Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is not written about artificial intelligence. It does not need to be. It defines Automated Processing and Profiling, gives individuals a right, subject to exceptions, to object to decisions that result from them, and requires an impact assessment before certain automated processing begins. The Decree-Law has been in force since 2 January 2022. Its Executive Regulations, which are to set several thresholds and whose issue starts the period allowed to comply, were not found on the federal legislation portal on 30 October 2026. A mainland company deploying AI has both a text to work to now and a set of open questions to plan around.
This article reads the English text of the Decree-Law published on the UAE Legislations portal at a general level for orientation. The portal notes that the Arabic text prevails in case of conflict. It is not legal advice. Whether and how the Decree-Law applies to a given AI tool depends on the company's own processing and should be decided on its own facts.
The dates on the record
The UAE Legislations portal records the Decree-Law as issued on 20 September 2021, published in Official Gazette No. 712 (supplement) on 26 September 2021, and effective on 2 January 2022. It lists the legislation state as “Active”. Article 31 says the Decree-Law “shall come into force as of 02 January 2022”.
Two further provisions govern timing. Article 28 required the Council of Ministers to issue the Executive Regulations “within six (6) months as of the date on which the Decree by Law is promulgated”. Article 29 then gives Controllers and Processors “a period of no more than six (6) months as of the date on which its Executive Regulations are issued” to regularise their status, and allows the Council of Ministers to extend that period “for another similar period”.
On 30 October 2026 the Decree-Law's page on the portal listed no Executive Regulation among its related legislation, and a portal search for “personal data executive regulation” returned 16 results, none of them an Executive Regulation of this Decree-Law. Article 26 leaves the list of violations and the administrative penalties to a decision of the Council of Ministers.
The consequence is that the Decree-Law itself fixes no calendar date by which a company must have regularised. Article 29's period runs from an event that we could not find recorded on the portal. Any fixed compliance date offered for the federal regime should be checked against the instrument that sets it. On our reading, the better planning assumption is that the Executive Regulations could be issued at any point, and that a company will then have no more than six months, or up to a further six months if the Council of Ministers extends the period, to bring its processing into line.
The UAE Government portal, updated on 4 December 2025, still describes the regulator in the future tense: it says the UAE Data Office, established by Federal Decree-Law No. 44 of 2021, “will act as the federal data regulator in the UAE”. The English text of the Decree-Law mostly calls this body the Bureau (Article 1 defines the term “Office” as “The UAE Data Bureau”). We use Data Office throughout.
Who the Decree-Law reaches
Article 2(1) applies the Decree-Law to processing of personal data “by means of electronic systems which operate automatically, or by other means”, and, on our reading of the English text as printed (its sub-numbering is irregular), in respect of data subjects residing or having a place of business in the UAE, to Controllers and Processors in the UAE processing data of data subjects inside and outside the State, and to Controllers and Processors outside the UAE processing data of data subjects inside it.
Article 2(2) then takes several categories out of scope. Those most relevant to AI deployments are:
- Article 2(2)(e): personal health data that has legislation regulating its protection and processing.
- Article 2(2)(f): personal banking and credit data and information that have legislation regulating their protection and processing.
- Article 2(2)(g): companies and establishments located in free zones that have special legislation regarding personal data protection.
- Article 2(2)(a) and (b): government data, and governmental entities which control or process personal data.
On our reading, paragraph (g) is what takes firms in free zones with their own data protection legislation, such as the DIFC and ADGM, outside the Decree-Law. We have covered those regimes separately for the DIFC and ADGM. Paragraphs (e) and (f) depend on whether other legislation regulates the data in question, so a bank or a healthcare provider on the mainland will want to map which of its AI use cases fall under the Decree-Law and which fall under sector rules.
Article 3 allows the Data Office to exempt establishments that “do not process a large volume of Personal Data” from some or all of the requirements, but only in accordance with standards set by the Executive Regulations. On our reading, until those standards are issued and the Data Office grants an exemption, no exemption of that kind can be relied on.
Consent and the lawful basis for AI
Article 4 opens with a prohibition: “It is prohibited to process Personal Data without the consent of its owner.” Ten specific exceptions and a catch-all follow. Those a commercial AI deployment is most likely to rely on are processing necessary to perform a contract to which the data subject is a party (Article 4(9)), to fulfil specific obligations in other UAE laws (Article 4(10)), and for the Controller or data subject to carry out employment, social security or social protection obligations and rights (Article 4(8)). Article 4(11) adds “Any other cases set out in the Executive Regulations of this Decree by Law”.
On our reading, the list contains no general ground for processing in the Controller's own legitimate interests. Article 15(2)(c) refers to “the absence of legitimate reasons for the Controller to continue the processing”, but in the context of erasure, not as a basis for processing. A company that wants to run personal data through an AI tool for a purpose outside a contract or a legal obligation, such as analytics or model improvement, should therefore expect to need consent unless another Article 4 case clearly applies or the Executive Regulations add one. Article 6 sets the terms for consent: the Controller must be able to prove it, it must be clear, simple and unambiguous, it must include the right to withdraw it easily, and withdrawal may happen “at any time”.
Purpose limits matter as much as the basis. Article 5(2) requires data to be collected for a specific and clear purpose and not processed later in an incompatible manner, although it “may be processed if the purpose is similar or close to the purpose for which this data is collected”. Article 5(3) limits data to what is necessary for that purpose, and Article 5(7) prohibits keeping data after the purpose is exhausted unless the data subject's identity has been concealed using anonymisation. On our reading, a company reusing customer records to train or tune a model would need to show that the training purpose is similar or close to the original one, or obtain a fresh basis, such as consent, for it.
Automated decisions: Article 18
Article 1 defines Automated Processing broadly: processing by an electronic program or system operating “either completely independently without any human intervention or partially with limited human supervision and intervention”. Profiling is a form of automated processing used to assess personality aspects, “including analyzing or predicting aspects related to his/her financial performance or condition, health, personal preferences, interests, behavior, location, movements or reliability”. On our reading, candidate screening, fraud flags and personalised pricing that assess individuals are likely to fall within those words, as is credit scoring, subject to the Article 2(2)(f) exclusion for credit data regulated by other legislation.
Article 18(1) gives the data subject “the right to object to any decisions resulting from automated processing, including profiling, particularly those decisions which have legal impact on or adversely affect the Data Subject”. Article 18(2) removes the right to object where the automated processing is agreed in the contract between the data subject and the Controller, is required under other applicable UAE legislation, or the data subject gave prior consent to it under Article 6.
Two further duties follow. Article 18(3) requires the Controller, in the cases in Article 18(2), to adopt appropriate measures to protect the data subject's data and not to prejudice their rights. Article 18(4) says: “The Controller shall include the human element in reviewing automated processing decisions at the request of the Data Subject.” On our reading, that review duty is not limited to the cases where an objection is available, so every automated decision process needs a route by which a person can ask for a human review and a person can carry it out.
Transparency runs alongside. Article 13(1)(c) entitles a data subject, on request and without charge, to information on “Decisions made based on automated processing, including profiling”, and Article 17(1) allows a data subject to object to and stop processing for direct marketing, “including profiling related to direct marketing”.
The impact assessment: Article 21
Article 21(1) requires the Controller, before carrying out the processing, to assess the impact of the proposed processing on the protection of personal data “when using any of the modern technologies that would pose a high risk to the privacy and confidentiality of the Data Subject's Personal Data”. Article 21(2) states that the assessment is required where the processing includes “a systematic and comprehensive assessment of the personal aspects of the Data Subject, using automated processing, including profiling, having legal consequences or serious impact on the Data Subject”, or where processing would be carried out on a large volume of Sensitive Personal Data.
Article 21(3) sets the minimum content:
- A clear and systematic explanation of the proposed processing operations and the purpose of processing.
- An evaluation of how necessary the processing operations are and how suitable they are for the purpose.
- An evaluation of potential risks to the privacy and confidentiality of the data subject’s personal data.
- The proposed procedures and measures to reduce those risks.
A Controller may carry out one assessment for a set of operations with similar nature and risks (Article 21(4)), must coordinate with its Data Protection Officer (Article 21(5)), and must review the results regularly in case the level of risk changes (Article 21(7)). Article 21(6) requires the Data Office to prepare and publish a list of processing types that do not need an assessment. Nothing in Article 21 waits for the Executive Regulations, even though Article 29's regularisation period runs from Executive Regulations we could not find on the portal. On our reading, a Controller introducing an AI tool that systematically and comprehensively profiles customers or employees with legal or serious effects should hold an Article 21 assessment before it goes live, as a matter of the text as it stands.
When a DPO is needed: Article 10
Article 10(1) requires both the Controller and the Processor to appoint a Data Protection Officer in any of three cases: where processing would cause “a high-level risk to the confidentiality and privacy” of personal data “as a result of adopting new technologies or with regard to the volume of data”; where processing would involve “a systematic and comprehensive assessment of Sensitive Personal Data, including Profiling and Automated Processing”; or where processing would be carried out on a large volume of Sensitive Personal Data.
Article 10(4) leaves “the types of technologies and criteria for determining the volume of data” to the Executive Regulations. Sensitive Personal Data is defined widely in Article 1 and includes criminal record, biometric data and health data. A company whose AI tool assesses such data systematically has a reason to plan for a DPO now, even though the volume thresholds are not yet set. Article 10(2) allows the DPO to be an employee or someone authorised by the company, inside or outside the UAE.
Records, vendors and transfers
Most AI on the mainland arrives through a vendor. Article 7(5) requires the Controller to appoint a Processor “which has sufficient guarantees” to implement the necessary technical and organisational measures. Article 8(1) requires the Processor to process in accordance with the Controller's instructions and the contracts between them, which specify in particular the scope, subject, purpose, nature and type of personal data. Article 8(4) requires the Processor to erase data after the processing period expires or on handing it back.
Article 7(4) requires the Controller to keep a record of its personal data, covering among other things the categories of data, who may access it, the purpose of processing, any cross-border movement, and the security measures, and to give it to the Data Office on request. On our reading, personal data processed through an AI tool belongs in that record like any other.
Where the model or its hosting sits outside the UAE, the transfer rules apply. Article 22 permits transfers in cases approved by the Data Office, where the destination has data protection legislation or the UAE is party to a relevant agreement. Article 23(1) permits transfers in other cases. These include, under Article 23(1)(a), transfers by companies operating in countries with no data protection laws under a contract or agreement obliging the companies there to adopt the measures, controls and requirements set out in the Decree-Law, and, under Article 23(1)(b), transfers with the data subject's explicit consent, provided the transfer does not contradict the public or security interest of the State. Article 23(2) leaves the controls for those transfers to the Executive Regulations.
What to have on file
A mainland company using AI on personal data would want the following in writing, ready for the day the Executive Regulations start Article 29's clock:
A register of AI tools in the Article 7(4) record
An Article 4 basis for each use
An Article 18 review route
Article 21 assessments before go-live
A DPO decision under Article 10
Vendor terms and transfer grounds
Where to start
The register of AI tools is the input everything else depends on. It is the first thing the two-week AI Governance Assessment produces: a written baseline across a firm's AI tools and a costed roadmap, at a fixed AED 5,000.