Your customer data does not live on your website. It lives in every system your website touches — host, form tool, email inbox, CRM, analytics, chat widget, payment platform, backups — often in several countries at once. You can list them all today, in an hour, and that list is the most useful privacy document a small UAE business can hold. This guide shows you how to build it, and what the UAE PDPL expects. It is guidance, not legal advice.
The short answer: your data lives in more places than your website (and you can list them today)
One enquiry usually creates several copies: the form stores it in the website database and emails it to your inbox, the CRM keeps its copy, and backups copy it again.
Your inventory is one row per system: what personal data it holds, where it is stored, who else can access it (sub-processors), how long it is kept, and on what basis. The PDPL requires controllers to keep a record covering categories, access, durations, erasure mechanisms, purpose, and cross-border movement — the inventory is most of that record.
The problem: an enquiry form is the start of a chain you have never mapped
Owners answer "where does our customer data live?" with their hosting company's name. Everything after the form is invisible: the plugin emailing enquiries, the analytics account a freelancer created, the spreadsheet leads are exported into every Friday.
An unmapped chain fails at the first test. A customer asks what you hold or to delete it — and nobody can say which systems to check. A cancelled tool's copy is never deleted, because nobody knew it existed. They need the list, not a lawyer.
PDPL in plain English: controller, processor, personal data — as they apply to your website
The UAE PDPL — Federal Decree-Law No. 45 of 2021 — rests on three ideas. Personal data is any information relating to an identified or identifiable person: names, phone numbers, email addresses, identification numbers, online identifiers and location count. Form entries, analytics identifiers and chat transcripts are personal data.
You are normally the controller — you decide why and how data is processed. Your host, CRM, email, analytics and chat providers are processors, acting under your instructions and a contract. The duties sit mostly with you — choosing processors giving sufficient guarantees, and answering for the chain.
Health data and banking and credit data are governed by their own legislation, not the PDPL, and companies in free zones with their own data-protection legislation — DIFC and ADGM — follow those regimes. In general, the law prohibits processing personal data without consent unless a listed case applies, such as performing a contract with that person. Consent relied on must be provable, clear, unambiguous, accessible and easy to withdraw. The form is covered in Arabic form design for UAE websites.
Build your data-location inventory: hosting, forms, email, CRM, analytics, chat, payments, backups
Work through these eight rows, recording what each tool's settings and terms say — do not guess.
- Hosting and website database — master copy of form entries, orders and logs. Record the data-centre country.
- Form tools and plugins — many store entries separately, and email copies to inboxes. Record both.
- Email — enquiries in inboxes and sent folders. Record provider and account holders.
- CRM — the working copy, with notes and exports. Record onward integrations.
- Analytics and advertising tools — identifiers and behaviour; personal data when they can identify a person.
- Chat and messaging tools — transcripts, names and numbers on vendor servers. Record retention.
- Payments and bookings — gateways hold transaction data under their terms; know what you hold.
- Backups and exports — backup services, developer copies, spreadsheets: the copies surviving every deletion.
Finish with two more columns: who can access each system, and how long each copy is kept.
Does the PDPL require data to stay in the UAE? The general rule and the sector exceptions
No — not as a general rule. Nothing in the PDPL says personal data must be stored inside the UAE. The law sets conditions for transferring it outside the country.
The exceptions are sector rules. Health data relating to services provided in the UAE sits under Federal Law No. 2 of 2019 on the use of ICT in health fields, which restricts storing and processing it outside the UAE, with exceptions only as health-authority decisions allow. Banking and payment data held by Central Bank-regulated institutions is likewise governed by that sector's rules. An ordinary website works under the PDPL's transfer conditions; a clinic, a regulated financial business or a government supplier must take sector advice before choosing hosting.
Cross-border transfers: what "conditions" means when your tools are overseas
Most UAE websites transfer data abroad daily, because most tools are hosted abroad. The PDPL's framework, in Articles 22 and 23, works in two steps.
First, a transfer is permitted where the destination country has data-protection legislation covering the law's core protections, or where the UAE has joined a data-protection agreement covering it. Second, where it is not in place, a transfer can proceed in listed cases — most often a contract obliging the receiving company to apply the PDPL's provisions, measures, controls and requirements. The law lists the person's express consent, contract performance, legal claims, international judicial cooperation, and the public interest.
For every overseas system in your inventory, know which case you rely on. For most tools, the vendor's data-processing terms are your transfer basis — not paperwork to click past. If a vendor cannot point to terms binding it to that standard, that row has no answer.
How long do you keep it? Retention and storage limitation, system by system
One PDPL processing control is storage limitation: personal data may not be kept after its purpose has been fulfilled, unless anonymised. The law hands owners no table of periods.
Set a period per system, from the purpose. Enquiries: keep them while the enquiry is live, plus the period needed for follow-up, disputes and records — then delete or anonymise. Chat transcripts and analytics histories are the usual offenders: both default to keeping everything as long as the tool allows — a setting, not a decision. Backups need a rule: a deletion the next restore undoes is not a deletion.
If a customer asks: access, correction, erasure and portability requests, owner workflow
The PDPL gives people rights over their data, and your inventory makes them answerable. A person can ask what data about them is processed and why, who it is shared with — inside or outside the UAE — what protections apply to cross-border processing, and how long it will be stored. They can ask for their data in a structured, machine-readable format, and its transfer to another controller where technically feasible. They can require correction of inaccurate data, and erasure in listed cases — where data is no longer needed, or consent is withdrawn. They can also require restriction and object to direct marketing. The law expects clear ways to contact you and exercise these rights — a published route, like the one in our privacy policy.
The workflow: one named person owns requests; every request is logged; the inventory says which systems to search, correct, export or delete. Two duties sit behind it. Security: measures proportionate to the risk, with encryption and pseudonymisation among the law's examples. Breaches: if a breach prejudices a person's privacy, confidentiality or security, the controller must report it to the UAE Data Office immediately on becoming aware of it, within the period and procedures the Executive Regulations set, and notify the affected person; a processor aware of a breach must notify its controller immediately.
Five questions to ask every vendor (sub-processors, location, DPA, deletion, breach notice)
Ask these in writing before you sign:
- Where exactly is our data stored and processed — which countries, including backups and support access?
- Who are your sub-processors — every company that may handle our data, and will you notify us before changes?
- Where are your data-processing terms — the contract binding you to protect the data?
- How is our data deleted — when we ask, and when we leave: what is erased, and how is it confirmed?
- How, and how fast, do you notify us of a breach — to whom, and through what channel?
"We use a global cloud" is not a location, and a sub-processor list naming only the cloud provider is incomplete if other tools see the data. If your stack was assembled with nobody asking, rebuilding it is development work — our core web development services and custom web application development teams document data flows within the build.
Common mistakes (assuming the host is the whole answer; a privacy policy copied from another country)
Assuming the host is the whole answer, when it often holds the least-used copy. Copying a privacy policy from a foreign template. Treating "we use a platform" as a compliance answer, when the platform is your processor and the duties remain yours. Forgetting the shadow copies — inbox enquiries, spreadsheets, test databases, old backups. Signing tools on terms nobody read.
FAQ
Does the UAE PDPL require my website data to be stored in the UAE?
No. The PDPL imposes no storage-location mandate; it sets conditions for transferring data outside the UAE. Localisation applies through sector rules — health and Central Bank-regulated financial data are the main examples.
What is the difference between a controller and a processor for my website?
You are normally the controller: you decide why and how data is processed. Your providers are processors, acting under your instructions and a contract. Most duties sit with the controller.
How long can I keep enquiry form submissions and chat transcripts?
The PDPL sets no fixed periods. Its rule is storage limitation: data may not be kept after its purpose has been fulfilled, unless anonymised. Set a period per system from that purpose.
What must happen if one of my vendors has a data breach?
Your processor must notify you immediately on becoming aware of a breach. As controller, if it would prejudice a person's privacy, confidentiality or security, you must report it to the UAE Data Office immediately, within the Executive Regulations' period and procedures, and notify the affected person.
Do I need to appoint a Data Protection Officer?
Only in the PDPL's listed cases: high risk through new technology or data volume, systematic assessment of sensitive data, or large amounts of it.
Not legal advice — and when to get a UAE lawyer involved (CTA)
This article is principles-level guidance built from the official text of Federal Decree-Law No. 45 of 2021. It is not legal advice — the Executive Regulations set detailed controls for several duties, and sector rules change the answer for health, financial and government work. Get a UAE lawyer involved if you process health or other sensitive data, if a request or breach has happened, or if a customer's contract asks you to warrant compliance.
For the wider landscape this article does not duplicate, read our guide to GCC data protection laws, with your inventory in hand.
