Data Bytes: Data, Cyber and AI Law, Regulation and Enforcement in the UAE

Rhiannon Webster:
Hello, I'm Rhiannon Webster, a partner in Ashurst Perkins Coie technology team. Welcome to our new season of Data Bytes and our first since becoming Ashurst Perkins Coie. In our first season last year, we stayed local and did some deep dives into the UK's new Data Use and Access Act. If you're still interested, you can find that six-part series on the Ashurst Legal Outlook podcast channel. In this new season, we'll be looking at things much more globally and are kicking off the season with an introduction to our UAE data team and a dive into the data, cyber and AI legal landscape in the UAE and surrounding region. The topic of this podcast is brought to you by popular demand, following a spotlight article that the team wrote on the UAE data protection regime that we published over the summer as part of our monthly Data Bytes newsletter. On that note, minor plug for our Data Bytes newsletter, which you can subscribe to via my profile on LinkedIn or by contacting any member of the Data Bytes team.

Shortly going to hand over the reins to Tom Brookes, a senior associate in our London team to do the interview. But in the meantime, Alex, Emma, please introduce yourselves.

Alex Brazeau:
Thanks very much, Rhiannon. We are absolutely delighted to be joining the UAE edition of the Data Bytes Podcast. My name is Alex Brazeau. I am a technology partner based in Dubai. I've been practicing in the region for over 12 years now and joined Ashurst Perkins Coie in February of this year. Our technology practice covers digital transformation, helping clients who are developing technology, procuring technology, or using technology in the context of their digital transformation projects. A big part of our practice is focused on data privacy and data governance. All tech projects involve questions about data, so what information is being collected, how is it going to be used, who can access it, and where will it go. So a lot of the work that we do with our clients involve developing their privacy programs, negotiating data processing and sharing arrangements, advising clients on cross-border data flows. We do some product counselling, and of course, we step in when things go wrong, and that's when I would hand over to my disputes colleague, Emma.

Emma Tormey:
Thanks, Alex. I'm Emma Tormey, a partner in the dispute resolution practice at Ashurst Perkins Coie based in Dubai where I've been based for almost 10 years, and I focus on commercial disputes, and that includes acting for large tech companies. I spend a lot of my time helping clients navigate enforcement and regulatory risk in the data and digital space, which as you'll hear is a rapidly growing area in our part of the world.

Tom Brookes:
Thanks very much, Emma and Alex. It's great to be here with you both today. So we've got three key topics on the agenda. Firstly, we're going to talk about the UAE's evolving data protection and privacy landscape. Then we're going to look at how the regional conflict is impacting cyber risk for businesses operating in the Middle East. And finally, we're going to wrap up by talking about data sovereignty in the UAE. So onto our first topic. Alex, you mentioned you've been practicing in the region for 12 years now. From the perspective of the UAE's onshore regime, what did the UAE start with and what kind of changes have taken place?

Alex Brazeau:
Yeah, thanks, Tom. The landscape has changed quite a lot. I remember when I first moved out to the region, we were giving client trainings or advising on privacy. We would describe the landscape as a patchwork of privacy legislation. So small provisions would be included in various pieces of legislation, whether that's the constitution, criminal law, cybercrime legislation, or certain-sector-specific rules, and we would package that into privacy advice, but there was really no sort of harmonized federal framework. That changed in 2021 with the issuance of law number 45 on the protection of personal data, which we refer to as the PDPL, which really introduced a broader framework for how organizations can collect, use, protect, and share personal data. This was very welcome, especially for our client base and businesses because it gave them a common starting point in terms of privacy governance, a clear organizational responsibilities, and really I'd say a basis for how to build their own compliance programs.

This was particularly helpful also for our international clients because a lot of the concepts in the PDPL were quite similar to those in the privacy frameworks in their home jurisdictions. So concepts like controllers and processors, data transfers, impact assessments, and data subject rights analogous to what they had in their own jurisdictions. That was in 2021. There's been a bit of an implementation gap, I'd say, onshore since the PDPL was issued. They were meant to issue implementing regulations six months after the law came into effect, as well as established a data office. Those implementation regulations have not yet been issued, and as we understand it, the data office is still not operational. That does not mean that clients have not been complying with the PDPL or that we have been advising clients that there's no enforcement, it's just left a bit of a grey area or question marks in terms of the applicability of certain provisions in the PDPL or enforcement actions of a regulator similar to what you'd see in other jurisdictions.

Tom Brookes:
Okay, thanks. Thanks, Alex. And you mentioned there about enforcement, so maybe we bring Emma in on this topic. What does this potential gap in enforcement actually mean in practice?

Emma Tormey:
Yeah, in practice it's meant that on the onshore mainland of the UAE, there's been very limited regulatory action on data protection since the introduction of our legislative regime, and businesses have largely been left to self-assess. And that's quite different from what you see in our Free Zones in the UAE where there has been real enforcement action and the regulators starting to flex their enforcement muscle. And that contrast is quite important. While the onshore regime was finding its feet and still continues to do so, the two big financial Free Zones, so the DIFC in Dubai where I sit, and the ADGM down in Abu Dhabi, they were building genuinely mature data protection frameworks of their own, including, for example, a world-first AI-specific data protection instrument, which was introduced in the DIFC in 2025.

Tom Brookes:
Okay. And when we get into this topic of enforcement, you've focused there on the DIFC and the Abu Dhabi global market. Can we just explain for the listeners, what does that enforcement really look like in those two Free Zones?

Emma Tormey:
Yeah, sure. So in the DIFC, the commissioner can impose fines ranging from as little as 10,000 US to 100,000 US for data protection contraventions. The position is a little bit different in the ADTM. The commissioner of data protection can impose fines of up to 28 million US, so that's a very high ceiling. Both regulators in both Free Zones have actively been issuing enforcement decisions over the last few years. In the ADGM, the commissioner has imposed fines for, for example, failing to comply with a data subjects access request, and other regulated entities have recently received formal directions for data security deficiencies caused by poor cybersecurity practices, inadequate training, and just generally a lack of proper policies.

Whereas on the DIFC side, the commissioner's office has been ramping up significantly also. It issued over 270 administrative fine decision notices in 2025 alone. That was up by about 65 the year before, alongside multiple investigation-based decision notices. And in 2025 in the DIFC, thematic assessments carried out by our regulator resulted in almost 250 fines for entities that just simply failed to respond. So really the takeaway here is the enforcement infrastructure in the Free Zones is operational and growing. And I would say that the DIFC's 2025 amendments, which give data subjects a direct private right of action, which means that they can go straight to the DIFC courts without going to the commissioner first, is a significant development for litigation risk.

Alex Brazeau:
If I could just jump in on what Emma said. In terms of the DIFC, the commission's office is very active, not only in enforcement, but they've been incredibly helpful in developing practical guidance for registered entities in terms of developing their own privacy compliance programmes. They've released supporting regulations, they have online tools for how to react if any entities suffer a breach, and that's really helped foster a sense of trust in terms of doing business with DIFC-registered entities and a lot of clarity in terms of how those entities can establish, for example, cross-border data flows.

Tom Brookes:
That's great to hear, Alex, and clearly there's an evolving picture here from an enforcement perspective. Often our clients are operating globally. So Emma, it'd be good to hear your views on how the enforcement picture you're seeing in the UAE and specifically in the Free Zones is comparing with other jurisdictions.

Emma Tormey:
Yeah, I think the direction of travel is clear and the expectation is that once the onshore UAE's new federal authority is operational, the onshore enforcement posture will become much more active, and our message to clients is you shouldn't wait for that to happen. But if we compare to other jurisdictions, listeners will be aware that in the UK, the ICO has been increasingly active, particularly on children's data specifically with fines and the tens of millions of pounds being issued for processing children's data. Likewise, in Australia, platforms face fines of up to 50 million Australian dollars under social media minimum age laws. Under the GDPR, we've seen fines running into the hundreds of millions of euros. Quantum-wise, we're not quite there, but I think what we will see is our onshore regulator follow suit and become much more robust.

Alex Brazeau:
And I just wanted to add, Emma's mentioned something really important, which is that we are getting a new federal authority, which is going to be the Artificial Intelligence and Data Authority. This is a very welcome development. It's going to be a consolidation of three existing body, so the AI office, the TDRA's digital government sector, and the UAE data office. The intention of this new authority is to bring data governance, AI development, and digital government under a more coordinated and institutional framework. From what we understand so far, the focus will very much be on setting national policy and developing standards for data and AI in the context of public services. But what I'm hoping, and I think what a lot of privacy practitioners are hoping, is that this will bring progress on the PDPL in terms of finalising the implementing framework and resolving a lot of those unanswered questions in terms of enforcement that we were discussing earlier, and equally to provide some practical guidance on AI adoption, which is front of mind for most of our clients.

Tom Brookes:
Okay, let's take this opportunity to move on to our second topic. Alex, one of the things your team's been focused on this year is cyber risk. What impact has the regional conflict had on the cyber threat landscape for your clients?

Alex Brazeau:
Yeah, thanks, Tom. So there's been a dramatic escalation in terms of the original conflict, which started in February this year, both in terms of physical security, but also cybersecurity. I think the UAE Cybersecurity Council estimates that the UAE is currently getting 600,000 attempts per day in terms of cyber-attacks, which is quite a stark figure. So this has really sharpened the focus on cybersecurity and cyber resilience more generally, especially in the context of critical sectors like financial services, energy, logistics, and healthcare. Exposure extends beyond just stolen personal data, so it can be entire systems going down, information being destroyed, but especially disruption across major supply chains, and that's really a lot of the questions that we're getting from our clients in terms of revisiting not only their own business continuity and disaster recovery programs, but also looking at their contracts, looking at their suppliers, understanding what their suppliers' obligations are in terms of their own business continuity and disaster recovery.

I think clients are increasingly looking at where their data sits and understanding how easily or quickly they can move data or services to reduce their risks and asking themselves, how are we as an organization ready to make decisions quickly?

Tom Brookes:
It sounds like for a lot of clients in the region, it's a question of when as opposed to if they're going to be impacted by one of these cyber incidents. So looking at this from potentially an enforcement perspective as well, Emma, what are you seeing that clients need to be focused on?

Emma Tormey:
Yeah, I think you're right, Tom, and this is something that Alex and I spent a lot of time talking to clients about, particularly recently. And I would say the starting point is recognizing that cyber risk is business risk. It's a boardroom issue, and it really requires a multidisciplinary, multi-team effort. It's not just an IT team issue. And so there's a few things that I would highlight. The first is getting your incident playbooks in line and asking, do you have a documented tested incident response plan that accounts for specific regulatory reporting requirements, for example, because every GCC jurisdiction has different regulators, and taking the UAE, for example, we have multiple regulators in the one country. So the notification timelines and the regulators, they differ across each jurisdiction and then within the jurisdictions differ again, and a single incident can trigger parallel notifications to multiple regulators and authorities.

So your escalation paths to the board need to be documented and tested, not just something that's written down and then put in a cupboard. Second is crisis simulation, and we're seeing an increasing amount of appetite from clients on making sure that they have tried and tested their systems and processes for responding to a cyber incident. So what we're asking our clients is, have you actually run an exercise that models a realistic scenario for this region? And specifically, we're looking at state-sponsored attacks, which is now a dominant threat vector in this part of the world. And I would say that the simulation needs to cover multi-regulator notifications across borders, media handling, which has particular sensitivities in this part of the world, and board-level decision-making under pressure.
And then the third aspect that we're talking to clients about is evidence of controls. So under the new liability regimes in the region, and this includes the DIC's expanded private right of action for distress claims and potential director liability under the commercial company's law, you really need to be able to produce audit ready evidence of implemented controls. Regulators and our courts here will want to see what was actually in place at the time of incident.

And finally, a point that catches a lot of people out is privilege. So in onshore UAE, legal professional privilege as understood in common law jurisdictions is not recognized. So that means that communications with your legal advisors during an incident response cannot necessarily be withheld from disclosure and proceedings or a regulatory investigation. The position is slightly different in the DIC and the ADGM where privilege is recognized, but of course, if you are an entity that operates across both onshore and Free Zone jurisdictions, you really need to structure your approach very carefully from day one of any incident. And so it's worth taking professional advice to understand how that might play out in the event of an incident.

Tom Brookes:
Thanks, Emma. It's really interesting now to hear about some of those local focus areas and those local nuances in terms of how to handle a cyber incident. I think another area where we often see clients having questions about what's happening in the UAE and the region is around data sovereignty. And Alex, I think it'd be good to bring you in on this point. Can you start us off by explaining what is the position in relation to data sovereignty in the UAE?

Alex Brazeau:
Yeah, thanks, Tom. So the UAE's approach to data sovereignty is very much to retain control over sensitive and strategically important data, and one of the ways it achieves that is through targeted data localization requirements. I think there's a misconception, especially for multinational clients that think that all data must be localized in the UAE and that transfers are not permitted, and that's not the case. But for particular sectors, specifically healthcare, financial services, government, there are stricter data localization requirements that clients need to navigate. And I think five or six years ago, that was a really difficult requirement for clients to comply with just because there weren't many local options in terms of hosting and processing the data locally. The UAE's invested quite a lot in local capability in recent years, and you're also seeing a lot of international companies set up in region through strategic partnerships with the UAE government. Microsoft's a big example of that. G42 is another example of a very strong local player.

So in that context, storing your data locally, especially data that's considered critical or sensitive that must be maintained within the UAE becomes a lot easier. That being said, for multinationals doing business in region, it is still possible to have cross-border data flows. You just have to have the right safeguards in place. So a lot of the frameworks that we were discussing earlier, either the onshore frameworks or the DIC framework, for example, will permit cross-border data transfers as long as the right safeguards are in place. And that's a lot of the work that we do with clients is really understanding what data they're hosting or processing, what safeguards are in place, and how they can effectively carry out their contracts or their business within those frameworks.

Tom Brookes:
Thanks very much, Alex. So we've managed to cover a fair amount of ground today. We've started on the general data protection framework. We've moved into cyber and finally finished off in relation to data sovereignty. Alex, have you got any final thoughts you wanted to leave our listeners with?

Alex Brazeau:
Yeah, I wanted to echo what Emma was saying, which is it's really important not to consider these issues in silos. I think as tech practitioners, we're used to dealing with tech teams only, but I think a lot of these issues are important across our clients' businesses, their board level issues, compliance, risk, tech, legal, commercial. So it's really important to have those conversations across teams and make sure that everyone gets a seat at the table in terms of resolving these risks.

Tom Brookes:
Okay. And Emma, anything from you?

Emma Tormey:
From the disputes and enforcement side, Tom, I agree with you that the risk isn't theoretical anymore, particularly in this part of the world, and between the conflict-driven cyber threat landscape, the new enforcement powers that we're seeing develop in this region, and the expanding scope for private claims, businesses really do need to be prepared, not just compliant on paper. They need to be genuinely ready to respond when something goes wrong, and your businesses across the board need to understand what that response process looks like.

Rhiannon Webster:
Thanks so much, Tom, Alex, and Emma for joining me and providing such practical insight. I really enjoyed listening to that, and thank you to our listeners for listening to our podcast. Please do share the podcast with interested colleagues and look out for upcoming podcasts this autumn. Don't forget, this podcast series is a spinoff from our monthly Data Bytes newsletter covering data law insights from across EMEA. You can subscribe to that via my profile on LinkedIn or contact any member of the team. Thank you for listening, and until next time.