UAE PDPL for chatbots and WhatsApp: what applies today

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has applied since 2 January 2022 to chatbots and WhatsApp systems that handle personal data of people in the UAE: you need consent or one of the law's listed exceptions, a specific purpose, only the data that purpose needs, and a way for people to exercise their rights. Its Executive Regulations, which set breach deadlines, transfer controls and the start of a six month regularisation period, were still not listed on the official UAE Legislation portal on 27 October 2026.

This is general information, not legal advice. Confirm your position with a UAE adviser.

What is actually in force today?

The UAE Legislation portal lists the Decree-Law as issued on 20 September 2021, effective 2 January 2022, and active. It also shows the law's last update as 20 September 2021, and its related legislations page lists no Executive Regulations.

That gap matters because the law hands several details to those regulations:

• Article 28 required the Cabinet to issue them within six months of the law. The portal shows none.
• Article 29 gives controllers and processors six months to bring themselves into line after the regulations are issued, extendable by the Cabinet. That clock has not started.
• Article 9 says breaches must be reported to the UAE Data Office within the period the regulations set, so there is no statutory number of hours yet.
• Article 26 leaves the list of violations and penalties to a Cabinet decision.

The core rules on consent, purpose and rights are in the Decree-Law itself, and the regularisation period will be six months at most unless extended. Building to them now is cheaper than retrofitting later.

Does it cover your business?

Article 2 applies the law to controllers and processors in the UAE, and to those outside it that process personal data of people in the UAE. A Chennai or London vendor running your chatbot is inside its reach.

It does not apply to government data, to health and banking data that have their own laws, or to companies in free zones with their own data protection legislation. That last exclusion is why location comes first:

• DIFC has its own Data Protection Law (DIFC Law No. 5 of 2020), and Regulation 10 of its Data Protection Regulations adds rules for personal data processed by autonomous and semi-autonomous systems, including AI, treating the business that deploys the system as the controller.
• ADGM has its own Data Protection Regulations 2021.

If you trade from both onshore and a free zone, map which customers' data falls under which regime.

What a chatbot or WhatsApp CRM must do

Consent. Article 4 prohibits processing without consent unless an exception applies, such as performing a contract with the person. Article 6 says consent must be clear, simple and unambiguous, easy to withdraw, and provable by you. For a WhatsApp CRM, store when and how each person opted in, and what they were told.

Purpose and minimisation. Article 5 requires a specific, clear purpose, data limited to what that purpose needs, and deletion once the purpose is exhausted unless the data is anonymised. An enquiry bot that asks for a passport number to answer a price question fails this test.

Tell people before you process. Article 13 lists what a person can ask for, and requires you to tell them up front the purposes, who inside or outside the UAE the data is shared with, and the safeguards for any transfer abroad. One plain notice in the first message, with a link to the full policy, covers the start.

Rights. Under Articles 14 to 18 people can ask for correction or erasure, restrict or stop processing, and object to direct marketing. They can also object to decisions made by automated processing, and you must include a person in reviewing such a decision on request. A lead scoring bot that decides who gets a callback needs that human step.

Transfers abroad: model APIs and WhatsApp servers

Article 22 allows transfers to countries with adequate data protection law approved by the Data Office. Article 23 adds other routes where protection is not adequate, including a contract binding the recipient to the law's standards, the person's explicit consent, or necessity for a contract with them. The controls for these routes are left to the Executive Regulations.

Two practical points. Sending a transcript to a model API hosted abroad is a transfer, so either document the route or keep the model in the country: our private AI deployment puts an open-weight model on your server or in a UAE cloud region. And Meta's WhatsApp Cloud API offers local storage with the UAE as a supported region: message content is stored at rest there, though Meta says it may be processed internationally for up to 60 minutes while in use. Saudi Arabia is not on that list.

Saudi Arabia in brief

Saudi Arabia's Personal Data Protection Law, issued by Royal Decree M/19 and amended in 2023, came into force on 14 September 2023 with a one year grace period, and is enforced by SDAIA. Unlike the UAE, its Implementing Regulations and a separate regulation on transfers outside the Kingdom were issued in September 2023. Assume Saudi customer data stays in the Kingdom unless a transfer basis is documented.

Building to the law as written

Our WhatsApp CRM can be set up to capture consent in the first message, ask only the qualifying questions you need and route anything sensitive to a person. Our Gulf page sets out how we work with UAE, Saudi and Qatari clients from Chennai.

Book a consultation.