Does a UAE business website need a privacy policy?
What the UAE's data protection law asks of a small business website, what it does not say, and what I put in the privacy policies I write for client sites.
A UAE business website that collects any personal data, through a contact form, a WhatsApp estimate, a booking or analytics, has to tell people what it collects and why, and a privacy policy is the practical way to do that. The UAE's Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, does not literally use the words "privacy policy", but it gives people a right to be told how their data is used, and a website has no other sensible place to tell them.
What is the UAE's data protection law?
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, usually called the PDPL. It was issued in September 2021 and came into force on 2 January 2022. It covers personal data processed in the UAE, with exclusions, and it is the law most onshore and free zone businesses without their own data regime fall under.
Who does it not apply to?
- Companies in free zones with their own data protection law. The DIFC has Data Protection Law No. 5 of 2020, and ADGM has its Data Protection Regulations 2021.
- Government bodies and government data.
- Health and banking data, where those have their own legislation.
- Personal data used purely for personal or household purposes.
The law also allows small establishments to be exempted, but only on criteria the executive regulations are meant to set, so that exemption cannot be relied on yet.
What does the law ask a website to do?
- Have a lawful reason to process the data. Consent is the default, with listed exceptions such as performing a contract with the person. Unlike Europe's GDPR, there is no general "legitimate interests" ground.
- Make consent specific, clear and unambiguous, be able to show it was given, and tell people they can withdraw it.
- Tell people, before processing, what the data is for and who will receive it, inside and outside the UAE.
- Answer requests from people who want to see, correct or delete their data, or object to direct marketing.
- Take care with sending data abroad. Most website tools, like analytics, form and email services, store data outside the UAE.
What do I put in a privacy policy for a client site?
Only what the site actually does. For a typical small business site with an enquiry form, that means:
- What each form collects, for example a name and a mobile number, and the one thing it is used for.
- The analytics the site runs, including any the hosting platform switches on by itself.
- Embeds like Google Maps or YouTube, which load third-party services when a visitor views them.
- A privacy email address that someone reads, and how to ask for data to be seen or deleted.
- The business's legal name and trade licence number, so a visitor knows who is responsible.
- The law cited correctly, with no claims about regulations that have not been issued and no named regulator I could not confirm.
The analytics point is the one people miss. Some hosting platforms can add analytics at the network level, so it never appears in the site's code. A privacy policy written from memory describes the site you think you built. Check what the live site loads, including anything the hosting platform injects, before you write a word.
Do I need a cookie banner?
There is no UAE law specifically about cookies. The general rules apply where cookies collect personal data, and some lawyers advise asking for consent before setting non-essential ones. If your site uses no tracking cookies at all, say so in the policy. If it runs advertising pixels, take advice, because those are the ones that send data to third parties.
Who enforces it?
The regulator named for the law is the UAE Data Office, set up by a separate decree-law, No. 44 of 2021. In June 2026 the Cabinet set up a Federal Authority for Artificial Intelligence and Data that absorbs the Data Office, and I have not been able to confirm how PDPL enforcement works under it. The PDPL leaves its fines to a Cabinet decision that I could not find published. That is not a reason to ignore it. When the regulations arrive, the law gives businesses a set period to comply, and a site that already tells the truth about its data has nothing to fix.
What should change in the policy when the site changes?
Every new script, embed or form. I treat it as a rule on client sites: the commit that adds a tool updates the privacy policy at the same time. A policy that was accurate on launch day can be wrong a month later.
Frequently asked questions
Does the UAE have a cookie law?
- Not a specific one, as of October 2026. The general data protection rules apply to cookies that collect personal data, so many sites ask for consent anyway, but there is no UAE cookie statute.
Can I copy a privacy policy from another website?
- You can read one for structure, but it has to describe what your own site does. A copied policy that names tools you do not use, or misses the ones you do, is not telling visitors the truth.
Does the PDPL apply to my DIFC or ADGM company?
- Probably not the federal law. DIFC and ADGM have their own data protection regimes, and the federal law excludes free zones that have their own. Check which one applies to your licence.
What are the fines under the PDPL?
- The law leaves penalties to a Cabinet decision, and I could not find one published as of October 2026. Be wary of articles quoting specific PDPL fine amounts without a source.