If an AI agent in the UAE records, transcribes and stores your customers' calls, the UAE PDPL is the first data law to check. The PDPL is the country's federal personal data protection law. Businesses in the DIFC and ADGM financial free zones follow their own data protection rules instead, so the answer depends on where your company is registered and who decides why the calls are kept.
The UAE PDPL is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. It is the starting point for mainland businesses. DIFC and ADGM have their own data protection regimes. A recorded, transcribed AI call is personal data, so you need a clear purpose, a notice to callers, and a plan for where the data is kept.
Which law applies to your calls
The first question is where the company running the calls is registered and operates. Each regime has its own law and its own regulator.
| Where your business operates | Rules to check | Official note |
|---|---|---|
| Mainland UAE | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data | Read the official text on the UAE legislation portal |
| DIFC | DIFC Data Protection Law, DIFC Law No. 5 of 2020 | Supervised by the DIFC Commissioner of Data Protection |
| ADGM | ADGM Data Protection Regulations 2021 | Supervised by the ADGM Office of Data Protection. ADGM-registered entities that process personal data must register as a data controller |
The company that decides why calls are recorded is the one to check first. If a free zone company runs the agent, read its free zone rules before the mainland law. If a mainland company runs the agent for a free zone client, ask counsel which regime applies to each party.
What makes an AI call personal data
A call that identifies a person creates personal data. So does a recording, a transcript, a summary and a booking that carries a name or phone number. The data does not need to be dramatic to count. For example, a property developer running an off-plan launch line records enquiries from buyers in Dubai, Abu Dhabi and abroad. The transcripts list names, budgets, phone numbers and the areas each buyer wants. That is personal data, and it needs a plan from the first call. Even a first name becomes personal data once it is linked to a phone number, a booking or a case.
AI adds steps that a human call does not. Audio goes to a speech service, text goes to a language model, and a summary is written to your system. Each step handles personal data, so each one belongs in your check.
Purpose, notice and consent
Before you rely on consent, decide and write down why you record and transcribe. A common approach is to tell every caller at the start of the call that it is recorded, why, how long it is kept, and how to ask questions or object. Keep evidence that the notice was given, such as the script version and the date it changed.
Treat this as practice to take to counsel, not as a statement of what the PDPL requires in your case. The notice should be short and spoken clearly, so that a caller can hear it in the first few seconds. A notice that plays only on the main route is not enough. Check that it also plays on call-backs, transfers and any outbound calls the agent makes.
The agent must also be honest about what it is. If a caller asks whether they are speaking to a person, it says it is an AI assistant. It should never deny this.
Where the data is stored and who can see it
Residency is one of the first things a buyer asks about, and it is also one of the easiest to answer vaguely. Ask your vendor for a written answer to these questions:
- Where are recordings, transcripts and summaries stored, and where are the backups?
- Which staff at the vendor can open them, and why?
- How long are they kept, and can you change that period?
- How is a recording deleted when a customer asks for it?
- Are logs kept of who opened a recording or transcript, and for how long?
VoiFlow is hosted in-region, with local numbers and voices. Ask for the detail in writing, and read what the company publishes on the trust page before you decide.
Cross-border transfers and other processors
Most AI calls rely on more than one service: a telephony carrier, speech recognition, a language model, and a storage provider. Each one may process personal data, and some may sit outside the UAE. Ask for the full list of processors and the country where each one processes data, in writing.
If any step runs outside the UAE, record the reason and check it with counsel before go-live. Free zone rules can differ from the federal law, so check them too. Do not assume that a vendor's home country sets the rule for your calls.
Mistakes to avoid
Most problems with recorded calls come from habits rather than bad intent. Watch for these:
- Reusing a recording for a new purpose. A call recorded for quality checks should not quietly feed a marketing list unless the caller was told that and the purpose is covered.
- Forgetting the summary. The AI's summary of a call is personal data too, and it often travels further than the recording, into a CRM or an email.
- Keeping everything forever. Storage feels cheap, but every extra month is another month of exposure if there is a leak or a dispute.
- Assuming one rulebook. A company in a free zone and a company on the mainland may need different answers, even if they share a brand.
- Opening access to everyone. A transcript that any staff member can search is a transcript that anyone can misuse.
Each of these is easy to fix before launch and hard to unpick afterwards.
A practical checklist
Use this list as a starting point for the conversation with counsel:
- Name the regime that applies to each company that runs the calls.
- Write down the purpose of recording and transcription.
- Play a recording notice at the start of every call.
- Set a retention period for recordings, transcripts and summaries.
- Limit access to named roles, and log who opens a record.
- Get the list of every processor and where each one processes data, in writing.
- Set up a way for people to ask what you hold about them and to request deletion.
- Have counsel review the whole set-up before the agent goes live.
How VoiFlow handles this
VoiFlow records, transcribes, scores and replays every call for supervisors, and keeps permissions, limits, consent, redaction and an audit trail outside the language model. Customer data is never used to train models. Read never trained on your data for the detail, and use the AI voice agent security checklist to ask any vendor the same questions.
What to do next
Write down the purpose, the notice and the retention period for your calls, then take that page to your counsel. Once the answers are clear, try a call to hear the recording notice and the handover, or contact us to talk through your set-up. For the wording of your public privacy notice, see the privacy policy.
Frequently asked questions
Is the UAE PDPL the same as the DIFC and ADGM rules?
No. The federal law is separate. DIFC has its own Data Protection Law, DIFC Law No. 5 of 2020, and ADGM has its own Data Protection Regulations 2021. Check which regime applies to the company that runs your calls.
Do I need to tell callers that a call is recorded?
Treat it as required. Say at the start of the call that it is recorded and why. Take the exact requirement for your business to counsel, because it depends on your sector and how you use the recording.
Can an AI agent keep call transcripts?
Yes, if you have a clear purpose, a retention period and access controls. Set how long transcripts are kept, and delete them when the purpose ends or when a valid request requires it.
What if a customer asks what you hold about them?
Have a written process before go-live. It should say who receives the request, how the caller's identity is checked, where the transcripts and summaries are searched, and who decides what can be shared. Counsel should confirm the response period and any exceptions that apply to your entity.
Does the PDPL apply to my AI vendor?
Ask the vendor to set out in writing its role in processing your call data, what it can do with that data and where it processes it. Your counsel can then decide which contract terms you need.
This is general information, not legal advice.
