Private LLM for businesses: local and self-hosted AI under PDPL, Law 09-08 and GDPR

Every AI project I take on hits the same question within the first week: where does the data go? With a typical setup, each prompt, document and customer message is sent to a model running in someone else's data centre, usually in the US. For a lot of work that's fine. For some, it isn't, and that's where private AI comes in: a model that runs on your own servers, or on a server you control in your own country.

This post covers when an on-premise or self-hosted LLM is worth it, what you give up, and how data protection laws, especially in the Middle East and North Africa, push companies towards it.

What "private AI" actually means

People use the term for three different setups:

1. Fully on-premise. The model runs on hardware in your building or your own data centre. Nothing leaves your network.
2. Self-hosted in the cloud. An open model runs on servers you rent, in a region you choose. The provider hosts the hardware, but you control the model, the logs and the location.
3. A cloud API with a regional or contractual guarantee. You use a big provider's model, but with data processed in a specific region and a contract that limits what they can do with it.

Which one is right depends on your data, your budget and your regulator.

Saudi PDPL, UAE PDPL, Law 09-08: when the law decides for you

Most countries now treat sending personal data abroad as a regulated act. Sending a prompt that contains a customer's name, phone number or ID to a model hosted in another country can count as a cross-border transfer. Some examples, as of late 2026:

• Saudi Arabia. The Personal Data Protection Law (PDPL) has been enforceable since 14 September 2024, supervised by SDAIA. Transfers outside the Kingdom are allowed to countries SDAIA considers adequate, or with safeguards such as standard contractual clauses, binding common rules or certification. Those safeguards come with a risk assessment before the transfer.
• United Arab Emirates. The federal PDPL (Federal Decree-Law No. 45 of 2021) allows transfers to countries with an adequate level of protection (Article 22) and, without one, only in listed cases such as contracts or the data subject's express consent (Article 23). Free zones like DIFC and ADGM have their own data protection laws. Sources disagree on how far the executive regulations have progressed, so check the current status.
• Egypt. Law No. 151 of 2020 got its executive regulations (Decree No. 816 of 2025) in November 2025, with a one-year compliance period. Controllers and processors need a licence from the Personal Data Protection Centre, and cross-border transfers, including to cloud environments, need their own licence or permit.
• Morocco. Law 09-08, supervised by the CNDP, allows transfers to countries with adequate protection and otherwise requires CNDP authorisation with safeguards. The CNDP has said that AI processing involving personal data falls under Law 09-08, and it has been working on a dedicated deliberation on AI since 2025.
• Europe. If you serve EU residents, the GDPR applies its own rules to transfers outside the EU, so the same question comes up.

None of this bans cloud AI. It means you need a legal basis, paperwork, and sometimes a licence before sending personal data abroad. For some companies, especially in banking, health, government work and HR, keeping the model in-country is simply the easier path. This is not legal advice: talk to a lawyer who knows your sector before deciding.

When a local LLM is worth it, legally or not

Law aside, a self-hosted model makes sense when:

• The data is your edge. Contracts, designs, source code, medical records, financial models. You don't want them in anyone else's logs.
• Volume is high and predictable. Classifying thousands of documents a day, or answering routine customer messages, costs a fixed amount on your own hardware instead of growing with every token.
• You need it to work offline or at the edge. A factory floor, a warehouse, a vehicle. In robotics and vision systems, latency and patchy connections often rule out a round trip to the cloud.

What you give up

• Peak quality. The largest cloud models are still the strongest at hard reasoning and long, messy tasks.
• Effort. Someone has to choose the model, serve it, monitor it, update it and keep the hardware running.
• Upfront cost. GPUs, or rented GPU servers, cost money before the first answer comes out.

For most business workflows (extraction, classification, search over your documents, drafting replies in a known format), a well-chosen open model running locally does the job.

The setup that usually wins: hybrid

Most private AI systems I build are hybrid:

1. A local model handles everything that touches personal or sensitive data: reading documents, classifying requests, answering routine questions from your own knowledge base.
2. Sensitive fields are removed or masked before anything leaves your network.
3. A large cloud model is called only for the hard, non-sensitive part, and only where your legal basis covers it.
4. Everything is logged on your side, so you can show what was processed where.

You get most of the privacy and cost benefits without giving up quality where it matters. The same pattern works for an Arabic customer-service chatbot or a WhatsApp assistant for a Moroccan business, where customer messages are full of names and phone numbers. Start with one workflow, test an open model on your real data before buying hardware, and expand from there, as I describe in what to automate first.

Working together

I'm Driss Briksine, a software and ML engineer based in Morocco. I build AI systems end to end, and I run most of my own on local models, from multimodal pipelines to production tools. You can see my case studies.

If you have data that can't leave your servers and a workflow you'd like to automate, send me a short brief. I'll tell you honestly whether a private model can handle it.