Often yes, but the answer turns on four decisions, not on the model's brand: where the data is stored, where inference runs, who acts as the processor, and whether personal data crosses a border on the way. Make those decisions per workflow, write them down and confirm them with counsel. This is not legal advice.
#Key takeaways
- The model's name does not decide compliance; storage, inference, processor and transfer do.
- Inference location matters as much as storage, because every model call processes the data wherever the model runs.
- Which models a provider offers in which country changes often, so get the current region list in writing, with a date.
- Choose the hosting first and the model second, or the pilot may never be allowed into production.
- None of this is legal advice: your counsel confirms the legal basis before any customer data is used.
#What do the UAE and Saudi data protection laws cover?
In the UAE, personal data is governed by federal decree-law no. 45 of 2021 on the protection of personal data (UAE government portal). In Saudi Arabia, the personal data protection law (PDPL) became fully enforceable on 14 september 2024, and SDAIA is the regulator (Clyde & Co, september 2024).
Both laws govern how personal data is processed and moved. What they require for your specific workflow, and how they treat a model call made from another country, are questions for your counsel. This post gives you the decisions to bring to that conversation. It is not legal advice, so confirm each point with counsel.
#Why does inference location matter, not only storage?
Many teams check where the database sits and stop there. But every time a workflow sends a customer record to a model, that record is processed wherever the model runs. If storage is in-country and inference happens in another region, personal data has still travelled. Ask the provider for the inference region in writing, for each model, with the date they confirmed it.
The same applies to logs, prompt caches, evaluation copies and vendor support access. Each is a place where customer data can rest or be read. List them next to the main database, not after it.
#Which AI models can be hosted inside the UAE or Saudi Arabia?
We will not name a model and a country here, because availability by region is set by each cloud provider and model vendor and changes with new releases. Ask the provider for its current region list for the exact model version you plan to use. Get it in writing, keep the date, and recheck it before each new workflow.
The options to compare usually include a model offered through a cloud provider's in-country region, an open-weight model run on infrastructure you control, and a vendor's own API. Each gives a different answer to the decisions below, so compare them on those decisions rather than on benchmark scores.
#What should you write down for each workflow?
- storage: where the source data, the logs and any copies sit, and who can read them.
- inference: the region where the model runs for this workflow, confirmed in writing by the provider, with a date.
- processor: who processes the data on your behalf, whether the model vendor, the cloud provider or both, and what the contract says.
- cross-border transfer: whether any step sends personal data outside the country, and which legal basis counsel has confirmed for it.
- minimisation: which fields the model actually needs. Names, ids and account numbers can often be masked before the call.
We covered the processor question in detail in who is the data processor when AI runs on your cloud. Treat customer text as untrusted input too: prompt injection is the first risk on the OWASP top 10 for LLM applications list.
We are
Stennir maps storage, inference, processor and transfer for each workflow, hosts where your rules require, and leaves you owning the accounts, the data and the off switch.
We aren't
Stennir is not a law firm and does not give legal opinions. Your counsel confirms the legal basis before anything runs on customer data.
#Can you automate a workflow without moving data to a US cloud?
Often, yes, by choosing the hosting before the model. Start with the workflow and the data it touches, pick a deployment that keeps storage and inference where your rules require, then pick a model available there. Choosing the model first is how teams end up with a pilot that legal will not approve for production.
Buyers ask this in Arabic too: «هل يجوز استخدام ChatGPT مع بيانات العملاء في السعودية حسب نظام حماية البيانات الشخصية؟». The framework is the same, and Stennir works through it with your team in Arabic and English.
#What should a compliance or operations lead do next?
Pick one workflow that touches customer data and fill in the five decisions above. Bring the sheet to counsel. AI consulting includes the hosting region in its recommended build, and AI implementation runs the workflow where your rules require. See AI for compliance, take the free readiness assessment or book a 30-minute call.
#Common questions
Is it legal to use ChatGPT with customer data in Saudi Arabia?
It depends on how the data is processed, stored and transferred, not on the product name. The PDPL is enforced by SDAIA, and your counsel needs to confirm the legal basis for each workflow. This is not legal advice. Bring counsel the storage, inference, processor and transfer decisions for the specific use.
Where does our data stay?
Where you decide, workflow by workflow. Stennir writes down the storage region, the inference region and every place a copy can rest, such as logs and caches. The accounts sit in your name, so you can see the settings yourself and change or close them without asking us.
What do you need from us to start?
The workflow you have in mind, the fields it touches, your current cloud and vendor contracts, and a contact in legal or compliance. With those, the hosting decision can be made before any model is chosen, which is the order that keeps a pilot able to reach production later.
What could go wrong?
The common failure is checking storage and missing inference: the database stays in-country while every model call goes elsewhere. Others are logs kept in a different region, vendor support staff able to read prompts, and a provider changing its region list after you signed. Recheck the list before each new workflow.
