UAE PDPL and AI: What a Small Business Must Do Before Putting Customer Data Into Any AI Tool

Before any customer data goes into an AI tool, do seven things: map the data, check the tool tier, get consent where needed, minimise what you share, check where it is processed, write a staff rule and log it. The UAE's PDPL has been in force since 2 January 2022, but its Executive Regulations were still reported as unpublished in September 2026. That gap is why a simple, cautious checklist beats waiting for perfect clarity.

I build AI agents at ForgeApp and I am not a lawyer. This is a practical checklist for a small business, built from linked sources, several of which are compliance blogs and law-firm summaries rather than the law itself. Where sources disagree, I say so. Get legal advice before you rely on it.

What is the UAE PDPL and does it apply to a small business?#

The PDPL is Federal Decree-Law No. 45 of 2021 on the protection of personal data. According to Business Dubai's 2026 status guide, it has been in force since 2 January 2022, but the Executive Regulations that would make its penalties, procedures and thresholds operative had still not been issued, with a September 2026 update confirming that. The same source says the Cabinet created the Federal Authority for Artificial Intelligence and Data on 14 June 2026 and that it absorbs the Emirates Data Office and is expected to finalise the regulations. A second tracker reaches the same conclusion, though a few sites claim the regulations are already in force without citing an official instrument. I weigh those lower.

A summary from Trustable describes the law as requiring consent unless an exception applies, a data protection officer for high-risk processing, breach notification and safeguards for transfers abroad. Three limits matter for a small business:

• Free zones such as DIFC and ADGM run their own data protection regimes, so check which applies to you.
• Health data is governed by separate rules. Per a Baker McKenzie summary, the PDPL does not apply to health data covered by separate regulation. For clinics, read what a clinic AI agent can and cannot do.
• Details are pending. Without the regulations, some specifics (fines, transfer mechanics) are unconfirmed.

My approach: follow the principles now (consent, purpose, minimisation, security, transparency) because they will not disappear when the regulations arrive.

Which customer data counts as personal data?#

Names, phone numbers, emails, Emirates ID details, addresses, photos, voice recordings, WhatsApp messages and anything that identifies a person alone or combined. An AI receptionist's call recording and transcript are personal data. So is a lead list.

What are the 7 steps before customer data goes into an AI tool?#

1. Map the data. Write down what you hold, where, and what you want the AI tool to do with it. One page is enough.
2. Check the tool tier. A consumer chat account and a business plan are different products with different terms. Read the vendor's data terms for business plans: do they use your inputs for training? Can you delete them? Where is data processed?
3. Get consent or confirm another lawful basis. Consent is the default unless an exception applies, per the summaries above. Add a line to your forms and your first WhatsApp message.
4. Minimise. Send the tool the least it needs. Replace names and phone numbers with placeholders when the task is drafting, summarising or analysing patterns.
5. Check where it is processed. Cross-border transfers need safeguards. For health data, the bar is higher: Federal Law 2 of 2019 restricts storing or moving health data outside the UAE unless an approved exception applies, as Al Tamimi explains.
6. Write a one-page staff rule. What may be pasted into which tool, what never may, who approves new tools.
7. Keep a log. Which tools you use, with what data, who approved, and when you last checked the vendor's terms.

What data can go into which AI tool?#

This table is my practical starting point. It is not a legal ruling.

What should I ask an AI vendor about data?#

Seven questions, in writing:

1. Where is my data processed and stored, by country?
2. Is my data used to train your models? Can I opt out by contract?
3. Who at your company can access my data, and under what conditions?
4. How long do you keep it, and can I delete it on request?
5. What happens in a breach, and how fast will you tell me?
6. Which sub-processors do you use?
7. Do I get an export if I leave?

A vendor who answers all seven clearly is easier to trust. A vendor who says "it's all secure" has not answered any. This also applies to me: ask me these before you sign.

What should customers be told?#

Plain, short and early:

• That an automated assistant may handle their messages or calls.
• What data you keep and for how long.
• Who they can contact to correct or delete it.
• How to reach a person instead.

Put it in your privacy notice, and as a one-liner at the start of the chat or call. If you do outbound WhatsApp, opt-in language matters twice: for PDPL consent and for Meta's rules. See WhatsApp automation for UAE businesses.

What does a safe setup cost?#

The compliance work is mostly time, not software: a data map, a staff rule, vendor questions. For built tools, I scope data handling in the Day-1 Blueprint, which is included in every ForgeApp build, and I list data and storage in the one-page spec. See how to write a brief that gets a fixed price. For monthly tool costs, see how much AI costs a UAE SME per month. An AI receptionist is 3,000 to 4,000 AED setup plus 600 to 900 AED per month.

What is still unclear?#

Honest list:

• When the Executive Regulations will be published, and what they say on penalties and transfers.
• How a new federal authority will divide work with existing ones.
• Which transfer exceptions will apply to AI tools in practice.
• Sector rules that apply on top, such as health, finance and real estate.

Until then: collect less, tell people more, and keep a record of why you made each choice.

Questions#

Does the UAE PDPL apply to my small business?#

Federal Decree-Law No. 45 of 2021 is the UAE's general personal data protection law and has been in force since 2 January 2022. Whether it covers you depends on where you operate. Free zones such as DIFC and ADGM have their own regimes, and health data has separate rules. Ask a lawyer to confirm your position.

Can I paste customer data into ChatGPT?#

I would not paste identifiable customer data into a consumer chat tool. Use a business plan with a data agreement you have read, minimise what you share, and replace names and numbers with placeholders where you can.

Are the PDPL executive regulations published?#

As of September 2026, several compliance trackers report that the Executive Regulations have not been published, which means penalty and procedure details are still awaited. Some sources disagree, so check the current status with a lawyer or the UAE Data Office.

What is the biggest PDPL mistake small businesses make with AI?#

Treating an AI tool as private by default. Every tool is a place your data is processed. Know where, who can see it, how long it is kept and whether the vendor uses it for training.

Do I need to tell customers I use AI?#

Tell them how their data is used, including that an automated assistant may process their messages. Transparency is a core principle in data protection laws, and for health data the Dubai Health Authority's AI policy stresses it. Put it in your privacy notice and at the first message.

---

Want an AI setup you can explain to your customers?

• See the pricing
• Book a 20-minute call

Legal status was checked in October 2026 against compliance blogs and law-firm summaries, not the official texts. This is not legal advice.