The UAE PDPL, formally Federal Decree Law No. 45 of 2021 on the protection of personal data, is the country's general personal data law, and any business that runs an AI chatbot collecting names, phone numbers or messages from customers in the UAE needs to understand it. A chatbot is a data-collection channel: every conversation can contain personal data, and the answers it gives can affect people. This guide summarises what the UAE government portal says about the law, read on 14 November 2026, and what it implies for AI chatbots, and it states plainly what could not be verified, including the text of the law's articles and the status of its Executive Regulations. It is general information, not legal advice, and a business should take advice before launching a chatbot that handles personal data.
Key takeaways
- The u.ae portal says the PDPL applies to the processing of personal data, in full or in part through electronic systems, inside or outside the country, and came into force on 2 January 2022.
- The portal says the law prohibits processing personal data without the owner's consent, except in some cases such as protecting a public interest or carrying out legal procedures.
- Data owners can request correction of inaccurate data and ask to restrict or stop processing, and the law sets requirements for cross-border transfers.
- The UAE Data Office is described as the federal data regulator, and the portal lists separate laws for health data, consumers and cybercrime.
- For a chatbot, plan consent, notices, retention, transfers and human handover before launch, and check sector rules such as the health data law.
What the UAE PDPL covers
The u.ae page on data protection laws, last updated on 4 December 2025, describes the PDPL as an integrated framework to protect the confidentiality of information and the privacy of individuals in the UAE. It says the provisions apply to processing personal data, whether in full or in part through electronic systems, inside or outside the country. It describes controls on processing and general obligations for companies that hold personal data to secure it and keep it confidential. A chatbot that records conversations, stores phone numbers or uses customer messages to improve answers is processing personal data in that sense.
Consent, rights and transfers
According to the portal, the law prohibits processing personal data without the consent of its owner, except for some cases in which processing is necessary to protect a public interest or to carry out legal procedures and rights. It gives the data owner the right to request correction of inaccurate personal data and to restrict or stop processing. It also sets out requirements for the cross-border transfer and sharing of personal data for processing. This guide does not summarise the articles themselves, because the legislation portal blocked automated access, and the PDF that the u.ae page links is available in Arabic only. A business should read the Arabic text, or an authoritative translation, with an adviser.
The regulator and what is not confirmed
The u.ae page says the UAE Data Office will act as the federal data regulator, affiliated with the UAE Cabinet, and lists its responsibilities, including preparing policies and legislation related to data protection, proposing and approving standards for monitoring the law, preparing systems for complaints and issuing guidelines for implementation. The page does not state whether Executive Regulations have been issued or give any penalty amounts, and none are stated here. Sources disagree on timing and detail, so a business should check the Data Office and the legislation portal for the latest position before relying on any summary.
Other laws that matter for chatbots
- Health data: the same portal page lists Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, which regulates ICT in healthcare including free zones. A chatbot for a clinic must be assessed under that law too, as explained in the guide to the UAE health data law.
- Consumers: the portal says the Federal Law No. 15 of 2020 on Consumer Protection protects consumer rights, including consumer data, and prohibits suppliers from using it for marketing.
- Cybercrime: the portal lists Federal Decree Law No. 34 of 2021 on combatting rumours and cybercrimes, which addresses misuse of online technologies.
- Free zones: the portal mentions the DIFC data protection law, so businesses in a free zone should check which regime applies.
What the government says about AI
The u.ae page on artificial intelligence in government policies, updated on 8 October 2026, describes the UAE strategy for AI, a National Program for AI and a Council for AI. It links a generative AI guide that, according to the page, emphasises the importance of data privacy. The page presents this as guidance, and it does not describe binding rules for commercial chatbots. A business should therefore treat privacy as a design requirement, and not wait for a chatbot-specific rule.
A practical checklist for a UAE AI chatbot
- Tell people what is collected: show a short notice at the start of the chat explaining what the chatbot records and why.
- Get consent where needed: record how consent was obtained, and do not use conversations for unrelated purposes.
- Limit what the chatbot asks for: do not request identity numbers or health details unless the service truly needs them.
- Decide where data goes: check whether the chatbot's AI provider or hosting is outside the UAE and what the cross-border requirements imply.
- Set retention and deletion: define how long chats are kept and how a person can ask for correction or deletion.
- Offer a human: provide a way to reach staff, especially for complaints, payments or sensitive matters.
- Keep a log and review: test the chatbot against real questions and review it when the rules change.
Where CreativeIn Tek fits
CreativeIn Tek builds AI agents for businesses through its AI solutions service and the AI Agent product, which connects to WhatsApp by QR code. CreativeIn Tek does not claim that these products meet the UAE PDPL, and a business must assess its own use. The cost side of running an agent is explained in the guide to AI agent cost, and a business planning a chatbot can talk to CreativeIn Tek.
Frequently asked questions
What is the UAE PDPL?
It is Federal Decree Law No. 45 of 2021 on the protection of personal data, which the UAE government portal says came into force on 2 January 2022.
Does the PDPL apply to AI chatbots?
It applies to processing personal data through electronic systems, so a chatbot that collects or stores personal data from people in the UAE is within its subject matter. Check the articles with an adviser.
Is consent required to process personal data?
The portal says the law prohibits processing without the owner's consent, except in some cases such as public interest or legal procedures.
Who regulates data protection in the UAE?
The portal says the UAE Data Office will act as the federal data regulator.
Are there extra rules for health chatbots?
Yes. The portal lists Federal Law No. 2 of 2019 on ICT in health fields, which has its own data rules for the health sector.
Last reviewed: 14 November 2026, against the UAE government portal pages on data protection laws and artificial intelligence in government policies. The text of the articles, penalties and the status of Executive Regulations were not verified. Laws change, and this article is general information and not legal advice.
