Can a UAE Company Put Customer Data into ChatGPT under the PDPL?

# Short answer Yes. A UAE company can put customer data into ChatGPT in most cases, but compliance is not automatic. You must align the use with Federal Decree-Law No. 45 of 2021 (the PDPL) by controlling three variables: the commercial plan tier, the physical region that processes and stores tokens, and the contractual terms with the AI vendor.

# What matters under the PDPL PDPL establishes a concrete statutory framework for any processing of personal data. When you consider feeding customer files to a large language model, five requirements matter practically:

• Data minimisation and retention (Article 5). Only data adequate and strictly necessary for the stated purpose may be processed. Prompt logs, chat histories, and any server-side retention must be treated like other records and deleted or rendered non-identifiable when the purpose ends.

• Processor selection and contractual controls (Article 7(5)). If you send personal data to a cloud model, your company is the Controller and the vendor is the Processor. Controllers must appoint only processors offering sufficient technical and organisational guarantees. The vendor's enterprise terms and Data Processing Addendum (DPA) are the concrete documents that document those guarantees.

• DPIAs and DPOs (Articles 10 and 21). Deploying modern technologies that create high risk—such as profiling or large-scale automated processing—triggers a Data Protection Impact Assessment. A DPO must be appointed where processing involves cutting-edge technologies with systemic privacy risk or large-scale sensitive data.

# Operational levers: plan tier, residency, contract OpenAI began offering UAE data residency on 25 November 2025 for ChatGPT Enterprise, ChatGPT Edu, and its direct API platform. That removes the main data-sovereignty hurdle for mainland businesses that want in-region inference and storage. But residency alone is not sufficient. You must:

• Verify the plan tier provides in-region inference and contractual assurances you need.
• Ensure the signed DPA and terms expressly address security, retention, redaction, human review, and any sub-processor chains.
• Run a DPIA and appoint a DPO if processing falls into PDPL's high-risk categories.

# Practical examples

• Lawful: Summarising a client's tenancy dispute file to draft a response where the processing is necessary to perform the contract with that client.
• Likely not lawful without consent: Feeding consumer purchase histories into an LLM to build behavioural profiles for marketing.

# Jurisdictional caveats Financial free zones with independent frameworks—DIFC and ADGM—are governed by their own data protection laws. Their compliance obligations around vendor selection, processing regions, and transfers resemble the federal rules but sit in those separate regimes.

# Enforcement and penalties Regional guides sometimes cite fines "up to AED 5 million." That specific figure does not appear in a traced gazetted cabinet instrument in the supplied text. The immediately binding obligations are the PDPL's statutory provisions described above.

# Bottom line Don't rely on a tool's brand or homepage claims. Build an operational playbook that sets the lawful basis, minimises data in prompts, ensures UAE residency where needed, signs a robust DPA, runs DPIAs, and appoints a DPO when PDPL criteria require it.