UAE PDPL and GDPR on One Control Plane

RENEDOR LLC is a Dubai company. Our product is used by institutions that sit under UAE PDPL, under GDPR, and often under both on a single matter. Building two gateways would have been the easy story. It would also have been a lie the first time a Dubai desk collaborated with a European affiliate.

We map both regimes onto one control plane. The invocation still has one residency pin, one retention class, one dual-control policy. The legal basis and the transfer story are fields on that record, not a separate stack.

What we actually encode

PDPL and GDPR do not share a clause map. They share a requirement that you can say where personal data went, why, and for how long.

On a request, Eridian records:

• Lawful basis or processing purpose as the institution tagged it (we do not invent the basis)
• Data subject region tags on the project, not guessed from the prompt
• Residency pin and whether a transfer to a provider endpoint occurred
• Redaction strategy and entity counts
• Retention class and hold flags
• Subprocessor IDs as they appear on our published list

If the institution has not tagged a purpose, we fail closed on projects marked personal_data: true. We do not infer a purpose from the prompt. Inference is not a legal basis.

Transfers

A model call is a transfer if the endpoint is outside the pin. Strict pinning is how most UAE production projects avoid the question. GDPR desks that must use a European endpoint pin to eu and stay there. We do not "optimize" them to a cheaper UAE hop.

SCCs, addenda, and the DPA live in the legal pack at geteridian.com/legal/dpa. Engineering does not get to satisfy a transfer with a comment in a routing file.

Conflict rule

When PDPL and GDPR both apply, we take the tighter operational control, not the tighter marketing sentence.

• Residency: intersection of allowed regions, not union
• Retention: the shorter clock unless a legal hold says otherwise
• Redaction: union of entity types
• Dual control: on if either regime's workflow class requires it

Intersection is annoying. Union of regions is how you accidentally satisfy neither supervisor.

What this is not

This is not legal advice and it is not a substitute for the institution's DPO. We are the operating system that makes the DPO's rules executable at invocation. If the rules are not in the project policy, they will not be in the record, and we will not pretend otherwise.