Data protection
Saudi and UAE PDPL for an AI shopping assistant
What the two data protection laws ask for, what an AI shopping assistant handles, and how Hephon Commerce treats that data. Not legal advice.
In short
Saudi Arabia's Personal Data Protection Law (PDPL), enforced by SDAIA since 14 September 2024, and the UAE's Federal Decree-Law No. 45 of 2021 both apply to the personal data an AI shopping assistant handles: messages, voice, basket, identity and delivery details.
Hephon Commerce never uses conversations to train AI models, runs on servers in the European Union today, lets each retailer set retention and delete a shopper's data on request. We hold no certification and do not claim PDPL compliance; we go through each retailer's requirements with its team. This page is not legal advice.
Updated
What do the Saudi PDPL and the UAE PDPL say?
The basics, as public legal sources describe them. Sources and dates are named in the text.
| Saudi PDPL | UAE PDPL | |
|---|---|---|
| The law | Personal Data Protection Law, with Implementing Regulations and Transfer Regulations | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data |
| Regulator | Saudi Data and AI Authority (SDAIA) | UAE Data Office |
| In force | 14 September 2023; fully enforceable from 14 September 2024 | In force since 2 January 2022; full implementation waits on the Executive Regulations |
| Reach | Processing in the Kingdom, and organisations abroad processing data of people in Saudi Arabia | Processing in the UAE, and controllers abroad processing data of people in the UAE; not DIFC or ADGM |
| Transfers abroad | Adequacy, or safeguards such as SDAIA's standard contractual clauses, with a risk assessment | Adequate protection, or routes such as a contract or the person's explicit consent |
| Open questions on 5 November 2026 | Draft amendments, consulted on until 5 November 2026, would add a storage-in-Kingdom requirement | We could not confirm that the Executive Regulations have been published |
Saudi Arabia
The PDPL took effect on 14 September 2023, a week after SDAIA published its Implementing Regulations and the Regulations on Personal Data Transfer outside the Kingdom (Clyde & Co, September 2023). A one-year grace period followed, and the law became fully enforceable by SDAIA on 14 September 2024 (Clyde & Co, 10 September 2024). It reaches organisations outside Saudi Arabia that handle the personal data of Saudi residents. People have rights to be informed, to access their data, to have it corrected and to have it destroyed, and controllers must keep records of processing. Transfers abroad need an adequacy decision or safeguards such as SDAIA's standard contractual clauses.
Two changes are in draft. Today a controller must notify SDAIA of a breach within 72 hours where it is likely to cause harm; draft amendments to the Implementing Regulations would require notice of any breach within 72 hours, add an express requirement to store personal data within the Kingdom, and make registration mandatory for controllers that transfer data abroad. The public consultation ran from 6 October to 5 November 2026 (Clyde & Co, 8 October 2026). If the storage requirement is adopted, it matters for any provider hosting outside Saudi Arabia, including us.
The UAE
Federal Decree-Law No. 45 of 2021 was issued on 20 September 2021 (Simmons & Simmons, 6 December 2021) and came into force on 2 January 2022 (Chambers and Partners, Doing Business in the UAE 2025). It applies to controllers and processors in the UAE and to those abroad processing the data of people in the UAE. It does not apply to free zones with their own data protection laws, such as the DIFC and ADGM, or to health and banking data governed by their own laws. Consent is the main legal basis and must be specific, clear and unambiguous, and people can withdraw it. They can ask to access, correct and erase their data and to restrict its processing. The UAE Data Office oversees the law.
Full implementation waits on the Executive Regulations, which Chambers and Partners described as not yet formally released. As of 5 November 2026 we could not confirm from an official source that they have been published, and secondary sources disagree.
What data does an AI shopping assistant handle?
For Hephon Commerce, these are the kinds of personal data in a shopper's conversation.
| Kind | What it is | How it is used |
|---|---|---|
| Messages | What the shopper types, voice notes (transcribed), and calls with their transcripts | Your inbox; deleted with the conversation |
| Basket and orders | Products, quantities, checkout, order status | Sent to your platform or team when the shopper confirms |
| Identity | Your shopper id, or a WhatsApp number and profile name; a name and phone where given | Used to keep one basket and to deliver |
| Delivery details | Address or location pin, to choose the branch and deliver | Address consent is recorded with a date |
| Photos and voice notes | Media a shopper sends on WhatsApp | Served only to your signed-in team |
| Remembered preferences | Usual products, preferences, dietary needs | Only if you turn memory on and the shopper says yes |
Shoppers do not create accounts with us. They talk to your store, and you are the controller of their data; Hephon processes it to run the assistant for you. Phone numbers and emails are masked in the traces we use to debug replies.
How do consent, retention and deletion work?
Consent
The legal basis for each kind of processing is the retailer's to decide with its lawyers. The product records the consents it collects, each with a date and a version: that the privacy notice was shown, that a delivery address may be kept, and a shopper's marketing opt-in or opt-out. Memory is off unless you turn it on; when it is on, the assistant asks a shopper you have identified once whether it may remember things such as usual products, saves nothing without a yes, and clears it when the shopper says forget. Call recording is off by default.
Retention
Each retailer sets how long conversations are kept. The default is 365 days after a conversation's last message, and a daily job deletes conversations past the retailer's period, with their messages, basket and insights.
Deletion
Your team can request deletion of a shopper's data from the dashboard or through the API, for example when the shopper asks you. Conversations, the shopper's profile and sessions, saved addresses, photos and voice notes, and debugging traces are deleted. Orders are kept for your accounts with the shopper's identifier removed. Your team can follow each request's status in the dashboard.
Where is the data processed, and by whom?
Our application and database servers are in Amsterdam, in the European Union, and product search embeddings are computed in Google Cloud's Netherlands region. We do not host in Saudi Arabia or the UAE today. Some of our subprocessors are outside the EU, so parts of a conversation leave it while a reply is being made:
- AI model providers. Replies are written by the model the retailer chooses, reached through OpenRouter, whose model hosts may be in the United States or other countries. Every request that can carry conversation data is sent with data collection denied, so no conversation is used to train a model.
- Search and relevance. A search's words are turned into embeddings, and a fast classifier checks results against the shopper's message.
- Speech providers. Voice notes and calls are turned into text, and replies into speech, by speech providers for each language.
- Hosting, files and operations. Servers, file storage, site delivery, error reports and debugging traces, with phone numbers and emails masked in traces.
The full list, with each company and region, is on our subprocessors page, next to our data processing agreement. Both are drafts pending legal review. Platform credentials you give us are encrypted with AES-256-GCM.
What we do not claim
- No certification. Hephon Commerce holds no ISO or SOC certification.
- No compliance badge. We do not claim Saudi or UAE PDPL compliance. Compliance depends on the whole processing, including yours.
- No local hosting today. Data is not stored in Saudi Arabia or the UAE. Tell us your residency requirements and we will go through them with your team.
- Not legal advice. This page summarises public sources with dates. Your lawyer decides how the laws apply to you.
A checklist for retailers
Before an AI shopping assistant goes live with shoppers in Saudi Arabia or the UAE.
- 1
Map the data
List what the assistant collects on each channel, using the table on this page, and add it to your records of processing.
- 2
Update your notice
Tell shoppers in your privacy notice that an AI assistant answers them, what it keeps, for how long and who processes it.
- 3
Decide transfers
Our servers are in the EU and AI model providers may be elsewhere. Choose the transfer route your lawyer is comfortable with.
- 4
Set retention and memory
Pick a retention period shorter than the default if you need one, and decide whether the assistant may remember anything.
- Confirm whether your entity is in a free zone with its own law, such as the DIFC or ADGM.
- Check whether you need a data protection officer under the Saudi PDPL, for example if you process sensitive data or monitor people regularly.
- Agree a data processing agreement with every vendor that touches shopper data, including us, and review the subprocessor list.
- Decide who answers access, correction and deletion requests, and test a deletion end to end before launch.
- Agree how a breach is reported to you, so you can meet SDAIA's 72-hour window.
- Turn on only the channels and memory you have covered in your notice, and keep call recording off unless you need it.
PDPL and AI shopping, answered.
Go through your requirements with us.
Bring your data protection questions to the demo. We walk your team through how the assistant handles shopper data.
