UAE Data Protection Law & Your Website: What Businesses Must Know

The UAE's Federal Decree-Law No. 45/2021 on the Protection of Personal Data (PDPL) came into full effect in 2022 and applies to all businesses operating in the UAE that collect, store, or process personal data of UAE residents.

**Key PDPL obligations for website operators:**

**1. Privacy Policy:** You must publish a clear, accessible Privacy Policy in both Arabic and English that covers: what data you collect, why you collect it, how long you keep it, whether you share it with third parties, and how users can exercise their rights.

**2. Cookie consent:** If your website uses cookies for analytics, advertising, or tracking (Google Analytics, Meta Pixel, LinkedIn Insight Tag), you must obtain user consent before setting non-essential cookies. A PDPL-compliant cookie banner must be displayed to UAE users.

**3. Data subject rights:** UAE residents have the right to: access their personal data, correct inaccurate data, request deletion, and opt out of direct marketing. You must have a process to handle these requests within 30 days.

**4. Cross-border data transfers:** If you store UAE customer data on servers outside the UAE, you must ensure the recipient country has adequate data protection laws. AWS (Bahrain region) and Azure (UAE region) are both compliant options.

**5. Security:** You must implement "appropriate technical and organisational measures" to protect personal data. This means: HTTPS everywhere, encrypted database fields for sensitive data (passwords, payment details), access control, and regular security testing.

**Penalties:** PDPL violations can result in fines of up to AED 5,000,000. The UAE's Office of Data Protection is actively investigating complaints.

Smart Screen Technology builds PDPL-compliant websites with proper cookie consent, privacy policies, and data security measures as standard.