A regulator wrote down what an agent is. It reads like a grant.

One country, three regimes, resolved per decision

The UAE is not a single jurisdiction. Federal PDPL applies onshore, and the DIFC and the ADGM are financial free zones with their own data protection law. This profile carries all three, and the platform resolves the narrowest that applies to each decision rather than flattening them.

That matters practically: a workload onshore is not scored against a DIFC instrument, and one inside the DIFC does not escape Regulation 10 because the profile said “AE”.

Regulation 10, and why it fits

Every other instrument this platform maps was written for models, systems or processing in general, with agents fitted afterwards. Regulation 10 was written for autonomous systems. Its clause 10.3.4 is worth reading in the regulator's own words:

“Its position is substantially similar to that of an employee within the Deployer organisation… the Deployer will be responsible for ensuring that, when processing Personal Data, the System always operates within the appropriate human-established limits and on the basis of human-established principles.”

And 10.2.2(b) divides purposes into human-defined — hard-coded, which the system cannot change — and self-defined, where any self-generated purpose must derive from principles a human fixed. A grant is that boundary, enforced at runtime rather than written in a policy. The clause map →

Emirates ID, and an honest limit

The Emirates ID is 784-YYYY-NNNNNNN-C, and its check digit is widely believed to be Luhn. There is no official specification, and published analyses disagree about whether the check covers the whole number or a truncated sequence.

So the check runs, and a match is still reported as asserted rather than observed — the same treatment the fifteen VAT states recognised by length alone already get. A UAE IBAN beside it carries ISO 13616 mod-97 and is reported as observed, and a reader who sees both in one scan learns exactly how much arithmetic stood behind each.

Neither the PDPL nor DIFC Data Protection Law enumerates protected characteristics for outcome testing, so this profile ships no fairness vocabulary and refuses proxy inference. The objective, and its justification, are yours to state.

The clock, and the date in front of you

PDPL Article 33 — 72 hours

Notification to the UAE Data Office without undue delay; the Data Office has communicated 72 hours from awareness as the operative standard. Encoded.

DIFC — no fixed window

The Commissioner sets windows rather than publishing a count, so this profile records the obligation with no clock rather than inventing one.

PDPL compliance — 1 January 2027

A hard date, and the reason the register Regulation 10 asks for is worth having before it rather than after.

What resolving a profile actually changes

A market profile is not a locale setting. Changing it changes what the platform is permitted to do, what it looks for, what it scores you against and how long it keeps a record — and moving a workspace between profiles is itself a governed act with a name against it.

And a workload can be under more than one at once. The profile resolves per decision — narrowest wins — and is sealed into the record, so a pack states which laws this deployment believed applied at the moment the decision was made. How that works →