UAE Personal Data Protection Law, Article 4: no processing without the owner's consent, with a closed list of exceptions (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 4)
The base rule is consent: the law forbids processing personal data without the person's consent and lists the exceptions (public interest, legal claims, contract performance, a legal duty, scientific or statistical study and a few others). There is no legitimate-interest ground in the list, and 'processing' is defined to include sharing, disclosing and making data available, so licensing customer or staff records to an AI buyer needs consent unless the data is anonymised or an exception fits. On my reading a paid licence to train a commercial model is not archival, scientific or statistical study. The English text is the UAE Legislation portal's translation.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
“It is prohibited to process Personal Data without the consent of its owner. The following cases shall be excluded from such prohibition: ... 6. If the processing is necessary for archival purposes or for scientific, historical and statistical studies in accordance with the legislation in force in the State.”
- UAE Personal Data Protection Law, Article 5: collect for a specific purpose, no incompatible later use, keep only if anonymised (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 5(2) and 5(7))
- UAE Personal Data Protection Law, Article 1: what personal data is (voice included) and what anonymization means (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Art. 1 (definitions of Personal Data and Anonymization))
- UAE Personal Data Protection Law, Articles 22 and 23: sending personal data outside the UAE (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Arts. 22(1) and 23(1)(a)-(b))
- UAE Personal Data Protection Law, Articles 2(2)(g) and 28: free zones with their own data law are outside, Executive Regulations due within six months (Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data, Arts. 2(2)(g) and 28)
It is shown on its own, not counted into a figure.
Cited in these 2 guides