Where the PDPL stands for a website in October 2026
The Personal Data Protection Law, Federal Decree-Law 45 of 2021, covers any business that processes personal data of people in the UAE, including companies abroad (Article 2). A website does that the moment it stores a name from a contact form, a phone number from a WhatsApp button or an identifier in a cookie.
Three facts set the risk level today:
- The law binds you now. It has applied since 2 January 2022. As SOVA puts it, the executive regulations add operational detail; they do not create the duties.
- The detail is missing. Article 28 required executive regulations within six months of September 2021. ITSEC found none on the UAE legislation portal as of 24 September 2026, and no Cabinet decision setting fines under Article 26. When the regulations appear, Article 29 gives businesses six months to comply.
- A regulator now exists. On 14 June 2026 the UAE created the Federal Authority for AI and Data, which absorbed the dormant UAE Data Office. Morgan Lewis expects it to finalise the regulations and bring PDPL enforcement into its mandate.
If you also send marketing on WhatsApp or SMS, a separate telemarketing regime with fines already in force applies. We covered it in WhatsApp marketing rules and PDPL; this guide stays on the website itself.
Mainland, DIFC or ADGM: which law covers your site
Article 2(2) of the PDPL excludes free zones that have their own data protection law. The law that applies follows the licence of the company running the site, not the server location.
| Company licensed in | Law | Website rules in practice |
|---|---|---|
| Mainland or most free zones | PDPL, Decree-Law 45/2021 | Principles in force; regulations and fines pending |
| DIFC | Data Protection Law 5 of 2020 and DIFC DP Regulations | Specific cookie and consent rules (Regulation 9), active Commissioner |
| ADGM | Data Protection Regulations 2021 | Benchmarked to GDPR, active Commissioner |
A group with a mainland trading company and a DIFC holding company may need two sets of notices. Map which entity owns each website and form.
Cookies and consent banners
We found no cookie law for mainland UAE. What applies is the PDPL definition of consent: a specific, clear and unambiguous indication through a clear positive statement or action. Article 6 adds three conditions. You must be able to prove the consent, the request must be clear, simple and easy to access, and it must say how to withdraw consent, which has to be easy.
For a banner, that translates into:
- Strictly necessary cookies (session, security, the language switch) run without a choice, and the notice says so.
- Analytics and advertising cookies wait until the visitor clicks "Accept". A banner that says "by browsing you agree" gives you nothing to prove.
- "Reject" is as easy as "Accept", and a link in the footer lets people change their mind later.
- You keep a log: the date, the choice and the banner version.
DIFC spells this out. Regulation 9 covers cookies for personalisation, analytics or ad profiles and pixel tracking. Consent needs at least an unticked selection box or another positive selection and a link to the privacy policy. The DIFC Commissioner's consent guidance says failing to untick a pre-ticked box is not consent.
Contact forms and lead capture
A contact form is where most small sites collect personal data. Three rules from the law shape it.
- Purpose. Article 13(2) requires you to tell people why you collect the data before processing starts. One line under the form works: "We use your number to reply to this request."
- Separate marketing consent. Article 17 gives people the right to object to direct marketing. Put an unticked checkbox for offers and news apart from the request itself, so a client can ask for a quote without joining your mailing list.
- Minimum fields. Article 5 requires data to be limited to what the purpose needs. A quote form rarely needs a date of birth or a passport number.
Leads often go straight from the form into a CRM, a Google Sheet or a WhatsApp inbox. Each tool is a recipient, and many sit on servers outside the UAE, which brings in the transfer rules below.
What the privacy policy must say
Article 13 lists what a person can ask you for, free of charge. Article 13(2) makes three items mandatory before processing starts:
| Before processing (Art. 13(2)) | On request (Art. 13(1)) |
|---|---|
| Purpose of processing | Types of personal data you hold |
| Sectors or companies you share data with, inside and outside the UAE | Retention rules |
| Safeguards for transfers abroad (Art. 22–23) | Automated decisions and profiling |
| How to correct, erase, restrict or object | |
| What you do after a data breach | |
| How to complain to the regulator |
A policy copied from a European template usually covers these points but cites the GDPR and an EU authority. Replace those references with the PDPL, name your actual tools (CRM, analytics, ad platforms, hosting) and give a contact for requests. Consumer-facing information in the UAE also has Arabic-language requirements; see our guide to Arabic language rules for ads and websites.
Analytics, pixels and data leaving the UAE
Google Analytics, the Meta Pixel and most CRMs send data abroad. The PDPL treats that as cross-border processing.
- Article 22 allows transfers to countries with adequate data protection law, or under a treaty, in cases the regulator approves. No list of approved countries has been published.
- Article 23 allows transfers elsewhere under a contract that imposes PDPL-level protection, with the person's explicit consent, or when needed to perform a contract in their interest. Article 23(2) leaves the detailed controls to the executive regulations, which do not exist yet.
In practice: sign the vendor's data processing terms, list each tool in the privacy policy with the country, and load ad pixels only after consent. On IP addresses, Google states that in GA4 IP addresses are not logged or stored. The Meta Pixel, by design, builds ad audiences, so treat it as marketing and keep it behind the "Accept" button.
Where sources disagree
Several pages claim the executive regulations already exist. Multilaw's guide names Cabinet Decision 83 of 2022. Business Dubai lists other numbers in circulation, 111 of 2023 and 33 of 2024, and could not verify any of them. ITSEC checked the official legislation portal on 23 September 2026 and found no regulations. We follow the portal check.
The same goes for fines. Figures of AED 50,000 to AED 5 million and a 72-hour breach deadline circulate online, but Business Dubai could not trace them to any published instrument. There is no official PDPL fine table to quote yet.
A checklist for your site
- Find which entity owns the site and whether PDPL, DIFC or ADGM rules apply.
- List every tool that receives visitor data, with its country.
- Hold analytics and ad cookies until the visitor accepts, and log the choice.
- Add a purpose line under each form and a separate, unticked marketing checkbox.
- Rewrite the privacy policy around Article 13, with a contact for requests.
- Check the legislation portal for the executive regulations; the six-month clock starts on publication.
