PDPL and GDPR

RENEDOR LLC is established in Dubai. Many tenants also process EU personal data. Eridian Legal runs UAE PDPL and GDPR on one control plane: one API, two residency pins, one audit export. It does not collapse the two laws into a single "privacy mode."

What the control plane enforces

Account, billing, and security telemetry may leave the pin as documented in Privacy. Matter documents and embeddings do not.

One tenant, two projects

The supported pattern:

1. prj_legal_ae in me-central-1 for UAE client work and PDPL mappings.
2. prj_legal_eu in eu-west-1 for EU personal data and GDPR mappings.
3. Same SSO, same Terraform module, different region and keys.
4. Combined examiner pack: two Evidence Export jobs, then your counsel memo.

Eridian will not replicate a matter across those projects. A 403 residency_violation is a correct outcome if a client sends the wrong region.

Mapping both catalogs

On a document that is in-region for that project, you may pass both catalogs:

{
  "contract_id": "ctr_4821",
  "catalog_ids": ["cat_pdpl_uae", "cat_gdpr"],
  "model": "gpt"
}

Use this only when the document is lawfully in that region. Mapping GDPR articles against a UAE-only file is a counsel decision, not an API feature flag.

Transfer language

Redlines can insert processor and transfer clauses from published templates:

• tpl_pdpl_processor_v2
• tpl_gdpr_art28_v5

Those templates are starting text. They are not your DPA. See Redlines.

Model routing

Both families (GPT and Gemini) are offered in me-central-1 and eu-west-1. Pin "gpt" for committee-facing mapping. Use "auto" for bulk clause extraction after eval. See Models and Regions.

Offices

Product and legal entity are Dubai. Support and solutions staff also operate from Hong Kong and South Africa. Those offices do not receive matter payloads unless a project pin and a DPA allow it. Opening a support ticket should include request_id, not the contract PDF.

See Policy Mapping, PII Redaction, and Evidence Export.