The UAE Personal Data Protection Law and your company website

A "Contact us" form, a quote request, an appointment booking, a newsletter sign-up. Each of them collects a name, a phone number and an e-mail address, and all of that is personal data protected by law in the UAE.

The law in question is Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data. It was issued on 20 September 2021 and came into force on 2 January 2022. Its obligations fall on your company itself, not only on the developer or the hosting company. This article explains what that means for a company website, and when different rules apply if your company is licensed in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM).

It is for information and is not legal advice. For specific cases, ask a lawyer, and refer to the official text on the UAE legislation portal (in Arabic).

Who the law applies to

Under Article 2, the law applies to the processing of personal data of anyone who resides or has a place of business in the UAE, to every controller or processor located in the UAE even if it processes the data of people outside it, and to a controller or processor outside the UAE that processes the data of people inside it.

In the law's terms, the controller is whoever decides how and why data is processed, which means your company. The processor is whoever processes it on your behalf and on your instructions: the hosting company, the agency that runs the website, the newsletter tool, the booking system.

The law excludes several categories. The most relevant for business owners:

• health data that has its own legislation governing its protection and processing,
• banking and credit data that has its own legislation,
• companies and establishments in free zones that have their own personal data protection legislation, most notably DIFC and ADGM.

The authority responsible for the law is the UAE Data Office, established by Federal Decree-Law No. (44) of 2021.

What your website actually collects

The law's definition is broad: personal data is any data relating to an identified natural person, or one who can be identified directly or indirectly. Its examples include name, voice, image, ID number, electronic identifier and geographic location.

On an ordinary company website this data turns up in many places:

• contact, quote request and appointment booking forms,
• customer accounts and orders in an online shop,
• job application forms that receive CVs,
• newsletter sign-up,
• analytics and advertising tools, because they rely on electronic identifiers of the visitor.

Start with a simple list: every form and every tool on the website, what data it collects, where it goes (a mailbox, a CRM, a spreadsheet), who can read it, and how long it is kept. That list is the basis of the record required by Article 7, which covers the categories of data, who is entitled to access it, the purpose of processing, any transfer outside the UAE, and the information security measures. The controller provides it to the Data Office on request.

Consent and notice before the visitor clicks "Send"

The starting point in Article 4 is that processing personal data without the data subject's consent is prohibited, with specific exceptions. Among the exceptions that matter for websites: processing that is necessary to perform a contract the data subject is party to, to take steps at their request with a view to concluding a contract, or to meet an obligation that another law places on your company. Replying to a quote request is one thing. Adding the same person to your marketing list is another.

When you rely on consent, Article 6 requires it to be clear, simple, unambiguous and easily accessible, for you to be able to prove it, and for it to include the data subject's right to withdraw it in an easy way. Article 13 requires you to tell them, before processing starts, its purposes, the parties inside and outside the UAE their data will be shared with, and the protection measures if it is transferred abroad.

In practice this means:

1. A clear link to the privacy policy next to every form, in both languages if your website is in Arabic and English.
2. A separate checkbox for consent to marketing messages, not ticked in advance.
3. Storing the date and time of consent and the text the person agreed to.
4. An unsubscribe link that works in every marketing message, because Article 17 gives the data subject the right to object to direct marketing.
5. An e-mail address or a clear form that receives requests from data subjects, as Article 19 requires.

Data security: the part that concerns the website directly

Article 20 requires the controller and the processor to put in place technical and organisational measures appropriate to the risk, in line with the best international standards and practices. It names among them encryption of personal data, ensuring the confidentiality and integrity of processing systems, restoring data in good time after any failure, and testing how effective these measures are.

The law does not name WordPress plugins or SSL certificates, but this is what it means in practice on a company website:

• every page with a form runs over HTTPS with a valid certificate, which you can check with the free SSL certificate check,
• the core, theme and plugins are up to date, and abandoned plugins are deleted (see outdated WordPress plugins),
• logging in to the site's admin panel and the hosting panel uses two-step verification,
• backups are stored outside the public website folder, and restoring them has actually been tested,
• form messages are not kept forever, because Article 5 does not allow data to be kept after the purpose of processing has ended unless the data subject's identity has been removed.

Article 7 also requires you to appoint a processor that offers sufficient guarantees of applying the required technical and organisational measures. Ask your hosting company and your agency about this in writing, and have it stated in the contract.

If there is a breach

Article 9 requires the controller, as soon as it becomes aware of any breach or infringement of personal data that could compromise its privacy, confidentiality and security, to report it to the UAE Data Office within the period and according to the procedures set by the Executive Regulation. The report includes a description of the nature of the breach, its causes and approximate scale, the data protection officer's details, the likely effects, and the measures taken to deal with it. The data subjects must also be notified if the breach affects the privacy, confidentiality and security of their data. If a processor, such as your agency or hosting company, learns of the breach first, it must inform you as soon as it knows.

Note that the law itself does not set a number of hours for reporting, as the EU General Data Protection Regulation does (72 hours). It leaves the period to the Executive Regulation. The same goes for administrative penalties, which are issued by a Cabinet decision under Article 26. Article 29 gives a period of no more than six months from the issue of the Executive Regulation to comply, which the Cabinet may extend by the same period. These details change, so check their status on the legislation portal before you base a decision on them.

You do not need to wait for the regulation to prepare. Decide who in your company handles the report, where the server logs are kept, and whom to call at your agency and your hosting company.

DIFC and ADGM: two separate regimes

If your company is licensed in the Dubai International Financial Centre or Abu Dhabi Global Market, each has its own data protection legislation and its own supervisory authority.

In DIFC, Data Protection Law No. 5 of 2020 applies to companies registered in the Centre wherever the processing takes place, and to anyone processing data inside the Centre. It is overseen by the Commissioner of Data Protection. A controller must notify the Commissioner of its processing operations and renew this every year, for a fee. In a breach, the Commissioner is notified "as soon as practicable in the circumstances", with no deadline in hours, and individuals are notified if the risk to them is high. Since the amendments of July 2025, data subjects can claim compensation directly before the DIFC Courts.

In ADGM, the Data Protection Regulations 2021 apply, overseen by the Office of Data Protection. Every entity registered in ADGM that processes personal data must register as a controller. A breach must be reported to the Office without undue delay and, where feasible, within 72 hours of becoming aware of it.

If your company is on the mainland or in another free zone, ask the authority that issued your licence whether the zone has its own data protection legislation. If it does not, the federal law applies.