Data Regulation in the AI Era: A Comparison of Korean and UAE Data Protection Laws

12 min 24 sec October 20, 2026 (Edited)

Written by

Jiwon Ha

Legal Director, Korea Group

j.ha@tamimi.com View LinkedIn Profile

As artificial intelligence, cloud computing, and fintech continue to develop rapidly, personal data has become more than simply information that needs to be protected; it has become a key asset in the digital economy. Accordingly, the effectiveness of a data protection regime is increasingly measured not only by how strongly it protects personal data, but also by whether it safeguards the rights of data subjects while enabling businesses to use and transfer data across borders in a lawful and predictable manner.

Korea and the United Arab Emirates (UAE) provide an interesting comparison in this respect.

Since enacting the Personal Information Protection Act (PIPA) in 2011, Korea has developed a comprehensive data protection framework covering both the public and private sectors. In particular, following a series of major data breaches in 2025, including the SK Telecom incident and the large-scale Coupang breach affecting approx. 33.7 million customer accounts , Korea has continued to strengthen corporate accountability and the rights of data subjects.

Meanwhile, the UAE enacted its federal Personal Data Protection Law (Federal Decree Law No. 45 of 2021; the PDPL) in September 2021, which came into force in 2 January 2022. Although the UAE’s federal data protection regime is relatively recent, data protection is becoming increasingly important as the country positions AI and cloud-based industries at the heart of its national growth strategy.

This article first examines the regulatory structures and fundamental principles of data protection in both jurisdictions, before turning to a comparison of selected key areas, including privacy policies for transparency in personal data processing, the use of pseudonymised data, data subject rights in relation to automated decision-making in the AI era, cross-border data transfer rules, and enforcement.  It concludes by considering the separate regimes of the UAE’s financial free zones and their implications for business strategy.

Korea’s Integrated Framework vs. the UAE’s Multi-Layered Regime

One of the most significant structural differences between the two jurisdictions lies in their respective regulatory frameworks.

Korea has a largely integrated regulatory framework centred on the PIPA and supervised by the Personal Information Protection Commission (PIPC). The 2020 and 2023 amendments brought the data protection rules formerly applicable to online service providers into the PIPA and then consolidated them into its general rules, although sector-specific legislation, such as the Credit Information Use and Protection Act, continues to apply in the financial sector. The UAE, by contrast, has a multi-layered framework: the federal PDPL serves as the principal onshore legislation and is administered by the UAE Data Office, but it expressly excludes, among other things, government data and government entities, health and banking or credit data governed by their own legislation, and free zones with their own data protection laws.  Most notably, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each operate their own independent data protection regimes.

Moreover, although the UAE federal PDPL has been in force since January 2022, the Executive Regulations contemplated under the law have not yet been issued. As a result, certain detailed regulatory requirements, including specific timelines for data breach notifications and the controls applicable to cross-border transfers, remain dependent on further implementing rules.

Understanding the UAE’s data protection framework therefore requires consideration not only of the federal PDPL, but also of the separate regimes applicable in the DIFC and ADGM.

Fundamental Principles and Data Subject Rights

Despite differences in regulatory structure, the fundamental direction of Korean and UAE data protection law is broadly similar.

Both jurisdictions require personal data to be processed on a lawful basis and only to the extent necessary for the relevant purpose. They also impose obligations on those processing personal data to ensure its secure management and protection. Data subjects are granted rights to obtain information regarding the processing of their personal data and, in certain circumstances, to request access, correction, deletion, or restriction of processing.

The UAE PDPL takes consent as its starting point: Article 4 prohibits processing without the data subject’s consent, subject to a list of exceptions that includes the establishment or defence of legal claims, employment-related obligations, and the protection of the public interest. It also provides mechanisms for managing risks associated with personal data processing, including Data Protection Impact Assessments (DPIAs) and the appointment of Data Protection Officers (DPOs) in specified high-risk cases.

Korea’s PIPA similarly requires personal data to be processed with the consent of the data subject or on another lawful basis set out in Article 15, such as the conclusion or performance of a contract, compliance with legal obligations, or the controller’s legitimate interests, and regulates the entire lifecycle of personal data, from collection and use to disclosure, retention, and destruction.

The two regimes are broadly similar in their fundamental approach to lawful processing and the protection of data subject rights, but differ in how these principles are implemented in practice.

UAE: Controllers, Processors, and Extraterritorial Application

The UAE PDPL distinguishes between a “Controller”, which determines the purpose and means of processing personal data, and a “Processor”, which processes personal data on behalf of a Controller. The law imposes specific obligations on each, and Processors, as well as Controllers, are subject to legal obligations relating to secure processing and data security.

Notably, the PDPL expressly provides for extraterritorial application. Under Article 2(1), it applies not only to Controllers and Processors located within the UAE, but also to Controllers or Processors located outside the UAE where they process personal data of data subjects within the UAE. Accordingly, even a foreign company with no legal entity in the UAE may need to consider whether the PDPL applies if it processes the personal data of individuals in the UAE.

Korea likewise imposes obligations on both personal information controllers and the service providers to which processing is outsourced.  Although the PIPA contains no express extraterritoriality provision, the PIPC has applied it to overseas businesses that provide services to users in Korea (as in its 2022 enforcement action against Google and Meta), and Article 31-2 requires certain foreign businesses without an address or place of business in Korea to designate a domestic representative.  Extraterritoriality itself is therefore not an absolute distinction between the two regimes. What is notable about the UAE framework is that the distinction between Controllers and Processors, as well as the extraterritorial scope of the law, is comparatively explicit in the statutory text.

Transparency in Personal Data Processing: Korea’s Privacy Policy Requirement

From the perspective of transparency, Korea’s “privacy policy” requirement is particularly noteworthy. Article 30 of the PIPA expressly requires personal information controllers to establish and publicly disclose a privacy policy setting out matters such as the purposes of processing, retention periods, disclosures to third parties, and outsourcing of processing activities, and following the 2023 amendments, the PIPC has been empowered to evaluate privacy policies and recommend improvements (Article 30-2), with the first evaluations conducted in 2024. The UAE PDPL requires Controllers to inform data subjects, before processing begins, of the purposes of processing, the recipients of their data, and the safeguards for any cross-border transfers, and grants a right to further information on request (Article 13).  However, it imposes no equivalent obligation to publish a privacy policy.  Korea’s requirement that key information about processing activities be made publicly available, therefore provides a clearer mechanism through which individuals can understand how their personal data is being processed.

Pseudonymised Data: Korea’s Special Framework for Data Use

One notable feature of Korea’s approach to data use in the AI era is its statutory framework for “pseudonymised information.”

The PIPA defines pseudonymised information as personal information processed so that a particular individual cannot be identified without the use or combination of additional information. In particular, Article 28-2 of the PIPA provides a special regime under which pseudonymised information may, subject to prescribed conditions, be processed without the consent of the data subject for purposes such as statistical analysis, scientific research, and archiving in the public interest. This flexibility is balanced by strict safeguards: Article 28-5 prohibits processing pseudonymised information for the purpose of identifying a particular individual, and breaches may attract both administrative penalties and criminal sanctions.

Pseudonymisation is therefore treated not merely as a technical security measure, but also as a legal mechanism designed to balance the protection of personal data with its legitimate use.

The UAE PDPL also recognises the concepts of pseudonymisation and anonymisation but treats them as protective measures: Controllers are expected to apply pseudonymisation as part of their compliance and security measures (Articles 7 and 20), and personal data may be retained after its purpose has been exhausted only if it has been anonymized (Article 5).  It does not, however, establish pseudonymised information as a distinct statutory category.  Archival, scientific, historical, and statistical purposes appear instead as general exceptions to the consent requirement under Article 4, without a specific pseudonymisation condition.  This differs from Korea’s approach, which expressly permits pseudonymised information to be processed  without consent for specified purposes such as research and statistical analysis.

A New Right in the AI Era: Responding to Automated Decisions

The rapid adoption of AI is creating new challenges for data protection law. Personal data is no longer merely collected and stored; increasingly, AI systems and algorithms analyse personal data and use it to make decisions that may affect individuals.

In Korea, Article 37-2 of the PIPA, which took effect in March 2024, provides data subjects with rights in relation to decisions made by a fully automated system, including a system applying AI.  Where such a decision materially affects a data subject’s rights or obligations, the data subject may refuse it, unless the decision is based on consent, a contract, or a legal provision; in addition, a data subject may request an explanation or review of an automated decision.  Controllers must also disclose the criteria and procedures for automated decisions in a manner that data subjects can readily access.

Similarly, Article 18 of the UAE PDPL entitles data subjects to object to decisions resulting from automated processing, including profiling, particularly where those decisions have legal effects on, or adversely affect, the data subject, and requires the Controller to include human review of such decisions at the data subject’s request.  As in Korea, the right to object does not apply where the automated processing is agreed under a contract, required by other legislation, or based on the data subject’s prior consent.  Notably, however, the PDPL defines automated processing to include processing carried out with limited human supervision, whereas Korea’s right applies only to fully automated decisions.  The UAE provision may therefore reach a wider range of AI-assisted decision-making.

In short, both jurisdictions recognise that situations in which AI and algorithms substitute for human judgment constitute an emerging area of data protection. Data protection law is expanding beyond the traditional regulation of the “collection and storage” of data to address how personal data is used to make “decisions” about individuals.

Cross-Border Transfers: Parallel Statutory Grounds vs. an Adequacy-Led, Two-Tier Approach

As cloud computing and AI services become increasingly widespread, cross-border transfers of personal data have become an important regulatory issue for businesses.

Article 28-8 of Korea’s PIPA, introduced by the 2023 amendments, generally restricts the cross-border transfer of personal data but permits such transfers where one of the grounds prescribed by law is satisfied. These grounds include the separate consent of the data subject, a basis under applicable laws or treaties, outsourcing or storage necessary for the conclusion or performance of a contract, where this is disclosed in the privacy policy or notified to the data subject, certification of the recipient under a scheme designated by the PIPC, and transfers to countries or international organisations recognised by the PIPC as providing a level of protection substantially equivalent to that under the PIPA. In this respect, Korea’s framework sets out a list of parallel grounds, of which adequacy is only one; any one of them is sufficient on its own to permit a transfer.

By contrast, the UAE PDPL adopts a two-tier structure.  Article 22 permits transfers, in cases approved by the UAE Data Office, to jurisdictions that have data protection legislation and a competent supervisory authority, or with which the UAE has concluded a relevant bilateral or multilateral agreement.  Where such a level of protection is not available, Article 23 permits transfers only in specified cases, including, under a contract imposing PDPL-equivalent obligations on the recipient, with data subject’s express consent, where necessary for the conclusion or performance of a contract, for the establishment, exercise or defence of legal rights, for international judicial cooperation, or to protect the public interest. The detailed controls for Article 23 transfers are, however, left to the Executive Regulations.

The distinction is therefore one of structure rather than of permissiveness.  Both regimes enumerate the circumstances in which transfers are allowed, but while Korea treats its statutory grounds as parallel alternatives, the UAE framework places the level of protection available in the destination jurisdiction at the centre, with Article 23 grounds operating as exceptions or compensating safeguards where that protection is lacking.

Ultimately, both jurisdictions permit cross-border transfers subject to an appropriate level of protection and a sufficient legal basis rather than imposing an absolute prohibition. However, the specific legal grounds and procedures through which such transfers are permitted differ.

Enforcement: Detailed Rules in Korea, Implementing Measures Awaited in the UAE

The difference between the two regimes becomes more pronounced in relation to enforcement and sanctions.

Korea’s PIPA provides a relatively detailed framework for calculating administrative penalties. For general violations, administrative penalties of up to 3% of total revenue, excluding revenue unrelated to the violation, may be imposed, under Article 64-2.  Amendments adopted in early 2026, which took effect on 11 September 2026, introduced a special regime permitting penalties of up to 10% of total revenue where, for example, a business intentionally or through gross negligence repeats a violation within three years or causes harm to 10 million or more data subjects, or where a breach occurs because a corrective order was not implemented. At the same time, the amendments allow reductions of up to 40% of the base amount for businesses that have invested proactively in data protection. The scale of potential exposure is illustrated by the Coupang case: in June 2026, even under the 3% cap, the PIPC imposed administrative penalties totalling approximately KRW 624.7 billion in respect of breach and the unlawful collection of users’ online activity data, the largest in its history.

By contrast, Article 26 of the PDPL provides a legal basis for imposing administrative penalties for violations of the law, but the PDPL itself does not prescribe specific monetary amounts or revenue-based caps. Instead, the detailed violations and corresponding levels of administrative penalties are to be determined by a separate Cabinet decision, which, like the Executive Regulations, has yet to be published at the time of writing.

This illustrates a notable difference between Korea, which has developed a relatively detailed statutory framework for enforcement and sanctions, and the UAE federal regime, under which certain aspects of the enforcement framework remain subject to subsequent implementing measures.