The short version for a business owner
You can market on WhatsApp in the UAE, but only to people who agreed to hear from you, from approved local numbers, in daytime hours, and never to numbers on the Do Not Call Register. That is the working rule set in October 2026.
Two separate legal tracks apply. The first is the federal data protection law, PDPL, which sets the principles: consent, purpose, minimisation, a right to object. The second is the telemarketing regime under Cabinet Resolutions 56 and 57 of 2024, which sets the concrete rules and the fines that regulators can apply today. Most of the practical risk sits in the second track.
One caveat on sourcing. We could not reach the official text of the telemarketing resolutions for this guide. The rules and fine amounts below come from Wiro and Zian, two industry write-ups that summarise them. Treat the numbers as a strong guide and confirm them against the resolution text before you rely on them in a contract or a dispute.
PDPL: the law is in force, the detail is not
The Personal Data Protection Law, Federal Decree-Law 45 of 2021, has applied since 2 January 2022. Consent is the basic ground for processing personal data, and article 17 gives people the right to object to direct marketing.
What the law still lacks is its executive regulations. As of 12 October 2026 they have not been published, and neither has a PDPL fine table. The law gives businesses six months to comply, but that clock starts from the date the regulations come out, not from 2022.
So you will often read that "PDPL fines don't exist yet". That is accurate for PDPL specifically. It does not mean WhatsApp marketing is unregulated, because the telemarketing fines below already apply.
Who the regulator is now
On 14 June 2026 the UAE created the Federal Authority for AI and Data. It took over the UAE Data Office and the digital arm of TDRA. When the PDPL regulations appear, expect them to come from this authority.
DIFC and ADGM run their own rules
If your company is licensed in DIFC or ADGM, you follow those free zones' own data protection laws, which SOVA and Business Dubai describe as stricter than the mainland regime. The same split applies to cookies: we found no separate cookie law for mainland UAE, so the general PDPL principles of consent, purpose and minimisation apply, while DIFC (Law 5 of 2020) and ADGM (Data Protection Regulations 2021) set tighter requirements.
Telemarketing rules that already cover WhatsApp
According to Zian and Wiro, Cabinet Resolution 56 of 2024 on telemarketing extends to marketing messages sent through messengers. In practice that means WhatsApp broadcasts and cold messages to leads. The requirements they list:
- Approval. The business needs approval to run telemarketing.
- Local numbers. Messages go out from UAE numbers.
- Opt-in. The recipient agreed in advance to receive marketing.
- Do Not Call Register. You may not contact numbers listed in the DNCR.
- Hours. Marketing messages go out between 9:00 and 18:00.
For SMS the same sources list a slightly different set: opt-in, a working unsubscribe, a quiet period from 21:00 to 7:00, and a sender ID with the AD- prefix. Note that the SMS quiet period and the 9:00–18:00 window for calls and messenger marketing are two different rules from the same summaries. If you run both channels, plan to the narrower window.
The fine table
Cabinet Resolution 57 of 2024 sets escalating fines. The three numbers in each row are for the first, second and third violation, as reported by Wiro and Zian.
| Violation | 1st | 2nd | 3rd |
|---|---|---|---|
| Telemarketing without approval | AED 75,000 | AED 100,000 | AED 150,000 |
| Contacting DNCR numbers, trading personal data | AED 50,000 | AED 75,000 | AED 150,000 |
| Sending outside permitted hours | AED 10,000 | AED 25,000 | AED 50,000 |
A single message sent at 20:30 to a number you bought from a list can touch two rows at once: wrong hours and a contact you had no right to use.
What nobody tells you: the sales rep's personal SIM
The most common Dubai setup is a salesperson sending offers from their own phone. Resolution 56 has a clause for exactly that. Article 3(2) bars a natural person from marketing in their own name from a number licensed to them, and article 4(13) bars a company from using numbers "not registered or owned by the Company", as Zian quotes the text. Table 2 of Resolution 57 fines a natural person AED 5,000 for a first violation and cuts every number in their name until it is paid. Move marketing to a business number registered to the trade licence; it is cheaper than one fine.
What a compliant WhatsApp setup looks like
None of this needs a big compliance programme. It needs four habits.
- Collect opt-in where the number comes in. A checkbox on the website form, a line in the booking flow, a reply "yes" in chat. Store the date and the wording the person agreed to.
- Keep a suppression list. Anyone who says stop, or objects under article 17 of PDPL, goes on it and never gets a campaign again. Check new numbers against the DNCR before a broadcast.
- Schedule inside the window. Set broadcasts between 9:00 and 18:00 UAE time. Automated sequences should respect the same window.
- Don't buy lists. Bought or scraped numbers fail the opt-in test and fall into the "trading data" row of the fine table.
Inbound chats are a different situation
Most of the rules above describe messages a business starts. When a customer writes to you first, from an ad, a QR code on a table or the website button, you are answering a request. The sources we checked do not describe a separate regime for that case, and we will not invent one. Two things hold either way: the data you collect in that chat falls under PDPL, and if you later want to send that person promotions, you still need their marketing consent.
The practical takeaway: the cheapest compliant growth on WhatsApp comes from making people message you, then answering them fast.
What to record when someone opts in
Opt-in only helps you if you can show it later. A screenshot of a form is weak evidence; a record in your CRM is stronger. For each contact, keep:
- The date and channel where the person agreed: website form, booking page, chat.
- The exact wording they saw, for example "Send me offers and news on WhatsApp". A vague "I agree to the terms" says nothing about marketing.
- What they agreed to. Booking confirmations and promotions are different purposes under PDPL. Ask for marketing consent separately, so a customer can book a table without signing up for campaigns.
- Any later objection. If the person writes "stop", log the date and remove them from every list, including lists your agency or a platform holds for you.
Where lawful WhatsApp leads come from
The safest contacts are the ones who start the chat. Click-to-WhatsApp ads on Meta, a "Message us" button on your site, a QR code on the menu or the shop window, a link in your Instagram bio: each of these puts the first message on the customer's side. You then answer, and if you ask for marketing consent inside that conversation, you have a clean record of how and when you got it.
Children's data from 2026
Federal Decree-Law 26 of 2025 on children's digital safety has applied since 1 January 2026, with a transition period until January 2027. For children under 13, you need parental consent. If you sell to families (kids' clubs, schools, toy shops), check how your forms and chat flows handle age. We rate this source as secondary; confirm the detail against the decree.
What to watch next
- PDPL executive regulations. When they come out, the six-month compliance window starts and a PDPL fine table finally exists.
- Guidance from the Federal Authority for AI and Data. It is the body most likely to clarify how consent should be recorded for messaging.
- The official text of CR 56 and 57 of 2024. If you run large outbound campaigns, have a lawyer read the resolutions themselves rather than summaries, including ours.
Related reading: if your campaigns involve influencers, see our guide to the UAE Advertiser Permit. Restaurants planning promotions should also read what venues can't advertise.
