UAE PDPL Compliance Checklist for Business Websites

Your contact form collects names, emails and phone numbers. Your analytics tracks visitors. Your chat widget stores conversations, and your newsletter tool sits on a server in another country.

Then a client emails: "Is your website PDPL compliant?"

If that question made you pause, you are in good company. This UAE PDPL compliance checklist turns the law into ten practical website tasks, in plain language. It is not legal advice, but it will show you what to fix first and what to ask your lawyer.

Quick Answer

The UAE Personal Data Protection Law (PDPL) requires businesses to handle personal data lawfully, usually with clear consent, a transparent privacy notice, limited data collection, strong security and ways for people to use their rights. For a website, that means reviewing your forms, tracking tools, vendors and data storage, then fixing the gaps.

Key Takeaways

• The PDPL covers personal data about people in the UAE, including data handled by companies outside the country.
• Consent must be a clear positive action that you can prove and the person can withdraw.
• Tell people what you collect, why, who receives it and whether it goes abroad.
• Collect less, keep it for less time and protect what you hold.
• Some details depend on executive regulations, so check the current position with a lawyer.

What Is the UAE PDPL?

The PDPL is the UAE's federal data protection law, Federal Decree-Law No. 45 of 2021. According to the government's page on data protection laws, it came into force on 2 January 2022 and prohibits processing personal data without the owner's consent, with limited exceptions.

What counts as personal data on a website?

Any information that identifies a person. On a typical business site that includes:

• Names, emails and phone numbers from forms
• Account details and order history
• Chat and WhatsApp enquiries
• Information collected by tracking tools that can identify a visitor

Why the status caveat matters

Parts of the law, such as timing for breach notices, the threshold for appointing a data protection officer and cross-border controls, are left to executive regulations. Rules and enforcement details can change, so confirm the current position with a qualified UAE lawyer before you rely on this guide.

Does the UAE PDPL Apply to Your Business Website?

Probably, if you handle personal data about people in the UAE. The law's scope reaches businesses inside the UAE and those outside it that process data of people in the UAE.

It also lists exclusions. These include government data, personal-purpose processing by individuals, health data covered by separate legislation, personal banking and credit data, and free-zone entities that have their own data protection laws.

That last point matters in the UAE. If your company sits in a free zone with its own data law, different rules may apply to you. Ask your lawyer which regime covers each part of your business.

UAE PDPL Compliance Checklist: What Should Your Website Do?

The law's text, Federal Decree-Law No. 45 of 2021, points to ten website tasks:

1. Map your data. List every place your site collects personal data: forms, accounts, checkout, chat, newsletter sign-ups and analytics.
2. Check the legal basis. Decide where you need consent and where another basis may apply.
3. Collect consent properly. Use a clear positive action, never a pre-ticked box.
4. Publish a clear privacy notice. Say what you collect, why, who receives it and whether it leaves the UAE.
5. Collect less. Ask only for what you need.
6. Set retention rules. Keep data only as long as you need it.
7. Offer a way to use data rights. Give people a clear contact route.
8. Secure the data. Use encryption, access control and regular testing.
9. Check vendors and overseas tools. Know who processes data for you and where.
10. Prepare for incidents. Have a breach plan and know who decides what.

The next sections explain each one.

How Do You Handle Consent on Forms and Tracking?

Consent is central to the PDPL. The law says consent must be given through a clear positive statement or action. You must be able to prove it, present it in clear and simple language, and make it easy to withdraw.

Practical consent rules for your site

• No pre-ticked boxes. The visitor should actively choose.
• One purpose, one choice. Do not bundle newsletter sign-up into a contact form consent.
• Keep a record. Store when and how someone agreed.
• Make withdrawal easy. An unsubscribe link or settings page should work.

What about cookies and tracking tools?

In the sections of the law we reviewed, we found no cookie-specific rule. The safe approach is to treat any tracker that can identify a person as personal data and ask your lawyer how consent should apply. Your tag setup should also respect the choices visitors make, which is the kind of consent-aware setup GA4 and GTM services in Dubai can configure.

What Should Your Privacy Notice Say?

The law requires you to give people information before processing their data. That includes the purposes, the recipients and any cross-border sharing, along with the protections that apply.

A good website privacy notice includes:

• Who you are and how to contact you
• What data you collect and from which forms or tools
• Why you collect it (each purpose)
• Who receives it, such as hosting, email or payment providers
• Whether it goes abroad and what protections apply
• How long you keep it
• How people can exercise their rights

Write it in plain English and Arabic if you serve both audiences. A notice nobody can read does not help anyone.

How Should You Collect and Store Less Data?

The law's principles include data minimisation, purpose limitation, accuracy and storage limitation. In plain terms: ask for less, use it only for what you said and delete it when you no longer need it.

Review each form:

• Do you need a date of birth, or just an email?
• Do you need a full address before checkout?
• Are old enquiries and abandoned accounts piling up?
• Does a "download our brochure" form really need a phone number?

Every field you remove is one less thing to protect, explain and delete later.

How Do You Protect the Data You Hold?

The law requires appropriate technical and organisational security. It lists measures such as encryption, pseudonymisation, system resilience, restoring data in time and regular testing.

For a business website, that translates into:

• HTTPS everywhere
• Updated software, plugins and themes
• Strong passwords and multi-factor authentication
• Limited admin access
• Regular backups and restore tests
• Secure forms and databases

Our guide to website security best practices for businesses covers these steps in detail.

What About Overseas Tools and Hosting?

Most modern sites rely on tools hosted abroad, including analytics, CRM, email platforms and cloud hosting. The PDPL has rules for cross-border transfers.

In summary, the law allows transfers to countries with adequate protection, and it lists other routes, such as a contract imposing equivalent safeguards or the explicit consent of the person. It also expects you to choose processors that provide sufficient guarantees.

Make a simple vendor table:

Where the data lives can also be a business decision, as our piece on AI sovereignty and local data hosting in the UAE explains. Ask your lawyer before you move data or change vendors.

How Do You Handle User Rights and Data Breaches?

Rights people can use

The law gives individuals rights that include access to their data, correction, erasure in listed cases, portability, restriction, and objection to direct marketing. Controllers must offer clear channels for people to exercise these rights.

For your site, that means:

• A visible contact address for privacy requests
• A process to verify who is asking
• A simple internal checklist for finding and updating a person's data
• Someone responsible for replying on time

If something goes wrong

The law requires notifying the regulator of certain breaches and, in some cases, the people affected. The timing and format are left to executive regulations, so agree your internal steps now: who investigates, who decides, who contacts whom.

Many owners find this part the hardest, and Milaaj Brandset recommends settling it before anything goes wrong, because a plan written during an incident is rarely a good one.

Do You Need a Data Protection Officer?

Not every business does. The law requires a data protection officer where processing is high risk because of new technology or data volume, involves systematic assessment of sensitive data, or involves large amounts of sensitive data. The exact thresholds are left to executive regulations.

Sensitive data under the law includes things like health, biometric, genetic, religious and criminal-record information. If your site handles any of these at scale, ask your lawyer. A small brochure website usually will not meet these conditions, but the answer depends on your activity.

The law also expects a record of your processing activities, so even if you do not need a DPO, document what you do.

Which Step of the UAE PDPL Compliance Checklist Should You Do First?

Start with a data map, then fix consent and your privacy notice. List every place your website collects personal data, check what you really need, and update forms and notices accordingly. Then secure the data and review your vendors. Take legal advice for your sector before you finalise anything.

A simple priority order:

1. Data map
2. Consent and privacy notice
3. Removing unnecessary form fields
4. Security basics
5. Vendor review and transfers
6. Rights and breach process

Frequently Asked Questions

Does the UAE PDPL apply to my business website?

It can. The law covers processing of personal data about people in the UAE, including by businesses outside the country. It excludes some categories, such as certain government, health and banking data and free zones with their own data laws, so check which applies to you.

Do I need a cookie banner under the PDPL?

The sections of the law we reviewed do not mention cookies by name. If a tracker can identify a person, treat the data as personal data and ask your lawyer how consent applies to your tools.

What should a UAE website privacy policy include?

It should say who you are, what data you collect, why, who receives it, whether it goes abroad, how long you keep it and how people can use their rights. Write it clearly, and consider providing Arabic and English versions.

Do I need a Data Protection Officer?

Only in listed cases, such as high-risk processing or large-scale handling of sensitive data. Thresholds depend on executive regulations. Most small brochure sites will not need one, but check with a lawyer.

Can I use overseas tools like analytics or a foreign CRM under the PDPL?

Often yes, but the law has rules on cross-border transfers. You need an adequate-protection basis or another allowed route, such as a contract with equivalent safeguards. Review each vendor and take legal advice.

Final Thoughts

A UAE PDPL compliance checklist will not make you a lawyer, and it should not. It helps you see your website the way a regulator or a careful customer would: what you collect, why, where it goes and how well you protect it.

Start with the data map this week. Fix what is simple, write down what is not, and bring the rest to a qualified UAE lawyer. If your forms, tracking or hosting need to change, web development services in Dubai can rebuild them with consent, security and clean data handling in mind.

This article is general information, not legal advice. Treat your website as something you can improve step by step, not a problem you have to solve in one weekend.