If your website collects names, email addresses, phone numbers, analytics data, or cookie identifiers from people in the UAE, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, known as the PDPL) almost certainly applies to you — even if your company is registered somewhere else. It requires a clear privacy notice, opt-in consent before non-essential cookies fire, honest form data collection, a process for data-rights requests, secure handling, and contracts with your processors. Administrative fines run from AED 50,000 to AED 5,000,000 per violation. This guide explains exactly what UAE business owners must do. It is general information about the legal framework, not legal advice — consult a data protection advisor for your own situation.
What the UAE PDPL is — and who it covers
The PDPL is the UAE's first comprehensive federal data-protection statute, signed on 26 September 2021 and effective from 2 January 2022. It is overseen by the UAE Data Office, a federal authority established under Federal Decree-Law No. 44 of 2021, sitting under the UAE Cabinet. The UAE is our home market, so we track this regime closely for every site we ship.
Who must comply: any controller or processor established in the UAE processing personal data of individuals — inside or outside the UAE — and any entity outside the UAE that processes the personal data of UAE residents. Like the EU's GDPR, the PDPL reaches beyond borders: a foreign company marketing to people in the UAE can fall inside its scope. Excluded are government and security processing, personal or household use, health and credit data (covered by sectoral laws), and DIFC/ADGM-licensed organisations, which follow their own free-zone regimes.
The honest status check: as of early 2026, the UAE Data Office is still building its enforcement capacity and the PDPL's executive regulations have not yet been published — a six-month compliance window is expected once they land. That is not a free pass: the UAE Cybercrime Law already criminalises the unauthorised collection and disclosure of personal data, and sectoral regulators are actively enforcing their own rules today.
What PDPL compliance means for your website: the 7 must-dos
1. Publish an honest privacy notice
The PDPL does not explicitly demand a document called "privacy policy," but its transparency principle and data-subject rights effectively require one — and it must reflect what your site actually does, not a generic generator template.
A compliant notice should cover: what you collect and how; the purposes and legal basis for each use; retention periods; whether data leaves the UAE and under what safeguards; the rights individuals hold and how to exercise them; how to withdraw consent; your privacy contact; and the last-update date. For a UAE audience, a bilingual Arabic and English notice is the credible standard — see our guide to bilingual Arabic–English websites for how to structure that properly.
2. Get real consent with a proper cookie banner
The PDPL has no dedicated cookie provision — cookie compliance flows from its general consent and transparency rules. And analytics cookies do collect personal data: a cookie like _ga (Google Analytics) records a unique client identifier tied to a user's browsing behaviour.
Run an opt-in model for non-essential cookies: a clear banner before analytics or marketing scripts activate, per-category choice, and logged consent as evidence. Pre-ticked boxes, implied consent through scrolling, and dark patterns do not count.
| Cookie type | Example | PDPL consent needed? |
|---|---|---|
| Strictly necessary | PHPSESSID, csrf_token | No — required for the site to function |
| Functional | Language or currency preference | Yes — safest treated as opt-in |
| Analytics | _ga, _gid | Yes — tracks identifiable browsing behaviour |
| Marketing / advertising | _fbp, fr | Yes — profiles users for ad targeting |
3. Make your contact forms collect less and disclose more
Data minimisation is blunt: collect only what is strictly necessary for a stated purpose. Audit every form — contact, quote request, newsletter, booking, job application — and delete every field you cannot justify.
At each point of capture, add a short collection notice — what you collect, why, plus a link to your privacy notice — placed before the submit button. Marketing opt-ins must be separate and unticked.
4. Get your analytics and third-party trackers under control
Run a cookie and tracker scan to find everything firing on your site — analytics, ad pixels, tag managers, heatmaps, video embeds, chat widgets, social buttons. Classify each by purpose, document what it collects, and gate every non-essential script behind consent. Most of these tools also send data outside the UAE, making them a cross-border transfer question too (must-do 6).
5. Set up a process for data subject rights requests
The PDPL grants individuals rights that closely mirror the GDPR: to be informed about collection and use; to access and rectify their data; to have it erased when no longer needed or when consent is withdrawn; to object to or restrict processing (including a full stop on direct marketing); to data portability; to withdraw consent at any time; and to complain to the UAE Data Office.
Create a dedicated request channel, document who handles requests internally, and decide how you verify identity before handing data over. Exact response timeframes await the pending regulations — set a reasonable service standard and meet it.
6. Vet your processors and watch cross-border transfers
You remain responsible for data you hand to others. Appoint only processors that provide sufficient security guarantees and sign contracts with appropriate data-protection clauses — covering your analytics provider, email platform, cloud host, CRM, and web agency. The same obligations flow down to sub-processors.
When data leaves the UAE — and with most cloud, analytics, and email tools it does — the transfer is permitted if the destination offers adequate protection (as assessed by the UAE Data Office), if safeguards such as standard contractual clauses are in place, or with the individual's explicit consent. Map where your data goes before a customer or the regulator asks — a website handover checklist is the right moment to document which third parties hold your data.
7. Prepare for breaches and keep your records
If a breach occurs, notify the UAE Data Office and the affected individuals promptly, explaining what happened and what you are doing to contain it. Have a written breach response plan naming who decides, who notifies, on what timeline, and how you reach affected people.
Also keep records of your processing activities — data categories, purposes, retention, access rules, erasure mechanisms, transfers, and security measures — ready for the Data Office on request. Where you process sensitive data (biometric, health, religious, or criminal-record data) at scale, appoint a Data Protection Officer, and run a Data Protection Impact Assessment before high-risk processing such as large-scale profiling.
PDPL vs GDPR: what UAE business owners get wrong
| Aspect | UAE PDPL | EU GDPR |
|---|---|---|
| Scope | UAE mainland; excludes DIFC and ADGM free zones | All EU/EEA member states |
| Primary legal basis | Consent-heavy — legitimate interest is not broadly available for commercial processing | Six legal bases, including legitimate interest |
| Maximum administrative fine | AED 50,000 – AED 5,000,000 | Up to EUR 20 million or 4% of global annual turnover |
| Supervisory authority | UAE Data Office (still building enforcement capacity) | National DPAs in each member state |
| Implementing regulations | Still pending as of early 2026 | Fully operational since 2018 |
The biggest practical difference from the GDPR is legitimate interest. Under the GDPR, analytics and direct marketing can run on a legitimate-interest basis; under the PDPL they will typically need consent — so a GDPR banner relying on "legitimate interest" text needs reworking for UAE visitors, not just translation.
Your PDPL website compliance checklist
| # | Action | Done? |
|---|---|---|
| 1 | Publish a privacy notice matching your actual data flows, in English and Arabic | ☐ |
| 2 | Deploy an opt-in cookie banner with per-category choice; block non-essential scripts until consent | ☐ |
| 3 | Store cookie consent logs as compliance evidence | ☐ |
| 4 | Minimise form fields; add a collection notice and unticked marketing opt-in at each form | ☐ |
| 5 | Audit and classify every third-party tracker on the site | ☐ |
| 6 | Create a rights-request channel with an internal handling process | ☐ |
| 7 | Sign data-processing contracts with every processor and sub-processor | ☐ |
| 8 | Map cross-border transfers; confirm adequacy, safeguards, or consent for each | ☐ |
| 9 | Write a breach response plan naming who notifies the Data Office and affected users | ☐ |
| 10 | Keep processing-activity records, ready for the Data Office | ☐ |
| 11 | Assess DPO/DPIA need for sensitive or high-risk processing | ☐ |
| 12 | Use HTTPS everywhere, access controls, and a retention policy with secure deletion | ☐ |
What happens if you ignore it
The PDPL provides for administrative fines from AED 50,000 to AED 5,000,000 per violation, alongside suspension or restriction of processing. The UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) adds criminal liability: unauthorised access to personal data can mean at least six months' imprisonment and fines of AED 150,000 or more, doubled for repeat offences.
Free-zone businesses are not exempt from scrutiny — the DIFC and ADGM have enforced their own regimes for years, and the DIFC's July 2025 amendments even allow individuals to bring private claims directly before the DIFC Courts. Add the reputational damage of a public enforcement action, and non-compliance is a serious business risk even while the federal Data Office is still maturing.
Frequently asked questions
Does the UAE PDPL apply to my website if my company is registered outside the UAE?
It can. The PDPL applies to any entity — wherever it is based — that processes the personal data of UAE residents. If your site collects form submissions, analytics data, or cookie identifiers from UAE visitors, you fall within scope unless an exemption applies.
Do I need a cookie consent banner for UAE visitors?
If your site sets non-essential cookies that collect personal data — analytics, advertising, or profiling cookies — yes. The PDPL requires freely given, specific, informed, and unambiguous consent before collection. Pre-ticked boxes, implied consent through scrolling, and dark patterns do not qualify.
Can I just reuse my GDPR privacy policy and cookie banner for the UAE?
Largely yes, but review three things: the PDPL is consent-heavier (legitimate interest is not broadly available for commercial processing, so rewrite that wording for analytics and marketing); update regulator references to the UAE Data Office; and add an Arabic version of your privacy notice. If you are licensed in the DIFC or ADGM, that regime may govern you instead.
What is the PDPL compliance deadline for my website?
The law took effect on 2 January 2022. The detailed executive regulations were still pending as of early 2026, with a six-month compliance window expected once published. Do not treat the wait as a holiday: the Cybercrime Law is already in force and criminalises the unauthorised collection and disclosure of personal data through technology.
Do I need a Data Protection Officer for my website?
Only if you process sensitive personal data — biometric, health, religious, or criminal-record data — at scale. A typical business website with contact forms and analytics does not need a DPO, but reassess if you handle sensitive data in volume.
The bottom line
PDPL compliance for a website is mostly good engineering and honest documentation: a privacy notice that tells the truth, real consent before tracking, forms that collect less, a working process for rights requests, written contracts with processors, and a breach plan. Treat privacy as a build requirement from the first wireframe — it is far cheaper to build in than to retrofit under regulatory pressure, the same lesson that applies to web accessibility compliance.
This guide explains the general framework — it is not legal advice. For sensitive data at scale or multiple regimes (mainland, DIFC, ADGM), consult a data protection advisor. If you are choosing a web design company in Dubai, ask how they handle privacy engineering — WebStackRank builds websites in the UAE with privacy engineered in from the start. Message us on WhatsApp at +971 52 595 3174 or email hello@webstackrank.com.
