The law
The UAE's Personal Data Protection Law is Federal Decree-Law No. 45 of 2021, which came into effect on 2 January 2022. The UAE Data Office is the regulator. Summaries note that its executive regulations have been pending, so some details, such as breach notification deadlines and sanctions, remain in transition. Clyde & Co's summary also notes that businesses get six months from the issue of those regulations to comply. Check the current status with the UAE Data Office or a lawyer before relying on any grace period.
My view as a marketer: the principles are already clear enough to build good habits now. Consent-based lists are better lists anyway. People who chose to hear from you open, reply and buy more than people who didn't.
Where it applies, and where it doesn't
The law has a broad reach, including organisations outside the UAE that process data of people here. It also carves out several areas.
- It applies to processing personal data of people in the UAE, including by many private businesses.
- Financial free zones DIFC and ADGM have their own data protection laws.
- Some sectors, such as health and banking data, are covered by their own specific laws.
- Government data and processing for purely personal purposes are also excluded.
Consent
Consent is the default legal basis under the PDPL, though there are listed exceptions, such as performing a contract or meeting a legal obligation. Valid consent should be specific, clear and unambiguous, given in writing or electronically, and possible to withdraw at any time. You also need to be able to prove you obtained it.
One difference from GDPR matters for marketers. Clyde & Co point out that the UAE law doesn't include "legitimate interests" as a basis for processing, and that no exception to consent covers direct marketing. People also have a right to object to direct marketing. In practice: get a clear opt-in before sending marketing messages, and stop when someone asks.
Rights your contacts have
Summaries of the law list rights including:
- Getting information about what you hold on them.
- Correcting inaccurate data, or having it erased.
- Restricting processing in some cases, and objecting to direct marketing.
- Asking for their data to be transferred, and objecting to purely automated decisions.
- Withdrawing consent at any time.
You don't need a legal department to handle this. You need one inbox where requests arrive, a named person who answers them, and the ability to find and delete one person's data across your CRM, email tool and WhatsApp.
What this means for marketing
Websites · Dubai
Channel by channel
| Channel | What to do | Common mistake |
|---|---|---|
| Website forms | State what you'll use the data for. Add an unticked opt-in box for marketing. | Pre-ticked boxes, or one checkbox covering terms and marketing together |
| Email lists | Record when and how each person opted in. Unsubscribe link in every email. | Importing contacts from an old business, event or business-card pile |
| Message only people who gave you their number and opted in. Honour every opt-out. | Adding numbers to broadcast lists without asking | |
| Analytics and ad pixels | Explain them in your privacy notice, with the tools you use. | A copied privacy notice that mentions none of your actual tools |
| Bought lists | Avoid them. You can't show the people on them consented. | Assuming the seller's word counts as consent |
WhatsApp has its own rules on top of the law. Its Business Messaging Policy says businesses may contact people only if they shared their number and gave opt-in permission to receive messages, and that every request to block or opt out must be respected. More on running WhatsApp campaigns in click-to-WhatsApp ads.
Phone marketing has separate rules
Telemarketing is covered by Cabinet Resolution No. 56 of 2024, effective 27 August 2024. According to Clyde & Co's summary, marketing calls are limited to 9am to 6pm, must come from local numbers registered under the company's licence (not personal phones), and must not go to numbers on the Do Not Call Registry. If someone declines, you shouldn't call again about that product, and there are limits on how often you can call. Fines for calling registered numbers start at AED 50,000.
Privacy notice
Summaries note the law doesn't explicitly require a privacy notice, but publishing one is strongly advisable as the clearest way to explain your processing and collect informed consent. A useful notice for a small business covers:
- Who you are and how to contact you about data.
- What you collect through forms, WhatsApp, calls and cookies.
- Why you collect it, and the tools that process it (CRM, email platform, analytics, ad platforms).
- How long you keep it, and how people can access, correct or delete it.
Websites · Dubai
Where I start with a client
Map the data
List every place personal data comes in: forms, lead ads, WhatsApp, calls, events.
Fix the forms
Add a purpose line and a separate, unticked marketing opt-in.
Record consent
Store the date, source and wording each contact agreed to.
Clean the lists
Remove contacts you can't show opted in.
Publish the notice
Plain language, matching the tools you actually use.
If you're in DIFC or ADGM
Check your free zone's own data protection law, which has its own requirements.
If you want this built into a new site from the start, it's part of how I set up websites in Dubai, and the small business website checklist shows where it fits alongside everything else.