Data Protection and Cybersecurity Governance for eVTOL Systems in the UAE: Comparative Lessons from the EU and US.

The article investigates the data governance challenges arising from the integration of electric vertical take-off and landing (eVTOL) systems into the United Arab Emirates’ emerging urban air mobility ecosystem. As eVTOL operations rely on continuous streams of biometric, geolocation and operational telemetry data, existing legal instruments, particularly the UAE Personal Data Protection Law (Federal Decree by Law No. (45) of 2021), national cybersecurity strategies and General Civil Aviation Authority (GCAA) advisories, remain underprepared to regulate these high-risk data flows. The article examines the extent to which UAE frameworks can accommodate the unique risks posed by autonomous, data-driven aviation, including the processing of sensitive passenger data, real-time cross-border transfers, AI-based navigation decisions and the vulnerability of interconnected systems to cyberattacks. Through a doctrinal analysis, it draws comparative insights from the European Union’s integrated data protection and aviation cybersecurity model and the United States’ decentralised, innovation-led approach. The article argues that aviation-specific data governance standards, enhancing algorithmic accountability and strengthening cybersecurity obligations are essential steps for aligning technological ambition with public safety. It concludes that a coherent, forward-looking regulatory model will be critical for ensuring trust, accountability and operational resilience as the UAE advances its eVTOL deployment plans.