If your business collects names, phone numbers, email addresses, Emirates ID copies or any other personal data from people in the UAE, the Personal Data Protection Law (PDPL) applies to you, unless you operate in the DIFC or ADGM, which have their own laws. It has been in force since 2 January 2022. The executive regulations that will fix breach deadlines and penalties were still unpublished when we checked in October 2026, but the core duties are already in the decree-law, and they are the ones websites and apps most often get wrong.
This is general information, not legal advice. Check your own position with a lawyer who practises UAE data protection law.
Does the PDPL apply to you?
The law covers the processing of personal data, by electronic or other means, of people who live or have a place of business in the UAE. It also covers controllers and processors based in the UAE whoever the data belongs to, and businesses abroad that process data of people in the UAE.
Personal data is defined broadly: anything that identifies a person directly or indirectly, including a name, voice, ID number, online identifier or location. Sensitive data, such as health, biometric, religious or criminal-record information, gets stricter treatment.
The PDPL does not apply to:
- government data and government entities,
- personal data held by security and judicial authorities,
- people processing their own data for personal purposes,
- health data, and banking and credit data, that have their own laws, and
- companies in free zones with their own data protection laws, such as the DIFC (Data Protection Law, DIFC Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021).
A small business is not automatically exempt. The Data Office may exempt businesses that don't process large volumes of personal data, but only under criteria in the executive regulations.
Where things stand in 2026
The decree-law left a lot of detail to executive regulations, which the Cabinet was meant to issue within six months. As of October 2026, neither the government's data protection page on u.ae nor the most recent law-firm guidance we checked showed them as published. The regulator, the UAE Data Office, was set up by Federal Decree-Law No. 44 of 2021, and u.ae still describes its supervisory role in the future tense.
Three things are missing as a result:
- the deadline and format for reporting breaches,
- the list of violations and administrative penalties, which Article 26 leaves to a Cabinet decision, and
- detailed conditions for some transfers of data abroad.
Once the regulations are issued, businesses get up to six months to bring their processing into line, and the Cabinet can extend that once by a similar period.
Waiting is still a poor strategy. The duties below are already law, other rules such as the Consumer Protection Law and sector rules on health data already apply, and six months is short for a business that has never mapped its data.
Consent and the other legal grounds
The starting rule is strict: you may not process personal data without the person's consent unless one of the exceptions in Article 4 applies. The ones most businesses use are:
- performing a contract with the person, or steps they ask for before entering one,
- meeting an obligation under another UAE law,
- employment and social security obligations,
- legal claims and judicial procedures, and
- data the person has made public themselves.
There is no general "legitimate interests" ground of the kind found in the EU's GDPR. In practice, sending marketing to people who haven't agreed to it is hard to justify.
Where you rely on consent, it must be specific, clear and unambiguous, given by a statement or a clear positive action. You must be able to prove it, the request must be easy to understand, it must say people can withdraw, and withdrawing must be easy. A pre-ticked box, or consent buried in your terms and conditions, is hard to defend against that standard.
Article 5 adds the familiar principles: collect data for a specific, clear purpose, only as much as you need, keep it accurate and secure, and don't keep it once the purpose is fulfilled unless it has been anonymised.
The rights people can exercise
| Right | What it means for your business |
|---|---|
| Information | Tell people, free of charge, what you hold, why, who receives it and how to complain |
| Portability | Hand over their data in a machine-readable format where processing is automated and based on consent or a contract |
| Correction and erasure | Fix inaccurate data without undue delay, and delete it in listed cases, such as withdrawn consent |
| Restriction | Pause processing while accuracy or lawfulness is disputed |
| Objection | Stop processing for direct marketing, including related profiling |
| Automated decisions | Accept objections to automated decisions with legal or serious effects, and add human review on request |
Before processing starts, you must tell people at least the purpose, who will receive their data inside and outside the UAE, and how any transfer abroad is protected. You must also give them a clear way to contact you to use these rights.
Breaches, records and data protection officers
- Breaches. When you become aware of a breach that could harm people's privacy, confidentiality or security, you must report it to the Data Office with its nature and cause, roughly how many people are affected, your data protection officer's details, the likely effects and the measures you have taken, and you must tell the people affected. The regulations will set the deadline. A processor must tell you as soon as it knows.
- Records. Keep a record of processing covering the categories of data, who can access it, purposes, retention periods, transfers abroad and security measures. The Data Office can ask to see it.
- Data protection officer. Required where processing creates a high risk because of new technology or volume, involves systematic assessment of sensitive data including profiling, or covers large volumes of sensitive data. The officer can be an employee or an appointed provider, inside or outside the UAE.
- Impact assessments. Before high-risk processing using new technology, assess the effect on privacy, including whether the processing is necessary and how you will reduce the risks.
Sending data outside the UAE
Most businesses do this without noticing: hosting, CRM, email marketing and analytics tools often store data in other countries. The PDPL allows transfers to countries whose data protection laws are approved as adequate, or where the UAE has a relevant agreement. Otherwise a transfer can rely on a contract binding the recipient to the PDPL's standards, the person's express consent, performing a contract with the person, legal claims, international judicial cooperation or the public interest.
Until the Data Office publishes which countries it treats as adequate, the practical route is a written data processing agreement with each vendor that commits it to equivalent protection. Check where each tool stores data before you sign up, not after.
A checklist for your website or app
- Map your data. List every form, cookie, tool and integration that collects personal data, where it is stored and who can see it.
- Publish a privacy notice people can find, in every language your site uses. If you run an Arabic version, the notice belongs on it too; our guide to building a bilingual Arabic and English website covers the rest of that work.
- Ask for consent properly. Unticked boxes, separate consent for marketing, and an easy opt-out in every message.
- Handle cookies deliberately. Analytics and advertising cookies usually rely on online identifiers, which count as personal data, so block non-essential cookies until people agree. Measurement still matters for local SEO and marketing; set it up to respect consent rather than dropping it.
- Collect less. Don't ask for a date of birth or an Emirates ID number on an enquiry form unless you truly need it.
- Sign processor agreements with your hosting, CRM, email and analytics vendors, covering purpose, security, deletion and breach notice.
- Set retention periods, then delete or anonymise data when they end.
- Prepare for breaches and requests: a named owner, a contact address and a simple log.
When we build web platforms and mobile apps, we design consent, data minimisation and deletion into the product from the start, because retrofitting them later is slower and costs more. If you want a technical review of your site's data flows before launch, book a free consultation.
Sources
Frequently asked questions
Does the PDPL apply to free zone companies?
Do I need a cookie banner in the UAE?
What are the penalties for breaching the PDPL?
Does the PDPL cover employee data?
Do small businesses have to comply with the PDPL?
Found this useful? Pass it on.