ADGM AI Regulation Guide: Data Protection and AI Governance in Abu Dhabi's Free Zone

ADGM: A separate jurisdiction within Abu Dhabi

The Abu Dhabi Global Market is a financial free zone established by UAE Federal Decree No. 15 of 2013 on Al Maryah Island. It has its own civil and commercial legal system based on English common law, administered by the ADGM Courts and regulated by the Financial Services Regulatory Authority (FSRA) and the Registration Authority (RA).

Critically, UAE federal laws generally do not apply within ADGM unless the ADGM has specifically adopted them. This means the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) does not apply to companies registered in ADGM. Instead, the ADGM Data Protection Regulations 2021 (DPR 2021) govern personal data processing.

ADGM Data Protection Regulations 2021

The ADGM DPR 2021 replaced the earlier 2015 framework. It was designed to align closely with the EU General Data Protection Regulation (GDPR) while reflecting the ADGM's common law environment. The regulations are enforced by the Commissioner of Data Protection, via the ADGM Office of Data Protection.

Six lawful bases for processing

Like GDPR, ADGM DPR 2021 requires a lawful basis for processing personal data. For AI systems, the most relevant bases are:

• Consent: Freely given, specific, informed, and unambiguous. Cannot be bundled with general terms. AI systems relying on consent must offer genuine withdrawal.
• Legitimate interests: Processing necessary for the legitimate interests of the controller or a third party, subject to a balancing test against data subject rights. Most AI analytics and recommendation systems will rely on this basis.
• Contract: Processing necessary to perform a contract with the data subject. Credit scoring and underwriting AI often rely on this.
• Legal obligation: Where processing is required by law (e.g. AML checks).
• Vital interests and public interest are available in limited circumstances.

Special categories of personal data

ADGM DPR 2021 defines special categories (equivalent to GDPR Article 9 sensitive data): health data, biometric data used for identification, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, and criminal convictions.

AI systems that process these categories (healthcare AI, facial recognition, HR screening tools) require explicit consent or one of the specific derogations in Schedule 1 of the DPR 2021. The bar is higher than for ordinary personal data.

Automated decision-making under ADGM DPR 2021

This is where ADGM DPR 2021 is most relevant for AI systems. Regulation 20 of the DPR 2021 creates rights around automated individual decision-making, closely mirroring GDPR Article 22.

What triggers Regulation 20

Regulation 20 applies when a decision is made about an individual that:

• Is based solely on automated processing (including profiling), and
• Produces a legal or similarly significant effect on the individual

Examples: automated loan rejection, automated employment screening that results in no interview, automated insurance premium calculation that prices someone out of coverage, algorithmic content moderation that permanently bans an account.

The default prohibition

Regulation 20(1) prohibits such decisions unless one of three conditions is met:

1. The decision is necessary for a contract with the data subject
2. The decision is authorised by ADGM law (e.g. regulatory AML scoring)
3. The data subject has given explicit consent

Safeguards that must accompany permitted automated decisions

Even where one of the three conditions is met, the controller must:

• Inform the data subject that an automated decision has been made
• Provide meaningful information about the logic involved
• Allow the data subject to request human review of the decision
• Allow the data subject to contest the decision
• Not rely solely on automated means for decisions involving special category data, unless explicit consent is obtained

Data Protection Impact Assessments in ADGM

Regulation 27 of ADGM DPR 2021 requires a Data Protection Impact Assessment (DPIA) before processing that is likely to result in high risk to individuals. For AI systems, a DPIA is required where the system:

• Carries out systematic and extensive profiling with significant effects (Regulation 27(3)(a))
• Processes special category data on a large scale (Regulation 27(3)(b))
• Involves systematic monitoring of publicly accessible areas on a large scale

In practice: any AI system that profiles individuals for lending, employment, insurance, or access to services should have a DPIA before deployment. The DPIA must assess necessity and proportionality, risks and mitigations, and safeguards.

Data breach notification

ADGM DPR 2021 Regulation 25 requires notification to the Commissioner of Data Protection within 72 hoursof becoming aware of a personal data breach that is likely to result in a risk to individuals. If the breach is likely to result in high risk, affected individuals must also be notified without undue delay.

For AI systems with access to large datasets, an incident response plan with pre-drafted Commissioner-of-Data-Protection notification templates is not optional — it is prudent compliance.

ADGM and the UAE AI Governance Framework

The UAE Government's National AI Governance Framework (published by the Digital Government Authority, TDRA) is a mandatory framework for UAE federal government entities and recommended guidance for private sector entities. Since ADGM has its own government, ADGM entities are not directly bound by TDRA guidance — but many ADGM-regulated firms apply it voluntarily to demonstrate governance quality to international counterparties and investors.

The FSRA (Financial Services Regulatory Authority within ADGM) has also published guidance on responsible use of AI in financial services, covering model risk management, algorithmic trading, and AI-powered client advice. Firms regulated by the FSRA should review this guidance separately from the DPR 2021 data protection framework.

Cross-border data transfers from ADGM

Regulation 23 of ADGM DPR 2021 restricts transfers of personal data to countries outside ADGM unless an adequate level of protection is ensured. Adequate protection can be established via:

• Transfer to a country on the ADGM's adequacy list (includes EU/EEA, UK)
• Use of standard contractual clauses approved by the Commissioner of Data Protection
• Binding corporate rules for intra-group transfers
• Explicit consent of the data subject for specific transfers

For AI systems processing ADGM-resident personal data in cloud infrastructure outside ADGM (e.g. a US-region AWS instance), a data transfer mechanism must be in place.

Practical compliance checklist for AI teams in ADGM

• ☐ Map all personal data processed by your AI system — categories, volumes, purposes
• ☐ Identify the lawful basis for each processing activity
• ☐ Conduct DPIA for any AI involving profiling, special categories, or large-scale monitoring
• ☐ For automated decision-making: document the lawful basis, implement human review mechanism, prepare explanation template for data subjects
• ☐ Update privacy notice to disclose AI/automated decision-making
• ☐ Map cross-border data flows and put appropriate transfer mechanisms in place
• ☐ Prepare incident response plan with 72-hour Commissioner-of-Data-Protection notification template
• ☐ Appoint a Data Protection Officer if processing special categories on a large scale or carrying out systematic monitoring
• ☐ Register with the ADGM Office of Data Protection (registration required for controllers under certain conditions)

How ADGM compares to DIFC and UAE federal PDPL

When you need to comply with both ADGM DPR and EU AI Act

ADGM-registered companies that offer AI systems to EU users or process data of EU residents must also comply with the EU AI Act. The EU AI Act applies based on where the outputof the AI system is used — not where the company is registered. An ADGM fintech offering automated credit decisions to EU residents is subject to both:

• ADGM DPR 2021 (as the controller's registered territory)
• EU AI Act (as the deployer offering the system in the EU market)
• GDPR (if processing EU residents' personal data — territorial scope applies)