Your customer messages your AI chatbot on WhatsApp. The bot reads the query, calls an overseas model provider's API to draft the reply, and sends the answer back.
That request left the country the second it hit the model. For UAE businesses deploying AI, that moment is a cross border data transfer UAE law regulates, and most companies have no documented basis for it.
This article maps the event to the Personal Data Protection Law, walks through the routes that make the transfer lawful, flags the sector rules that override it, and gives you a compliance position you can put in place this quarter.
Key Takeaways
- Every AI API call is a regulated data transfer — Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, treats any personal data sent to an overseas model provider as a cross-border transfer, regardless of the technical channel used.
- The UAE Data Office polices cross-border transfers — Established by Federal Decree-Law No. 44 of 2021, it will publish the adequate-country list, approve standard contractual clauses, and adjudicate breaches; penalties for unlawful transfers can reach the millions of dirhams.
- Banking, health, and IoT data must often stay onshore — The Central Bank's 2021 Consumer Protection Standards, Federal Law No. 2 of 2019 on ICT in health fields, and the IoT Regulatory Policy of 22 March 2018 can require in-country storage regardless of what the general PDPL permits, even with a DPA in place.
- The adequate-country list still does not exist — Executive regulations defining adequacy were expected in March 2022 and remain unpublished more than three years later, leaving a data processing agreement with your AI provider as the most defensible transfer basis today.
- Three moves build a defensible position now — Map every field your AI features send to the model and strip what isn't needed, sign a data processing agreement with the provider that mirrors PDPL protections, and rewrite the privacy notice to disclose the transfer, the destination, and the safeguard used.
What Federal Decree-Law No. 45 of 2021 Actually Says About Sending Data Outside the UAE
The PDPL allows transfers to countries or organisations offering protection adequate to its own standard, subject to the UAE Data Office's rules. What "adequate" means in practice sits in executive regulations that are still not published.
Per the UAE government portal, the PDPL is the country's first federal personal data law and came into force on 2 January 2022. It sets the baseline rules for how personal data can be collected, processed, and moved abroad.
The federal regulator is the UAE Data Office, established by Federal Decree-Law No. 44 of 2021.
It is the body that will publish the adequate-country list, approve standard contractual clauses, and adjudicate breaches. On the mainland, cross-border transfer decisions run through it.
The executive regulations that define "adequate" were expected in March 2022, and more than three years later have still not appeared. Companies moving personal data abroad today have to work with the law's current text and document their own reasoning.
The UAE's Federal Decree-Law No. 45 of 2021 sets out the lawful bases for processing personal data and the rights a data subject can exercise against a controller.
Why Sending a Customer Query to an Overseas AI Model Is Already a Regulated Transfer
Photo: Brett Sayles on Pexels
Because the request leaves the UAE and lands on a server abroad. The PDPL regulates any transfer of personal data outside the country regardless of the technical channel, so an API call carrying a name or phone number counts.
Most UAE businesses deploying an AI chatbot do not think of themselves as running a cross-border transfer operation. They should. The moment your bot passes a customer's name, phone number, Emirates ID, or order reference to an overseas model provider, personal data has left the UAE and landed wherever that provider hosts its inference stack.
Your company is the controller. The overseas model provider is a processor. Legal responsibility for having a valid transfer basis in place before the first API call sits with you, not with the vendor.
The PDPL also has extraterritorial reach, so an overseas provider is not off the hook simply because it is not based in the country. Any organisation processing UAE residents' data comes within scope regardless of where its servers sit.
Enforcement reach against the UAE-based controller is far more direct, though, which is why the compliance burden lands on you.
Before you worry about the transfer basis, look at what your bot is actually sending. Cutting personal data at source shrinks the surface area you have to defend.
The Three Legal Routes for Transferring Personal Data to an Overseas Model Provider
Three routes: transfer to a country the UAE Data Office deems adequate, sign contractual safeguards with the recipient, or obtain explicit consent from the data subject. Only the contractual route is realistically usable in production today.
Adequate-country route. Transfer to a jurisdiction the UAE Data Office has declared adequate. In theory this is the cleanest path.
In practice, the office has not published the list, because the executive regulations that define the process are still not out. Nobody can rely on this route with confidence today.
Contractual safeguard route. Sign a data processing agreement with the overseas provider that binds it to protections equivalent to the PDPL. For AI deployments this is the most workable and auditable path. The major model vendors publish enterprise DPAs; the work is reading them, checking they cover PDPL-level obligations on security, subprocessing, and data subject rights, and filing them.
Consent route. Get explicit, informed consent from each data subject for the transfer. This falls apart at scale. An AI agent handling hundreds of daily conversations cannot pause for a consent dialogue every time, and in B2B contexts the person messaging your bot is often not the account holder whose consent would count.
Whichever route you pick, your privacy notice has to disclose the transfer, the destination, and the safeguard you're relying on.
If picking the right route for your setup is above the compliance team's paygrade, book a call with Lenoo AI to walk through the options.
Weighing the three routes side by side makes the current gap obvious.
Licensed financial institutions work to the Central Bank of the UAE rulebook, which covers outsourcing, model risk and how customer data may be handled.
| Route | Legal basis | Usable in production today |
|---|---|---|
| Adequate-country | Transfer to a jurisdiction the UAE Data Office deems adequate | No — adequate-country list not published |
| Contractual safeguard | DPA with the overseas provider binding it to PDPL-equivalent protections | Yes — most workable and auditable path |
| Consent | Explicit, informed consent from each data subject | No — falls apart at scale, hard to obtain mid-conversation |
When Sector Rules Are Stricter Than the General PDPL: Banking, Health, and IoT
Photo: Alec Adriano on Pexels
Banking, healthcare, and IoT sit under their own localisation regimes that can require data to stay inside the UAE, overriding what the general PDPL would permit. DIFC and ADGM add their own layers on top.
Banking. The UAE Central Bank's Consumer Protection Standards, issued in 2021, are widely understood to require licensed financial institutions to store customer and transaction data inside the country. Routing that data through an overseas AI model may breach the Central Bank's standards independently of the PDPL, even with a spotless DPA on file.
Healthcare. Federal Law No. 2 of 2019 concerning the use of ICT in health fields applies to healthcare providers and their technology systems across the UAE, including the free zones, and requires electronic health data to be stored in the country. If your AI use case touches patient records, the overseas processing path is largely closed.
IoT. The IoT Regulatory Policy issued on 22 March 2018 requires certain IoT service providers to store data classified as secret, sensitive, or confidential within the UAE, or only in countries meeting specified criteria. Connected-device deployments feeding data to an overseas model need to check this before wiring anything up.
Free zones. DIFC entities are governed by DIFC Law No. 5 of 2020, and ADGM entities by the ADGM Data Protection Regulations 2021.
Both regimes layer their own cross-border transfer obligations on top of the mainland framework. If you are in a free zone, treat your zone's rules as the primary reference.
What to Do Right Now: A Minimum Compliance Position Before Regulations Are Finalised
Map the data flow, sign a DPA with your model provider, update the privacy notice, and read the enforcement picture. You do not need to wait for the executive regulations to move.
Map the data flow. For every AI feature you run, list every field that reaches the model per request and confirm which qualify as personal data. Strip the fields that do not need to leave your systems and pseudonymise the rest.
Sign a DPA. Execute a data processing agreement with your overseas model provider that mirrors PDPL protections, and file it as your documented legal basis before the feature goes live, not after a regulator asks.
Rewrite the privacy notice. Disclose in plain language that personal data is transferred to an overseas AI provider, name the country, and describe the safeguard.
Understand the downside. Fines can climb into the millions of dirhams for the most serious breaches, and the reputational cost of a public enforcement action rarely shows up in a compliance budget.
Not sure which of your AI features carry personal data abroad? Book a consultation with Lenoo AI to talk it through.
Related reading
FAQ
Does using ChatGPT, Claude, or any overseas AI model count as a cross-border data transfer under UAE law?
Yes, whenever the input contains personal data of a UAE resident. That moment triggers the PDPL's cross-border transfer rules and requires a lawful basis. Fully anonymised or synthetic inputs sit outside scope.
Which countries does the UAE consider to offer adequate data protection for cross-border transfers?
No official list has been published. The framework for adequacy decisions sits in executive regulations that are still not out, so companies today rely on contractual safeguards rather than the adequate-country route.
What is the penalty for an unlawful cross-border data transfer under the PDPL?
Financial penalties are widely reported to reach into the millions of dirhams for the most serious violations, with lower bands for less severe breaches. The exact schedule sits in the executive regulations, so the headline numbers should be treated as indicative rather than fixed.
Does the PDPL apply to AI model providers based outside the UAE if they process UAE residents' data?
Yes. The PDPL has extraterritorial reach, so an overseas processor comes within scope when it handles UAE residents' data. Enforcement is more direct against the UAE-based controller, which is why the compliance work still lands on you rather than the vendor.
Are DIFC and ADGM businesses subject to the same cross-border transfer rules as mainland UAE companies?
No.
DIFC entities are governed by DIFC Law No. 5 of 2020 and ADGM entities by the ADGM Data Protection Regulations 2021. Both regimes have their own cross-border transfer mechanisms, closer in shape to GDPR, and take precedence for companies incorporated in those zones.
Can a UAE company use customer consent as the legal basis for transferring data to an overseas AI model?
You can, but it does not scale. Consent must be explicit, informed, and specific to the transfer, which is hard to obtain reliably inside a live AI conversation. Contractual safeguards are the more durable primary basis.
