UAE PDPL Website Compliance: What Every UAE Business Must Know (2026)

What is UAE PDPL and who does it apply to

The UAE PDPL is the UAE's first comprehensive personal data protection legislation, modelled loosely on the EU's GDPR but with UAE-specific requirements. It applies to: any entity that processes personal data of UAE residents (regardless of where the entity is incorporated), any UAE-incorporated entity that processes personal data anywhere. 'Personal data' under PDPL includes: names, email addresses, phone numbers, IP addresses, cookie identifiers, browsing behaviour on your website, and any other information that can identify an individual.

Cookie consent requirements under UAE PDPL

PDPL requires 'clear and specific' consent for the processing of personal data, which extends to tracking cookies. For UAE websites: your cookie banner must explain what cookies you use and why, visitors must be able to accept or reject non-essential cookies, analytics cookies (Google Analytics), marketing cookies (Facebook Pixel, Google Ads), and personalisation cookies are all 'non-essential' and require consent, essential cookies (session, security) do not require consent. Implementation: use a consent management platform (Cookiebot, OneTrust, or CookieYes) that creates a PDPL-compliant consent log.

Privacy policy requirements for UAE websites

Every UAE business website must have a Privacy Policy that explains: what personal data you collect (contact forms, cookies, booking systems), why you collect it (purpose), how long you keep it (retention period), who you share it with (email service providers, CRM tools, payment processors), the data subject's rights (access, correction, deletion), and your contact details for privacy enquiries. Generic privacy policy templates from the internet are often insufficient ensure yours reflects your actual data processing practices.

Data subject rights: what your website must enable

Under PDPL, UAE residents whose personal data you hold have rights including: the right to know what data you hold about them, the right to request correction of inaccurate data, the right to request deletion of their data ('right to be forgotten'), the right to object to specific processing (particularly for marketing). Your website should have a mechanism for exercising these rights typically a dedicated email address or form for 'Data Privacy Requests'. You have 30 days to respond to such requests under PDPL.

Practical PDPL compliance steps for UAE businesses

Step 1: Audit what personal data your website collects list every form, cookie, and third-party tool. Step 2: Map data flows where does data go after collection (email, CRM, database, third parties)? Step 3: Update your Privacy Policy to accurately reflect your practices. Step 4: Implement a cookie consent manager with UAE PDPL-compliant consent logging. Step 5: Add a data privacy request mechanism. Step 6: Review third-party tools does your email provider, CRM, and analytics tool have adequate data processing agreements? Step 7: If you process sensitive data (health, financial), consult a UAE legal professional penalties under PDPL can reach AED 5 million.

Related reading