Three regimes, one architecture decision
| Regime | Who it covers | Transfer position |
|---|---|---|
| Federal PDPL | Mainland UAE entities | Adequacy, SCCs or BCRs; no adequacy list published yet |
| DIFC (Law 5 of 2020) | Dubai International Financial Centre | Own regime; federal PDPL does not apply |
| ADGM (Regs 2021) | Abu Dhabi Global Market | Own regime; federal PDPL does not apply |
| Sectoral mandates | Health data; stored-value customer data | No transfer outside the UAE |
Read the last row first. For those two categories the question is not which safeguard to paper. The data stays. Everything else on this page follows from that. Our governance and security hub collects the wider treatment, starting with AI analytics in regulated industries.
What the AI Strategy 2031 does and does not do
The UAE National Strategy for Artificial Intelligence 2031 sets a national direction. Its objectives include optimising AI governance and regulations, and providing a data-driven infrastructure to support AI experiments.
It is worth being precise about its status. The strategy is policy direction, not a compliance obligation on a private enterprise. It tells you where the regulator is heading. It does not tell you what you must do next quarter.
The obligations come from elsewhere. The federal data protection law, the two financial free zone regimes, and a small number of sectoral rules that are stricter than any of them.
The federal law, and the list that has not arrived
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022. It is the first federal data protection law in the country, and it reads as broadly familiar to anyone who has worked with GDPR.
Articles 22 and 23 govern transfers out of the UAE. Data may move to a country the UAE Data Office recognises as offering adequate protection. Failing that, controllers can rely on standard contractual clauses or binding corporate rules.
Here is the practical difficulty. No adequacy list has been published. The Executive Regulations that would define the transfer mechanisms in detail remained unpublished as of January 2025. The mechanism most enterprises would reach for first is, for now, unavailable in settled form.
That does not make transfer impossible. It does mean an architecture which depends on shipping records offshore is resting on ground that has not finished setting.
The two rules with no exception path
Most of UAE data protection is a question of safeguards. Two areas are not.
Health information. Article 13 of Federal Law No. 2 of 2019 covers the use of ICT in health fields. It prohibits transferring health information outside the UAE. The only exception is what Federal Ministerial Decision No. 51 of 2021 permits. For a hospital group or an insurer, that closes the offshore option for the underlying records.
Stored value facilities. Article 10 of the Central Bank Stored Value Facilities Regulation requires customer data to remain in the UAE. Payment and wallet operators inherit a residency requirement directly from their licence.
If you run AI agents over either dataset, the licence settles the deployment question before you start comparing vendors. The processing happens in country. We covered the equivalent problem under a different regime in HIPAA-compliant AI analytics.
Two free zones, two separate regimes
The federal PDPL leaves the financial free zones alone. They had their own laws first, and they kept them.
DIFC entities follow Data Protection Law No. 5 of 2020, amended in July 2025. ADGM entities follow the Data Protection Regulations 2021. Each has its own regulator, its own transfer rules, and its own enforcement posture.
For a bank with a DIFC licence, a mainland subsidiary, and a group data platform, this is not an abstraction. One query spanning both entities can touch two regimes at once. The architecture has to answer which rule applied to which row, after the fact. That is an audit question more than a storage question, and it is the subject of auditable SQL for BFSI conversational analytics.
Fix the Context, Not the Model. A well-governed semantic layer that understands business context creates more reliable AI-driven analytics than fine-tuning the model itself. Jurisdiction is context. A larger model does not know which of your rows sit under ADGM.
What this means for the AI query layer
Put the four constraints together and a shape emerges.
The records cannot reliably leave the country, and in two sectors cannot leave at all. The applicable rule varies by entity, not only by dataset. And the regulator will ask, later, why a particular person saw a particular number.
An architecture that sends rows to a hosted model for summarisation fails the first constraint. An architecture that applies permissions after retrieval fails the second, because by then the unauthorised read has already happened. An architecture with no reproducible trace fails the third.
What survives is a layer that compiles the question into governed SQL and runs it where the data already sits. Access rules resolve at compile time, so an answer the caller may not see is never built. The mechanics are in governing AI agents that query enterprise data, and the enforcement detail in fine-grained data access control.
Which regime applies to you
Most confusion here comes from assuming one rule covers the whole group. It usually does not. Work entity by entity.
| If your entity is | Your regime is | Practical deployment consequence |
|---|---|---|
| Mainland UAE, general sector | Federal PDPL | Transfer is possible in principle, but the settled mechanism is not yet published |
| DIFC-licensed | DIFC Law 5 of 2020 (am. Jul 2025) | Federal PDPL does not apply; check the DIFC transfer rules directly |
| ADGM-licensed | ADGM Regulations 2021 | Its own regulator and its own transfer position |
| Healthcare or insurer | Federal Law 2 of 2019, Art 13 | Health records stay in country; in-country processing only |
| Payments or wallet operator | SVF Regulation, Art 10 | Customer data stays in country; in-country processing only |
| Group spanning several of these | All of the above at once | The layer must record which rule applied to which row |
The last row is the one that catches people. A group data platform inherits every regime its entities sit under. Banking groups meet this first, which is why we treated the sector separately in AI analytics for banking.
What to ask a vendor
Four questions separate a real residency story from a marketing one.
Where does the query execute? If the answer involves sending rows to a hosted endpoint, the residency question is already lost for the two mandated categories.
When are permissions applied? Before the plan is built, or after the rows come back. Only the first prevents the unauthorised read, a distinction we unpack in data authorization.
Can you reproduce this answer in twelve months? Regulators ask retrospectively. A system that cannot replay the exact query and policy state as of the original date cannot answer them.
What exactly compiles the SQL? A model that guesses a join path is a different risk profile from a compiler that proves one. That difference is the subject of what is a semantic compiler, and the underlying concept in what a semantic layer is.
Where Colrows fits in the region, honestly
Colrows runs on-premise and in a private VPC, which is the deployment that satisfies a residency mandate. The semantic execution layer compiles intent into dialect-perfect SQL, proves the join path, and applies role, row and column rules before execution. Every answer reproduces point-in-time.
Our commercial presence in the UAE is in Dubai. Regional distribution runs through Redington, the largest IT distributor in the Middle East and Africa, alongside evanssion.
What Colrows does not do is make you compliant. It removes one class of risk, the ungoverned query and the unprovable answer. Data classification, licence conditions, and your regulator relationship stay yours. Any vendor claiming more than that is selling the wrong thing.
If you are scoping a deployment against one of these regimes, talk to us about the on-premise option.
A note on the claims
We take the legal positions here from the published instruments and from DLA Piper's data protection reference: Federal Decree-Law No. 45 of 2021; Article 13 of Federal Law No. 2 of 2019 with Ministerial Decision No. 51 of 2021; Article 10 of the Stored Value Facilities Regulation; DIFC Data Protection Law No. 5 of 2020 as amended July 2025; and the ADGM Data Protection Regulations 2021.
Strategy objectives come from the UAE Artificial Intelligence Office.
Two points we deliberately leave out. Some commentary states that transfers from DIFC to mainland UAE count as cross-border, because the mainland is absent from the free zone adequacy lists. That is plausible and consequential, but we could not confirm it in a primary source, so we do not rely on it. We also omit the AED figures often quoted for the strategy's economic impact, which we could not trace to an official publication.
This page is not legal advice. Confirm your own position with UAE counsel before making an architecture commitment.
Frequently asked questions
Can enterprise data leave the UAE for AI processing?
It depends on the sector and the free zone. Under the federal PDPL, data may move to countries the UAE Data Office recognises as adequate. Standard contractual clauses or binding corporate rules cover the rest. The complication is that the UAE Data Office has not yet published an adequacy list, and the Executive Regulations defining transfer mechanisms were still unpublished as of January 2025. Two sectors are stricter and allow no transfer at all.
Which UAE data cannot leave the country at all?
Two categories carry hard residency mandates. Health information falls under Article 13 of Federal Law No. 2 of 2019 on ICT in health fields. That article prohibits transfer outside the UAE. Federal Ministerial Decision No. 51 of 2021 sets the only exception. Separately, Article 10 of the Central Bank Stored Value Facilities Regulation requires customer data to remain in the UAE. For these, offshore AI processing is not a policy choice.
Does the federal PDPL apply inside DIFC and ADGM?
No. The PDPL leaves the financial free zone regimes intact. Entities in the Dubai International Financial Centre follow DIFC Data Protection Law No. 5 of 2020, amended in July 2025. Entities in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021. If you operate in both a free zone and the mainland, more than one regime applies at once. Your AI architecture has to satisfy each.
What does the UAE AI Strategy 2031 require of enterprises?
The strategy is a national direction rather than a compliance obligation. Its eight objectives include optimising AI governance and regulations, and providing a data-driven infrastructure to support AI. It signals where regulation is heading. It does not itself impose duties on a private enterprise, so treat it as context for planning rather than a rule to comply with.
How does a semantic execution layer help with UAE data residency?
It moves the governed logic to the data instead of moving the data to the logic. Colrows compiles a natural-language question into SQL that runs inside your own environment, on-premise or in a private VPC. It applies role, row and column rules at compile time. The records never leave the jurisdiction, and every answer leaves a reproducible audit record for the regulator.
