An AI receptionist processes personal data on every call: a voice, a phone number, often a name, an address and the reason for calling. Which law governs that processing depends mostly on where your business is established, and in the UAE that can mean one of three regimes. This guide compares them with the UK GDPR so you can see what applies and what each expects.
It is general information, not legal advice. Some of these regimes are still developing; check the current position with the regulator or a lawyer.
Which law applies?
- Onshore UAE businesses, including most mainland and many free zone companies, fall under the federal Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021.
- Businesses established in the Dubai International Financial Centre fall under the DIFC Data Protection Law No. 5 of 2020.
- Businesses established in Abu Dhabi Global Market fall under the ADGM Data Protection Regulations 2021.
- UK businesses fall under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
The PDPL leaves the DIFC and ADGM laws intact, and also leaves in place sector rules for health data and banking and credit data. It can also apply to organisations outside the UAE that process the data of people in the UAE, so a UK provider serving UAE callers needs to think about both sides.
The UAE PDPL
The PDPL has applied since 2 January 2022. The government portal summarises its approach: processing personal data without the owner's consent is prohibited, subject to exceptions. Law firms list exceptions including performing a contract with the person, protecting their interests, legal claims and complying with other UAE laws. Unlike the GDPR, the PDPL does not currently include legitimate interests as a lawful basis.
Two parts are still unsettled. The executive regulations that fill in much of the detail had not been issued as of mid-2026, according to law-firm reports, and the PDPL itself does not set penalties, leaving them to a Cabinet decision. In June 2026 the UAE created a Federal Authority for Artificial Intelligence and Data, bringing together the UAE Data Office, the AI Office and TDRA's digital government sector; it is widely expected, but not yet confirmed, to oversee the PDPL.
For an AI receptionist this means: tell callers what happens to their data, make sure you can rely on consent or a listed exception such as handling the caller's own request, and watch for the regulations.
The DIFC
The DIFC Data Protection Law applies to controllers and processors incorporated in the DIFC, wherever they process data, and to others processing personal data in the DIFC as part of stable arrangements. It is enforced by the DIFC Commissioner of Data Protection and is close in structure to the GDPR.
The DIFC also has the region's most specific rule on AI. Regulation 10 of the DIFC Data Protection Regulations, in force since September 2023, covers processing through autonomous and semi-autonomous systems, including AI. Deployers must give users clear and explicit notice when they first use such a system, explaining the technology, its purposes and safeguards. For a DIFC business, an AI receptionist's greeting and privacy notice should be written with this in mind.
ADGM
The ADGM Data Protection Regulations 2021 apply to entities established in ADGM and to processing in the context of their activities. They established an independent Office of Data Protection, which publishes guidance and standard contractual clauses for international transfers. The regime is also closely modelled on the GDPR.
The UK GDPR
UK businesses need a lawful basis for each purpose. For an AI receptionist this is commonly performance of a contract or legitimate interests, with transparency at the point of collection. The 2025 Act replaced the old rules on automated decisions with Articles 22A to 22D, allowing significant automated decisions more widely but with safeguards. The ICO is the regulator, and some of its AI guidance is under review following the Act.
Side by side
| UAE PDPL | DIFC | ADGM | UK GDPR | |
|---|---|---|---|---|
| Applies to | Onshore UAE, plus some processing from abroad | DIFC entities | ADGM entities | UK establishments, plus some from abroad |
| Regulator | Not yet unambiguously designated | Commissioner of Data Protection | Office of Data Protection | ICO |
| Lawful bases | Consent by default, with listed exceptions | GDPR-style bases | GDPR-style bases | Six bases, including legitimate interests |
| AI-specific rule | None binding found | Regulation 10 on autonomous systems | None specific found | Articles 22A–22D on automated decisions |
| Status | In force; regulations pending | In force | In force | In force; amended 2025 |
What to put in place, whichever applies
- A clear greeting. Callers should know they are speaking with an AI assistant and whether the call is recorded or transcribed.
- A privacy notice covering purposes, legal basis, retention, recipients, transfers and rights.
- A processing agreement with your AI provider, which is usually your processor.
- Known data locations. Ask where audio and transcripts are processed and stored, and what safeguards cover transfers out of the UAE or the UK.
- No surprise training. Confirm whether your call data is used to train models.
- Minimisation and retention. Collect only what the call needs and delete it on schedule.
- Human review for anything consequential.
See also recording customer calls in the UAE and UK.
Sources and further reading
Hear Clodia for yourself.
Try a live conversation in your browser, or tell us about your front desk.