The law in one paragraph
The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL) is the federal data protection law for the UAE, overseen by the UAE Data Office. It applies to businesses in the UAE that process personal data, and to businesses outside the UAE that process the data of people in the UAE. It follows principles familiar from GDPR: a lawful basis for processing, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, and rights for individuals to access, correct and delete their data. Free zones with their own regimes (DIFC and ADGM) have their own data protection laws, and certain sectors such as health and banking have additional rules. Check which applies to you.
What changes when the "processor" is an AI
Four things make chatbots different from a contact form.
1. The conversation itself is data
It is not just the phone number. Everything the customer types, including things they volunteer about their health, finances or family, is stored somewhere. You need to know where, for how long, and who can see it.
2. A third party processes it
The AI model that generates replies is usually run by a provider outside the UAE. That is a cross-border transfer of personal data, which the PDPL permits only under conditions, such as adequate protection in the destination or appropriate contractual safeguards.
3. The AI can collect more than you intended
A bot that is helpful will ask follow-up questions. Without limits, it collects data you have no purpose for, which breaks the minimisation principle.
4. People do not always know they are talking to AI
Transparency requires that they do.
A practical checklist before go-live
Disclosure
The assistant introduces itself as an AI in its first message and on the website widget. Voice agents say it at the start of the call, including that the call is transcribed or recorded.
Consent and lawful basis
For WhatsApp, customers opt in before you message them, and the opt-in is recorded. For marketing follow-ups, consent is separate from service messages. Your privacy notice is linked from the chat and names the chatbot and the AI provider as a processor.
Minimise
Define the fields the bot may collect for each purpose (for example: name, phone, preferred time for a booking) and nothing else. Design the bot to not probe for sensitive data, and to route sensitive topics to a person.
Where the data lives
Keep customer records in your own systems, such as your CRM or booking system, where you already have controls. Keep chat transcripts for a defined period, then delete them. Decide this before launch, not after.
AI provider terms
Use providers whose business terms state that your data is not used for training and is deleted within a defined period. Record this in your data processing documentation. For regulated data or strict policies, use in-region hosting (UAE, Bahrain or Qatar cloud regions) and in-region models.
Cross-border transfer
Document the transfer: which provider, which country, which safeguard. For most businesses this is a contractual clause with the provider plus a note in your privacy policy. For health and financial data, check sector rules, which may require data to stay in the UAE.
Individual rights
Have a way to find and delete a specific person’s conversations when they ask. If transcripts are scattered across a chatbot platform, WhatsApp and a CRM, that is three places to search. Fewer is better.
Security
Scoped access for staff, logging of who viewed what, and encryption in transit and at rest. The chatbot’s connection to your CRM should have the minimum permissions it needs.
Handover rules
Complaints, health symptoms, financial advice questions, and anything the customer flags as sensitive go to a human. Write these rules down and test them.
Review and retention
Someone reviews a sample of conversations monthly for quality and for data the bot should not have collected. Retention periods are enforced automatically.
Sector notes
Healthcare
Patient data is also covered by the ICT Health Law and your regulator (DHA, DoH or MOHAP). Health data generally should stay in the UAE unless an exemption applies. The assistant should handle logistics only, never clinical advice.
Finance
Banks, insurers and fintechs answer to the CBUAE, SCA, DFSA or FSRA. Expect requirements on record-keeping, audit trails and outsourcing. The assistant should never give financial advice.
Real estate and hospitality
Mostly standard PDPL obligations, with particular attention to WhatsApp opt-in, marketing consent and retention of guest or buyer data.
How we build for this
Every Verva AI assistant discloses that it is AI, collects only the fields agreed in the conversation design, keeps customer records in your own systems, uses providers with no-training terms, supports in-region hosting where needed, logs every action and comes with a documented data flow you can hand to your legal adviser or regulator. It is the boring part of the project, and it is the part that lets you sleep.
Book a free audit
and we will walk through the data flow for your own use case before anything is built.