ADGM Data Protection and AI: What Applies to Your AI Systems in Abu Dhabi Global Market
ADGM has no standalone AI regulation, but its Data Protection Regulations 2021 already cover the core of AI use: profiling, automated decisions, impact assessments and controller registration.
9+ Years of Compliance Expertise
End-to-End Execution
ADGM regulates AI through its Data Protection Regulations 2021, enforced by the ADGM Office of Data Protection. Unlike the DIFC, which has a dedicated regulation for autonomous systems, ADGM has no AI-specific equivalent: AI systems are covered by the general data protection rules. Every ADGM-registered entity that processes personal data must register as a Data Controller. The rules most relevant to AI are those on automated individual decision-making, including profiling, and on Data Protection Impact Assessments (DPIAs). Processing counts as high-risk if it involves, among other criteria, a systematic and extensive evaluation of individuals based on automated processing, or the adoption of new technologies that materially increase risk. High-risk processing requires a DPIA before it begins.
Why This Matters
Many AI use cases meet the regulations' definition of high-risk processing: profiling-based evaluation, new technologies and special category data.
A DPIA must be completed before high-risk processing starts, and if it shows a high risk, the regulator must be notified.
The absence of an AI-specific rule does not mean the absence of obligations. The general rules already apply to AI-driven processing.
The Office of Data Protection publishes notices and directions on contraventions, so enforcement is visible.
Firms authorised by the FSRA face additional governance and operational resilience expectations on top of data protection rules.
What's Included
Check of Data Controller registration status and record of processing activities (ROPA)
Inventory of AI systems processing personal data in ADGM
DPIAs for AI-driven processing, including analysis of whether the regulator must be notified
Procedures and notices for automated decisions and profiling
Data subject rights process, including objections to automated decisions
Review of vendor and processor agreements and cross-border transfers
Data Protection Officer advisory where processing is high-risk
Question 1 of 8
Check Your AI Compliance Score
Frequently Asked Questions
No. ADGM has no AI-specific equivalent to the DIFC's Regulation 10. AI systems that process personal data are covered by the ADGM Data Protection Regulations 2021, and FSRA rules apply to authorised firms.
ADGM entities follow the ADGM Data Protection Regulations 2021. The federal PDPL does not apply to processing governed exclusively by the DIFC or ADGM regimes. A company that also processes data outside ADGM may face obligations under more than one regime.
Processing is high-risk if one or more criteria are met: a considerable volume of data, a likely high risk to individuals' rights, systematic and extensive automated evaluation including profiling with significant effects, the adoption of new technologies that materially increase risk, or processing of special category data.
Yes, before any high-risk processing begins. If the DPIA shows a likely high risk, the regulator must be notified. The Office of Data Protection publishes guidance on how to conduct a DPIA.
The regulations contain rules on automated individual decision-making, including profiling, and give individuals rights in relation to automated decisions that significantly affect them. Organisations using AI for such decisions should have a process for handling these requests.
Yes. All ADGM-registered entities that process personal data are required to register as a Data Controller.
Related
Not sure whether your AI systems count as high-risk in ADGM?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.