ADGM Data Protection Regulations 2021 and AI: What Actually Applies
Last updated: 29 October 2026
Key takeaways
- ADGM has no separate AI regulation, but the ADGM Data Protection Regulations 2021 are technology-neutral and several of their rules apply to AI directly.
- Training a model and using it are two different processing activities, and each needs its own lawful basis.
- Decisions based solely on automated processing are allowed only if necessary for a contract, based on explicit consent or authorised by law, and people must be able to obtain human intervention and contest the decision.
- AI that profiles people or helps make decisions about them usually needs a data protection impact assessment. If a high risk remains, the Commissioner must be notified before processing starts.
- Transfers to AI providers outside the adequacy list need safeguards such as ADGM’s standard contractual clauses. The maximum fine is USD 28 million.
Companies in Abu Dhabi Global Market (ADGM) often ask us for “the ADGM AI rules”. The honest answer surprises them: unlike the DIFC, which has Regulation 10, ADGM has no separate AI regulation, and its Office of Data Protection has not issued guidance dedicated to AI. But this is not a gap. The ADGM Data Protection Regulations 2021 are technology-neutral, and several of their rules apply to AI directly. One of them even mentions AI training by name.
Who is covered
The Regulations were enacted on 11 February 2021 and replaced the 2015 regime. They applied to new entities from 14 August 2021 and to existing ones from 14 February 2022. They cover processing in the context of the activities of a controller’s or processor’s establishment in ADGM, wherever the processing physically takes place. Every ADGM entity that processes personal data must also register with the Office of Data Protection. Registration and annual renewal cost USD 300 each.
A lawful basis for training and for use
The Regulations set out six lawful bases for processing. For AI, the practical point is that training a model and using it are two different processing activities. Data that clients gave you to open an account does not automatically become data you may use to train a model. Each use needs its own basis, and the choice should be documented before the data is used, not after a client complains.
Automated decisions: the core AI rule
The provision that matters most for AI is the right not to be subject to a decision based solely on automated processing, including profiling. Such decisions are allowed only if they are necessary for a contract with the person, based on their explicit consent or authorised by law. Even then, the controller must at least give the person the right to obtain human intervention, to express their view and to contest the decision. Where special categories of data, such as health data, are involved, the bar is higher: explicit consent or a substantial public interest.
Two practical consequences follow. First, “human in the loop” has to be real. A reviewer who approves every output without the time or authority to change it does not turn an automated decision into a human one. Second, your privacy notice must tell people that automated decision-making, including profiling, takes place
An impact assessment before launch
Before processing that is likely to result in a high risk to individuals, the controller must carry out a data protection impact assessment. ADGM’s guidance gives examples that fit most AI use cases: using profiling, automated decision-making or special category data to help make decisions, and profiling on a large scale. If a high risk remains after the mitigation measures, the controller must notify the Commissioner of Data Protection before starting the processing. This prior notification is the step that companies most often miss.
The AI training exception
Normally, personal data must be deleted or anonymised once it is no longer needed. According to ADGM’s guidance, the Regulations make an exception for data that forms part of a dataset used to lawfully train or refine an AI system, where it is used in a way that does not present risks to people’s rights, and an impact assessment is required first. This is one of the few explicit references to AI training in a data protection law in the region. But it is not a blank cheque: it allows you to keep data that was lawfully used for training, not to collect data for training without a lawful basis.
DPO, records and vendor contracts
A data protection officer is required where the core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special categories of data, and the appointment must be notified to the Commissioner within one month. Controllers must also keep written records of processing and have a written contract with every processor. For AI, this means a proper data processing agreement with each model or platform provider, not just acceptance of its standard terms of service.
Sending data to AI providers abroad
Most AI models are hosted outside the UAE. Data can be transferred without additional safeguards only to jurisdictions on ADGM’s adequacy list, which includes the EEA, the UK, Switzerland, Japan, South Korea and the DIFC. The United States is on the list only for organisations certified under the EU-U.S. Data Privacy Framework. If your model provider is in the US and not certified, you will need another safeguard, such as ADGM’s standard contractual clauses. Check this for every AI tool your teams use, including tools they signed up for on their own.
Breaches and fines
A personal data breach must be reported to the Commissioner without undue delay and, where feasible, within 72 hours. The maximum fine under the Regulations is USD 28 million. The Commissioner does use these powers: in May 2024, it published a penalty notice against a healthcare technology company for breaches of the Regulations.
What we recommend
- Check that your entity is registered with the Office of Data Protection and that the registration describes your AI use.
- List every AI use that involves personal data, and document the lawful basis for training and for use separately.
- Run an impact assessment for any AI that profiles people or helps make decisions about them, and notify the Commissioner if a high risk remains.
- Make human review meaningful, and give people a simple way to contest automated decisions.
- Check where each AI provider processes data and put the right transfer safeguards and contracts in place.
The bottom line
ADGM does not need a separate AI law for AI to be regulated there: the Data Protection Regulations already cover automated decisions, impact assessments, training data and transfers to AI providers. For most companies, the gap is not in the law but in their documents. AMLzone can help you map your AI uses against the Regulations and close these gaps before the Commissioner asks.
Sources
1. ADGM Office of Data Protection, Guidance. https://www.adgm.com/operating-in-adgm/office-of-data-protection/guidance
2. ADGM, “ADGM enacts its new Data Protection Regulations 2021”, February 2021; ADGM, Overview of the ADGM Data Protection Regulations 2021. https://www.adgm.com/media/announcements/adgm-enacts-its-new-data-protection-regulations-2021
3. ADGM, Guidance on the Data Protection Regulations 2021, Part 1, para 3.5. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+1.pdf/b65534b2595411ef82c5a27efcbde115
4. ADGM Office of Data Protection, Fees. https://www.adgm.com/operating-in-adgm/office-of-data-protection/fee-sections
5. ADGM, Guidance on the Data Protection Regulations 2021, Part 1. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+1.pdf/b65534b2595411ef82c5a27efcbde115
6. ADGM, Guidance on the Data Protection Regulations 2021, Part 2, chapter 10. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+2.pdf/4dfcd0f4595511ef8933e27828504259
7. ADGM, Guidance on the Data Protection Regulations 2021, Part 3, para 4.5. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+3.pdf/12ba12da595611ef894152361f6b9c5e
8. ADGM, Guidance on the Data Protection Regulations 2021, Part 4. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+4.pdf/63de087e595611ef8e065eb4feb71eb0
9. ADGM, Guidance on the Data Protection Regulations 2021, Part 4, para 3.1. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+4.pdf/63de087e595611ef8e065eb4feb71eb0
10. ADGM, Guidance on the Data Protection Regulations 2021, Part 3, chapter 5. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+3.pdf/12ba12da595611ef894152361f6b9c5e
11. ADGM Office of Data Protection, Adequate Jurisdictions. https://www.adgm.com/operating-in-adgm/office-of-data-protection/jurisdictions
12. ADGM Office of Data Protection, Guidance (Standard Contractual Clauses). https://www.adgm.com/operating-in-adgm/office-of-data-protection/guidance
13. ADGM, Guidance on the Data Protection Regulations 2021, Part 5, para 4.3. https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+5.pdf/fe422242595611efaa55be162688b39c
14. ADGM Office of Data Protection, Penalties of Non-compliance. https://assets.adgm.com/download/assets/ADGM+-+Penalties+of+Non-compliance+(Infographic).pdf/07c1a10858a811efb9d15e7c57113ad4
15. ADGM Commissioner of Data Protection, Penalty Notice No. 1 of 2024, 21 May 2024. https://assets.adgm.com/download/assets/Penalty+Notice+1+2024+Okado+Technologies+Limited+Redacted.pdf/a9a4417a7fb711ef9671ae2bd63eadfa
29.10.2026
