commissioner of Data Protection; ADGM Office of Data Protection
In force: 2 January 2022 (PDPL)
Maximum penalty: Administrative penalties under the PDPL are set by Cabinet decision (Art. 26); DIFC and ADGM impose their own fines under their respective laws

Statutory text

Which law applies

Federal Decree-Law No. 45 of 2021 (the PDPL) applies to processing of personal data inside the UAE and to controllers and processors abroad that process data of individuals in the UAE. Article 2 excludes, among others, government data, health personal data that has its own legislation, banking and credit data governed by its own legislation, and processing inside free zones that have their own data protection laws. In practice that carves out the DIFC (Data Protection Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021), each with its own regulator and transfer rules.

The PDPL leaves much of the operational detail, including transfer procedures and the penalty schedule, to Executive Regulations and Cabinet decisions. Check the current status of those instruments with the UAE Data Office before finalising a transfer analysis.

Cross-border transfers: Articles 22 and 23

Article 22 permits transfer to a country whose legislation covers personal data protection with an adequate level of protection, or with which the UAE has a bilateral or multilateral agreement on data protection. Article 23 sets out the alternatives where no adequate law exists, including a contract that obliges the recipient to apply the PDPL's standards, the data subject's express consent where it does not conflict with UAE public or security interests, and transfers necessary to perform a contract or for international judicial cooperation.

Health data and free-zone rules

Federal Law No. 2 of 2019 on the use of ICT in health fields requires health data and information relating to health services provided in the UAE to be stored and processed inside the country, except in cases set by decision of the health authority in coordination with the Ministry. For AI inference on clinical text this is the binding residency rule, not the PDPL.

Inside the DIFC, Articles 26 and 27 of the Data Protection Law govern transfers on the basis of adequate jurisdictions or appropriate safeguards, and the 2023 amendments to the DIFC Data Protection Regulations added specific requirements for personal data processed through autonomous and semi-autonomous systems, including AI.

Technical requirements for the inference path

01
Classify by regime before routing
A single UAE tenant may hold mainland retail data, DIFC client data and health records. Tag each request with its governing regime at the application layer; the router cannot infer it from IP address alone.
02
In-country inference for health workloads
Health prompts need an inference endpoint physically in the UAE. Use a provider's UAE region or a self-hosted runtime in a UAE data centre, and keep the pseudonymisation vault on the same side of the border.
03
Contractual transfer basis for non-UAE models
Where mainland personal data goes to a model outside the UAE, keep the Article 23 contract on file and map the provider's processing locations, including abuse-monitoring storage.
04
Masking of Emirates ID numbers
The 15-digit Emirates ID number begins with 784, which makes deterministic detection reliable. Mask it in-path before any cross-border hop.
05
Autonomous system notices in the DIFC
DIFC entities deploying AI on personal data should record the system's purpose, the principles applied and the human oversight in place, and be ready to explain them to data subjects.

Prescribed YTT Secunet routing rules

#	Rule	Legal rationale
01	Requests tagged as UAE health data resolve only to UAE-located endpoints, with no failover outside the country.	Federal Law No. 2 of 2019 makes in-country storage and processing the default for health information.
02	Mainland personal data may leave the UAE only when the tenant has recorded an Article 22 or 23 basis for the destination.	The PDPL permits transfer, but only on a documented legal basis, and the router should not invent one.
03	DIFC- and ADGM-tagged traffic evaluates against the free-zone policy, not the federal one.	The PDPL does not apply inside free zones that have their own data protection law; mixing rule sets yields the wrong answer in both directions.
04	Emirates ID numbers and passport numbers are tokenised before any non-UAE route.	Minimisation reduces what is transferred and keeps re-identification keys in the country.

Policy pack excerpt

uae-pdpl-local

The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.

Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.

How the policy engine works

regouae-pdpl-local.rego

package yttsecunet.policies.uae_pdpl_local

import rego.v1

default allow := false

uae_regions := {"me-central-1", "uaenorth", "uae-dxb-onprem"}

allow if {
	input.request.data_class == "health_uae"
	input.route.provider_region in uae_regions
}

allow if {
	input.request.regime == "uae_federal"
	input.request.data_class != "health_uae"
	input.route.provider_region in uae_regions
}

allow if {
	input.request.regime == "uae_federal"
	input.request.data_class != "health_uae"
	input.route.destination_country in data.tenant.recorded_transfer_bases
	input.guardrail.emirates_id_masked
}

Audit checklist

Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.

01Each UAE data flow is tagged as mainland, DIFC, ADGM or health before it reaches the gateway.
02Health inference runs on endpoints physically in the UAE, confirmed by facility identifiers in proof receipts.
03A transfer basis under PDPL Article 22 or 23 is recorded for every non-UAE destination used for mainland data.
04DIFC transfers rely on an Article 26 adequate jurisdiction or Article 27 safeguards, and the record names which.
05Emirates ID masking is enabled and its detection rate is tested on sample traffic.
06The current status of PDPL Executive Regulations has been reviewed with counsel in the last 12 months.
07Failover targets for UAE-only routes are inside the UAE.

UAE PDPL: frequently asked questions

Does the UAE PDPL require data localisation?

Not for ordinary personal data. It restricts transfers to cases with adequacy or a recognised exception. Localisation comes from sector rules, most notably the health data law, and from regulator expectations in banking and government work.

We are licensed in the DIFC. Does the PDPL apply to us?

Processing inside the DIFC falls under the DIFC Data Protection Law instead. If you also process mainland data outside the DIFC, the PDPL can apply to that part.

Which YTT Secunet pack covers this?

The uae-pdpl-local pack implements the routing above. Free-zone rules are added as custom Rego on Enterprise Sovereign, since DIFC and ADGM transfer bases are tenant-specific.

Sovereign route ready

Stop risking 4% global turnover GDPR fines on AI inference.

Deploy sovereign, cryptographically proven AI routing in 15 minutes.

Schedule an architecture demo Start 14-day trial