Your website collects personal data. Here's what UAE law expects.

This is a plain-language overview, not legal advice. For your specific situation, ask a lawyer.

If your website has a contact form, it collects personal data: names, emails, phone numbers. In the UAE, that's covered by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (usually called the PDPL). It came into force on 2 January 2022 ^[1].

Does it apply to you?

Probably. It covers personal data of people in the UAE, and businesses processing it whether they're inside the UAE or outside it ^[2].

There are exceptions. Businesses in the DIFC and ADGM free zones follow those zones' own data protection laws instead, and so do some regulated sectors such as health and banking data ^[2]. If you're set up in one of those, check your zone's rules. They're similar in spirit, with their own details.

"But the regulations aren't out yet"

True. The implementing regulations, which fill in details such as breach-reporting deadlines and fines, still hadn't been issued as of March 2026 ^[3]. The law itself is in force, though, and its core duties don't depend on those details ^[2]. The safe approach is to meet them now, so new rules don't send you scrambling.

What your website actually touches

• Contact and quote forms. Names, emails, phone numbers, sometimes company details.
• WhatsApp and live chat. Phone numbers and message history.
• Analytics. Many tools set cookies and record visitor behaviour.
• Newsletter sign-ups. Emails plus consent to contact.
• The tools behind the site. Your CRM, email provider and hosting all store this data too.

The five things the law expects

1. A lawful reason, usually consent. You need consent to process personal data, unless an exception applies, such as steps someone asked for before a contract (a quote request, for example) ^[2]. Consent has to be specific, clear and easy to withdraw.
2. Consent before non-essential cookies. There's no separate cookie law. Data protection law applies to cookies anyway, and that means explicit consent before non-essential cookies run, with a clear way to opt out ^[3]. Cookie-free analytics avoid the problem altogether. This website uses them, so there's no cookie banner to click.
3. Respect people's rights. People can ask to see their data, correct it, delete it, move it, restrict it, or object to how it's used (Articles 13 to 17) ^[2]. Someone has to own those requests, and your systems must be able to find a person's data.
4. Keep it secure, and report breaches. If data leaks, the law says you must report it to the UAE Data Office straight away (Article 9). The exact deadline will come with the regulations ^[2].
5. Watch where data goes. Sending personal data outside the UAE is restricted to countries with adequate protection, and the Data Office hasn't published the details yet ^[2]. Many form, email and CRM tools store data abroad, so know where yours sit.

A 30-minute check for your website

1. List every form, chat widget and script on your site. What does each collect?
2. Check your privacy policy. Does it name what you collect, why, who processes it, and how to ask for deletion?
3. Open your site in a private window. Do analytics or ad cookies load before anyone agrees?
4. Ask your providers (form tool, CRM, email, hosting) where they store data.
5. Name one person who handles data requests and breaches.

If any answer is "not sure", that's your list.