UAE PDPL website requirements, in plain English.

What the UAE PDPL is, and where it stands in 2026

The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It was issued in September 2021 and took effect on 2 January 2022. It is the UAE’s first general federal data protection law, and it borrows many ideas that readers of the EU GDPR will recognise: lawful bases for processing, transparency, data subject rights, security duties, breach notification and controls on sending data abroad.

Three points matter for anyone planning a website in 2026:

• The executive regulations have not been issued. The law leaves a lot of detail, including the administrative fines, to executive regulations. As of October 2026, published legal commentary reports that they have still not been issued. Treat any article that quotes a fixed PDPL fine or a firm compliance deadline with caution, and check the official sources below.
• The regulator is changing. The law names the UAE Data Office as regulator. In June 2026 the UAE announced a new Federal Authority for Artificial Intelligence and Data, which is reported to absorb the Data Office. How supervision will work under the new authority is not yet clear.
• The principles already apply. Pending regulations are not a reason to wait. The obligations in the law itself, such as transparency, a lawful basis and security, are in force, and they are cheaper to build into a site than to retrofit.

Who the PDPL applies to

The PDPL covers the processing of personal data of people in the UAE by businesses established in the UAE, onshore and in most free zones. Commentaries also describe it as reaching businesses outside the UAE that process the data of people in the country; if that is you, take advice on how it applies.

It does not apply to some categories that have their own rules. In summary:

• Free zones with their own data protection law, notably the DIFC in Dubai and ADGM in Abu Dhabi.
• Government data and government bodies that control or process personal data.
• Health data and banking or credit data that are covered by their own legislation.
• Purely personal or household use.

Your website collects personal data as soon as it has a contact form, analytics, a newsletter sign-up, a chat widget, a booking tool or a checkout. IP addresses and cookie identifiers count too when they can be linked to a person. So in practice almost every business website in the UAE is in scope.

Which data law applies: UAE, free zones, GCC and Syria

Where your business is established, and whose data you collect, decides which law you follow. Many regional businesses follow more than one. This table is a starting point, not a complete list.

A business with a Dubai mainland licence that sells into Saudi Arabia, for example, should read both the UAE PDPL and the Saudi PDPL. Writing one privacy programme to the stricter standard of the two is usually simpler than running two.

What your privacy notice should say

Transparency runs through the PDPL and every other law in the table. Your privacy notice is where you meet it. It should be easy to find (a footer link on every page is the norm) and written so a customer can understand it. A website privacy notice usually needs to explain:

• Who you are and how to contact you, including a privacy contact address.
• What data you collect, through forms, cookies, analytics, chat, booking and checkout.
• Why you collect it and the legal basis, for example consent or the performance of a contract.
• Who you share it with: hosting, analytics, advertising, payment, email, CRM and AI providers.
• Whether data leaves the country, and the safeguards used.
• How long you keep it, or how you decide.
• People’s rights and how to use them.
• How you protect it, and what happens if there is a breach.

Publish it in the languages your customers read. In the GCC that usually means Arabic and English, and the two versions should say the same thing.

Rights your website must be ready to handle

The PDPL gives people rights that include access to information about their data, correction, erasure, restriction of processing, objection (for example to direct marketing and certain automated decisions), data portability and withdrawing consent. You do not need a self-service portal, but you do need a route (usually an email address) and an internal process to verify the person, find their data across your tools and respond in time.

Cookie consent in the UAE

The UAE PDPL, like the Saudi PDPL, has no separate cookie rule like the EU’s ePrivacy Directive. But analytics and advertising cookies process personal data, and consent is the basis most businesses rely on for them. The approach that holds up across the region, and for EU visitors, is:

• Block non-essential tags until the visitor agrees. Analytics, advertising pixels and session recording should not load or set cookies first.
• Make Reject as easy as Accept. Both buttons on the first layer, with detailed choices on a second layer.
• Use Google Consent Mode v2 if you run Google Analytics or Google Ads. It is how Google expects consent signals to reach its tags, and without it Google’s advertising features are limited for EEA traffic.
• Honour browser privacy signals such as Global Privacy Control where you can.
• Publish a cookie policy listing every cookie and storage item, its purpose and how long it lasts.
• Let people change their mind. A footer link that reopens the consent choices is enough.

Check what actually happens, not just what the banner says. Open your site in a private window, do nothing, and look at the network requests and cookies. If analytics or ad requests fire before a choice, the set-up is not doing its job.

Transfers abroad, hosting and data location

Most websites send data outside the UAE without anyone noticing: analytics, email platforms, CRMs, chat tools and AI APIs are often hosted in Europe or the United States. The PDPL allows transfers to countries with adequate protection and, otherwise, under safeguards such as contracts or, in some cases, the person’s explicit consent. The details are among the things the executive regulations are expected to settle.

Practical steps while you wait:

• Keep a short data map: each tool, what it collects, where it stores data.
• Sign a data processing agreement with each provider that handles personal data for you, and keep their sub-processor lists.
• Say in your privacy notice that data may be transferred abroad, and why.

Some sectors have firmer location rules than the PDPL:

• Health data in the UAE. Federal Law No. 2 of 2019 on the use of ICT in health fields restricts storing and processing health data outside the country, with exceptions set by the health authorities.
• Saudi Arabia. Transfers of personal data outside the Kingdom follow SDAIA’s transfer regulations, and government and critical-sector bodies follow National Cybersecurity Authority controls.
• Financial services. Central banks and financial regulators can impose their own outsourcing and data-location rules.

If one of these applies, host on a regional cloud or local data centre and document where each system (website, CRM, chat, analytics, AI) keeps its data.

Security and breach notification

The PDPL expects appropriate technical and organisational measures to protect personal data, and it requires controllers to notify the regulator of breaches that affect privacy, and in some cases the people affected. Some organisations must also appoint a data protection officer; the law ties that to the type and scale of processing rather than to every business. For a website, the baseline looks like this:

• HTTPS everywhere, with HSTS.
• Security headers: a content security policy, X-Content-Type-Options and frame protection.
• Spam protection on forms that is enforced on the server, not only in the browser, plus rate limits on forms and logins.
• Regular updates to the CMS, plugins and libraries.
• Backups that you have actually tested restoring.
• A written breach plan: who decides, who notifies the regulator and customers, and how fast.

Card data deserves its own rule: let a licensed payment gateway handle it through hosted fields, a redirect or tokenisation, and never store card numbers yourself. That keeps your site out of the heaviest PCI DSS scope.

Other website requirements in the UAE and GCC

Privacy is the biggest legal topic for most websites, but buyers and procurement teams in the region also ask about these:

Accessibility

The UAE has strong policy commitments to inclusion for People of Determination, and government digital services follow WCAG-based standards. For private businesses accessibility is not uniformly mandatory, but WCAG 2.1 or 2.2 Level AA is the recognised benchmark. Key practices: sufficient contrast, keyboard navigation with visible focus, alt text, captions, labelled form fields, correct lang and dir attributes on Arabic and English content, and respect for reduced-motion settings.

Business identity, prices and VAT

Show your legal business name, licence or commercial registration details and contact information, plus delivery, return and refund terms if you sell online. Standard VAT rates as of October 2026:

In Saudi Arabia, invoices must follow ZATCA’s e-invoicing (FATOORAH) requirements, so check that your store or invoicing system is compliant.

Payments

Use a licensed gateway and support the methods your customers expect: cards and Apple Pay across the region, mada in Saudi Arabia, KNET in Kuwait, NAPS in Qatar, BenefitPay in Bahrain and OmanNet in Oman. In Syria, international card payments only began in May 2026, and cash on delivery and local wallets remain the norm. Our website cost guide covers what payment integration adds to a budget.

UAE PDPL website checklist

Privacy

• A privacy notice covering data, purposes, legal bases, sharing, transfers, retention and rights, in Arabic and English.
• A privacy contact address that someone reads.
• A data map: which tools collect what, and where they store it.
• Data processing agreements with hosting, email, analytics, CRM and AI providers.
• A process for access, correction and deletion requests.

Cookies

• Non-essential tags blocked until consent, checked in a private window.
• Accept and Reject on the first layer.
• Google Consent Mode v2 if you use Google tags.
• A cookie policy listing every cookie and storage item.
• A footer link to change consent at any time.

Security and hosting

• HTTPS, HSTS and security headers.
• Server-side spam protection and rate limits on forms.
• Tested backups, an update routine and a written breach plan.
• Hosting location reviewed against sector rules (health, finance, government).

Commerce and accessibility

• Business identity, licence details, VAT treatment, returns and terms visible.
• Card data handled only by a licensed gateway.
• WCAG 2.1 or 2.2 AA as the accessibility target.

How Nexlla builds this into a website

Nexlla Creative Agency is a design and technology studio headquartered in Dubai, working with clients across the UAE, the GCC and Syria. nexlla.com is a working example of the practices in this guide, and everything below is published on this site:

• Consent-based analytics. Google Analytics and Google Ads load only after opt-in, using Google Consent Mode v2, and Global Privacy Control is honoured. The cookie policy lists every cookie and storage item.
• Privacy documents written for the region. The privacy policy covers the data collected, legal bases, AI providers, sharing, retention and rights under the UAE PDPL, GCC laws, the GDPR and US state laws. Nexlla never sells personal data and does not train AI on client material.
• A data processing agreement for client data in Nexlla platforms, with 48-hour breach notice and a published sub-processor list: see the DPA.
• Security headers on nexlla.com, including HSTS, X-Content-Type-Options, frame protection and a content security policy, plus server-enforced spam protection on the contact form.
• A legal centre and a trust page. The legal centre and trust & security page set out terms, acceptable use, IP ownership on delivery and live system status.

Every project is quoted individually: a short discovery call, then a written plan with scope, a timeline and a fixed first milestone. See how we work, or ask us to review your website.