UAE PDPL and your website: a plain-English privacy policy guide for 2026

Most UAE business websites were launched before the Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021) existed, and plenty still carry a two-paragraph "privacy policy" copied from a template in 2016. That is now a liability. This guide explains, in plain English, what the law expects from an ordinary company website and gives you a checklist you can hand to whoever maintains the site.

This is a practical guide from a web agency, not legal advice. For anything high-risk — health data, children's data, large-scale profiling — speak to a UAE lawyer.

Who the PDPL applies to

The PDPL covers the processing of personal data of people in the UAE by any controller or processor established in the country, and by organisations outside the UAE that process the data of people inside it. "Personal data" is anything that identifies a person directly or indirectly: a name, email address, phone number, IP address, device identifier, location, or an image.

That means a company website is in scope the moment it has any of these: a contact or quote form, a WhatsApp or call button whose clicks are tracked, Google Analytics or Meta Pixel, a newsletter sign-up, a careers page accepting CVs, or an online store.

Two important carve-outs: government entities and businesses regulated under the financial free zones. Companies in DIFC and ADGM follow those zones' own data protection laws (DIFC DP Law 2020, ADGM DPR 2021), which are close cousins of the PDPL. Health data is additionally governed by the ICT Health Law, which is why clinic websites need extra care.

The regulator and the executive regulations

The law is overseen by the UAE Data Office. The executive regulations that set out the detailed procedures have been rolling out gradually, which is why you will see conflicting advice online about deadlines. The sensible position for a business is to comply with the principles in the law now rather than wait: transparency, purpose limitation, data minimisation, security, and honouring individuals' rights.

What your privacy policy must actually say

Article 13 of the PDPL requires that people be told, before their data is collected, how it will be used. In practice your policy needs these sections:

1. Who the controller is

The legal name of the entity, its trade licence number, the emirate of registration, a postal address and a contact email. If you appointed a Data Protection Officer (required for large-scale or high-risk processing), name the role and give a contact route.

2. What data you collect and from where

Be specific. "Information you provide" is not enough. List the forms and what fields they capture, the automatically collected data (IP address, browser, pages viewed, referrer), and any data from third parties (for example a payment gateway or a CRM enrichment service).

3. Why you process it and on what legal basis

The PDPL's main bases are consent, performance of a contract, a legal obligation, and the controller's legitimate interest where it does not override the individual's rights. Map each purpose to a basis: answering your enquiry (contract or legitimate interest), sending marketing (consent), fraud prevention (legitimate interest), tax records (legal obligation).

4. Cookies and tracking

Describe the categories you use (strictly necessary, analytics, marketing), name the main tools (Google Analytics 4, Meta Pixel, Hotjar, LinkedIn Insight), and explain how consent is given and withdrawn. Link to the cookie settings control.

5. Who you share it with

Hosting provider, email delivery service, CRM, analytics vendors, payment processors, courier companies for an e-commerce store, and professional advisers. You do not have to name every sub-processor, but you must describe the categories and the purpose.

6. Cross-border transfers

This is the section most UAE sites get wrong. If your site is hosted on Vercel, AWS in Frankfurt or Google Cloud in the US, or your CRM is HubSpot, you are transferring personal data outside the UAE. The PDPL allows transfers to countries with adequate protection, or otherwise with appropriate safeguards such as contractual clauses, or with the individual's explicit consent. State where data is hosted and what safeguard you rely on.

7. Retention

Give real periods: enquiry emails kept for 24 months, invoices for 5 years under the Tax Procedures Law, CVs for 6 months, analytics data for 14 months. "As long as necessary" alone is not transparent.

8. Security

A short, honest description: HTTPS, access controls, encrypted storage with named providers, staff access on a need-to-know basis. Do not promise "military-grade security".

9. Individuals' rights

The PDPL grants rights of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions. Explain how to make a request, the email address to use, and that you will respond within the statutory period.

10. Complaints and changes

Tell people they may complain to the UAE Data Office, and state the date of the last update and how changes are announced.

Cookie consent: what "compliant" looks like

The pattern we implement on every UAE site:

• Nothing non-essential loads until consent. GA4, Meta Pixel, TikTok Pixel and chat widgets are injected only after the visitor accepts the relevant category.
• Equal-prominence choices. "Accept all" and "Reject non-essential" are the same size. A reject option hidden behind "Manage settings" is the kind of dark pattern regulators elsewhere have fined.
• Granular categories with a persistent "Cookie settings" link in the footer to withdraw consent.
• Consent records stored with a timestamp and the policy version, so you can show what the visitor agreed to.
• Bilingual banner on Arabic/English sites, served in the language of the page.

If you use Google Tag Manager, implement Consent Mode v2 so that tags respect the choice automatically.

Forms: the small print that matters

Under each form that collects personal data, add a one-line notice linking to the privacy policy, and a separate unticked checkbox for marketing consent. Do not bundle "I agree to the privacy policy and to receive offers" into one checkbox — consent must be specific and freely given.

For WhatsApp click-to-chat buttons, the conversation itself happens on Meta's platform. Mention in your policy that WhatsApp enquiries are processed through WhatsApp Business and subject to Meta's terms.

A 15-minute self-audit

1. Open your privacy policy. Does it name your actual legal entity and licence number?
2. Does it mention the UAE Data Office or the PDPL at all?
3. Does it say where data is hosted and how transfers abroad are safeguarded?
4. Open the site in a private window. Do analytics or pixel requests fire before you click anything on the cookie banner? (Check the Network tab.)
5. Is there a way to reject non-essential cookies in one click?
6. Does every form link to the policy and keep marketing consent separate?
7. Is there an email address for data subject requests, and does someone actually read it?
8. If the site is bilingual, is the policy available in Arabic?

If you answered no to three or more, the policy and consent layer need rewriting. It is a half-day job on a well-built site and the cheapest compliance win you will find.

How we handle it on the sites we build

Every website The Dev Studio builds for a UAE client ships with a PDPL-aligned privacy policy and terms in English and Arabic, a consent-gated tag setup, privacy notices on each form, and the trade licence and TRN details in the footer. You still need to fill in your entity-specific details and have a lawyer review anything unusual, but you are not starting from a blank page.