UAE law does not generally require AI workloads or company data to stay in the country. The Personal Data Protection Law (PDPL) lets personal data leave under set conditions. The strict UAE data residency requirements are sectoral: health data from UAE health services must stay unless an exception applies, and banks must store their master system of record locally.
This guide is for IT and compliance teams deciding where an AI system should run. It summarises the public texts as of early October 2026 and is not legal advice: confirm your position with a UAE-qualified lawyer and, where relevant, your sector regulator. For the hardware side, see our guide to running AI on your own servers in the UAE.
UAE data residency requirements at a glance
Which rule applies depends on where your company is licensed, which sector it is in and what the data is. The same AI assistant can be fine for one document and out of bounds for the next.
| Who or what | Rule | Must the data stay in the UAE? |
|---|---|---|
| Personal data held by mainland companies | PDPL, Federal Decree-Law No. 45 of 2021, Articles 22 and 23 | No: in cases the UAE Data Office approves, or under Article 23 |
| Health data from health services in the UAE, free zones included | Federal Law No. 2 of 2019, Article 13 | Yes, unless a health authority resolution allows it |
| Customer data held by banks operating in the UAE | CBUAE Outsourcing Regulation for Banks, Article 6 | The master system of record stays here; sharing abroad needs Central Bank approval and written customer consent |
| Companies in the DIFC | DIFC Data Protection Law No. 5 of 2020, Articles 26 and 27 | No: to jurisdictions the Commissioner finds adequate, or with safeguards |
| Companies in ADGM | ADGM Data Protection Regulations 2021, Part V | No: on an adequacy decision, or with safeguards |
| Government entities and government data | Outside the PDPL (Article 2) | Not set by the PDPL; check the entity's own requirements |
| Internal, non-personal business data | Your contracts, client terms and policies | Only if one of them says so |
What the PDPL says about sending personal data abroad
It allows it, under conditions. The law's definition of cross-border processing includes the use, transmission, retrieval, sharing or processing of personal data outside the State. A prompt containing a customer's name that a model abroad answers is therefore cross-border processing, even if the chat history is stored in the UAE.
Article 22 permits transfers in cases approved by the UAE Data Office (the Bureau in the official English translation): to a country whose data protection legislation covers the law's main provisions, with a regulator or court that can impose measures on controllers and processors, or to one with which the UAE has joined a data protection agreement. Otherwise, Article 23 allows a transfer:
- to a country without a data protection law, under a contract that obliges the recipient to apply the PDPL's measures;
- with the data subject's explicit consent, if it does not conflict with the State's public or security interest;
- to conclude or perform a contract with the data subject, or with a third party in their interest;
- for legal claims, international judicial cooperation or the public interest.
Article 23 leaves the detailed controls to the executive regulations. Other duties bite on AI projects. The record of processing must cover cross-border movement (Article 7). Before processing starts, people must be told its purposes, who inside and outside the UAE receives their data and how cross-border processing is protected (Article 13). They may object to decisions from automated processing, including profiling, that have legal consequences or seriously affect them, with exceptions such as their prior consent, and ask for human review (Article 18). An impact assessment is needed before processing that uses new technologies posing a high risk to privacy, in particular systematic automated assessment of people with legal or serious effects, or processing large volumes of sensitive data (Article 21).
Article 2 excludes government data and entities, security and judicial authorities, health and banking data that has its own legislation, and free zone companies with their own data protection law. Those gaps are where the stricter rules below come in.
Are the PDPL executive regulations out yet?
Not on the official UAE Legislation portal. Article 28 asked the Cabinet to issue them within six months of the law's promulgation on 20 September 2021, and Article 29 gives controllers and processors up to six months from their issue to comply, which the Cabinet may extend by a similar period. In October 2026 the UAE Legislation portal listed no executive regulations among the law's related legislation, although the law has been in force since 2 January 2022, as the UAE Government portal also states.
The regulator is changing too. On 14 June 2026 the Cabinet announced the approval of the Artificial Intelligence and Data Authority, which brings together the functions of three bodies, among them the UAE Data Office. Date your compliance decisions and revisit them when the regulations are issued.
Sector rules that keep data in the UAE
Health data: Federal Law No. 2 of 2019
Article 13 of the law on ICT in health fields bars storing, processing, generating or transferring outside the State any health data and information related to health services provided in the State, except in cases where a health authority issues a resolution in coordination with the Ministry. The law covers free zones too (Article 2), and breaching Article 13 carries a fine of AED 500,000 to 700,000 (Article 24).
The Ministry of Health and Prevention's Ministerial Decree No. 51 of 2021 lists the permitted cases, among them treatment abroad, samples sent to overseas laboratories, approved research and insurance claims, each with conditions. The conditions include the patient's written consent and encryption for several cases, de-identified data for research, and, for several cases including any data the health authority approves under its catch-all case, a copy kept in the UAE. Before an overseas AI service touches patient data, check whether a listed case covers it or ask your health authority; otherwise keep storage and processing in the UAE.
Banks: the Central Bank's Outsourcing Regulation
The Central Bank's Outsourcing Regulation for Banks (circular 14/2021, in force since 15 July 2021) applies to all banks operating in the UAE. Article 6 requires the master system of record, which includes all customer confidential data, to be continuously maintained and stored in the UAE (foreign bank branches may keep a daily-updated copy here, with approval). That data may not be shared outside the UAE without Central Bank approval and the customer's prior written consent. Article 8 requires the Central Bank's prior non-objection before any material activity is outsourced, and outsourcing is defined broadly enough that a bank's compliance team will normally assess a cloud AI service against it.
The DIFC and ADGM run their own regimes
DIFC companies follow the DIFC Data Protection Law No. 5 of 2020 (consolidated July 2025). Transfers out go to jurisdictions the Commissioner of Data Protection finds adequate (Article 26), or rely on safeguards such as standard clauses and binding corporate rules, or on listed derogations (Article 27). Regulation 10 of the DIFC Data Protection Regulations covers autonomous and semi-autonomous systems that process personal data: an app or website using one must give users clear notice on first use, describing its purposes, its outputs and how they are used, and such a system may not be used for high-risk processing until the Commissioner has set audit and certification requirements for it, the system complies with them and an Autonomous Systems Officer is appointed. A June 2026 consultation paper proposes updating Regulation 10, so check which version is in force.
ADGM companies follow the ADGM Data Protection Regulations 2021, as amended. Part V allows transfers on an adequacy decision by the Commissioner of Data Protection (section 41), with appropriate safeguards (section 42), under binding corporate rules (section 43) or under derogations for specific situations (section 44).
PDPL vs GDPR: transfers and AI decisions
The structure is familiar to anyone who knows Europe's General Data Protection Regulation; the main difference today is that the PDPL's detailed rules are still waiting for its regulations.
| Topic | UAE PDPL | EU GDPR |
|---|---|---|
| Transfers to protected destinations | Article 22: cases approved by the UAE Data Office | Article 45: adequacy decisions |
| Transfers without that protection | Article 23: contract with the recipient, explicit consent, legal claims, contracts with the data subject, judicial cooperation, public interest | Article 46 safeguards; Article 49 derogations |
| Automated decisions | Article 18: right to object to automated decisions with legal or serious effects, with exceptions; human review on request | Article 22: right not to be subject to a decision based solely on automated processing with legal or similarly significant effects |
| Impact assessment | Article 21 | Article 35 |
| Detailed rules | Executive regulations not listed on the official portal (October 2026) | Applies since 25 May 2018 |
On-premise AI vs cloud: where a prompt is stored and where it is processed
Two locations matter, and residency commitments often cover only the first: where data is stored at rest, and where the model runs (inference).
- Microsoft 365. The UAE is a local region geography with datacentres in Abu Dhabi and Dubai. For tenants provisioned in the UAE, the Product Terms commit Microsoft to storing Exchange mailbox content, SharePoint and OneDrive files, Teams chat messages and stored Copilot interactions at rest in the UAE; Education tenants without the Advanced Data Residency for Education add-on may be stored in the EU or North America. A request is occasionally handled by servers in another region. For processing, Microsoft announced in-country processing of Copilot interactions in November 2025, and its April 2026 update expects local inferencing in the UAE by the end of 2026; check what your tenant has today.
- Azure. There are two Azure regions in the UAE: UAE North in Dubai, with three availability zones, and the access-restricted UAE Central in Abu Dhabi, its pair. In Microsoft Foundry, data at rest stays in the designated geography for every deployment type, but Global types may process prompts in any Azure region and Data Zone types process within the US, EU or Asia Pacific zones; Standard and Regional Provisioned types process within the chosen geography. Not every model supports every type, and geography-based types arrive last for new models.
- OpenAI. New ChatGPT Enterprise and Edu workspaces can choose the UAE for data residency, and the UAE is one of three regions with inference residency, which keeps GPU execution on in-scope content in the country, with some features excluded. Authentication, routing and other CPU processing may still run abroad, and web search and connected apps follow their providers' terms.
- On-premises. An open-weight model on your own server keeps prompts, documents and answers on hardware you control, unless you connect outside tools. You take on power, cooling, patching, access control and logs.
| Option | Data at rest | Where the model runs | Watch for |
|---|---|---|---|
| Global cloud AI service | The region you choose, which can be the UAE | Any region the provider routes to | Cross-border processing under the PDPL |
| UAE region with in-region processing | UAE | UAE datacentres | Fewer models and features; some system processing abroad |
| On-premises, open-weight model | Your server room | Your servers | Sizing, power, cooling, support |
| Hybrid | Split by data class | Split by data class | Routing rules, logging, user training |
Global cloud, UAE region, on-premises or hybrid: choosing by data class
Sort the data an AI system will touch into classes, then route each class to the simplest place that meets its rule. This is a typical starting map for a mainland company, not a legal ruling.
| Data class | Examples | Global cloud region | UAE cloud region, in-region processing | On-premises |
|---|---|---|---|---|
| Public | Website text, brochures | Yes | Yes | Yes |
| Internal, non-personal | Plans, code, financial models | Yes, if contracts allow | Yes | Yes |
| Personal data (PDPL) | HR files, customer emails | With an Article 22 or 23 basis | Yes | Yes |
| Health data | Patient records, claims | Only in a listed case or with an approval | Yes, if storage and all processing stay in the UAE | Yes |
| Bank customer data | Account and transaction data | Only with Central Bank approval and written customer consent | Yes, under the outsourcing rules | Yes |
In practice, many organisations end up hybrid: drafting and research on a global service, personal data in a UAE-region tenancy, and patient or banking records on a model in their own server room. A UAE region does not remove the PDPL's other duties: a legal basis, notices, records and retention apply wherever the server is.
When on-premises AI is the simpler answer
When a data class must stay in the UAE and the model you want is not offered with in-country processing, or when a client contract forbids processing abroad, running an open-weight model yourself is often the shorter path. Size it before you buy: our AI infrastructure simulator shows which servers run a given model for your number of users, and our guide to GPU memory for a 70B model explains the arithmetic behind it.
How UBM handles it
We start with a data map, not a model: which classes of data the AI will touch, which regime applies to each, and what your legal and compliance team has decided. The legal classification stays with your counsel; we design to it. On the cloud side we set up Microsoft 365 tenancies, licensing and identity, and check the data location the admin centre reports against that decision (see our software work). For classes that stay on your hardware, we size GPU servers in the simulator, check power and cooling, and install the servers, network and serving stack, with identity, access control and audit logging applied to prompts and outputs. The detail is on our AI solutions page; to map your own data classes, talk to a UBM engineer.
Questions people ask
Does UAE law require company data to be stored in the UAE?
Not in general. Personal data may leave under PDPL Articles 22 and 23. Health data from UAE health services and banks' master records stay here unless an exception or approval applies.
Is the UAE Personal Data Protection Law in force?
Yes, since 2 January 2022. Its executive regulations were not listed on the official portal in October 2026; companies get up to six months from their issue to comply.
Can we use ChatGPT or Copilot with personal data in the UAE?
Yes, with a legal basis, notice to the people concerned and, if processing happens abroad, a transfer route under Article 22 or 23. Microsoft and OpenAI both offer UAE storage, and UAE processing for some services.
Does Azure have a region in the UAE?
Two: UAE North in Dubai and the access-restricted UAE Central in Abu Dhabi. To keep model processing in the UAE, use a Standard or Regional Provisioned deployment in UAE North, where the model offers one.
Does the PDPL apply to companies in the DIFC or ADGM?
In general, no: the PDPL excludes free zone companies with their own data protection legislation, which the DIFC and ADGM have. The federal health data law still applies in free zones.
Can health data be processed in the cloud in the UAE?
Yes, if storage and processing stay inside the UAE, in a UAE cloud region or on your own servers. Your health regulator may set further conditions.
Sources
- Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (UAE Legislation portal, 2021)
- Data protection laws (UAE Government portal, updated December 2025)
- Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority (UAE Cabinet, 14 June 2026)
- Federal Law No. 2 of 2019 Concerning the Use of Information and Communications Technology in Health Fields (UAE Legislation portal, 2019)
- Ministerial Decree No. 51 of 2021 regarding cases in which health data and information may be stored or transferred outside the country (Ministry of Health and Prevention, 2021, Arabic text)
- Outsourcing Regulation for Banks, circular 14/2021 (Central Bank of the UAE, 2021)
- DIFC Data Protection Law No. 5 of 2020, consolidated July 2025, and Data Protection Regulations, consolidated version No. 2 (DIFC, 2025 and 2023)
- Consultation Paper No. 3: Updated Data Protection Regulations (DIFC Authority, June 2026)
- ADGM Data Protection Regulations 2021, Part V, section 41 (ADGM, 2021, as amended)
- Regulation (EU) 2016/679, General Data Protection Regulation (EUR-Lex, 2016)
- Product Terms Data Residency (Microsoft Learn, September 2026)
- Microsoft 365 datacenter locations (Microsoft Learn, June 2026)
- What is Microsoft 365 Data Residency? (Microsoft Learn, September 2026)
- Microsoft offers in-country data processing to 15 countries to strengthen sovereign controls for Microsoft 365 Copilot (Microsoft, 4 November 2025, updated April 2026)
- List of Azure regions (Microsoft Learn, 2026)
- Understanding deployment types in Microsoft Foundry Models (Microsoft Learn, August 2026)
- Data residency and inference residency for ChatGPT (OpenAI Help Center, 2026)
Comments
Questions and experience from readers. A person reads every comment before it appears.
No comments yet. If something here does not match what you have seen on site, say so.