The UAE personal data protection law (PDPL) is Federal Decree-Law No. 45 of 2021, overseen by the UAE Data Office. It expects your website or app to collect the minimum data for a clear purpose, get explicit consent where consent is the legal basis, publish a privacy policy, let people access, correct and delete their data, and protect it with appropriate security. Free zones with their own data laws, such as DIFC and ADGM, follow those laws instead.
- uae pdpl checklist
- uae data protection law federal decree law 45 of 2021
- uae pdpl requirements for apps
- privacy policy requirements uae website
- does uae pdpl apply to foreign companies
What does the UAE PDPL ask of your website and app?
In short, the UAE PDPL (Federal Decree-Law No. 45 of 2021) asks you to treat customer data as something held in trust: collect only what you need, for a stated purpose, on a clear legal basis such as consent, protect it well, and let each person see what you hold about them, correct it and ask for it to be deleted. The body responsible is the UAE Data Office.
If you run a store that collects names, mobile numbers and addresses, a booking app that stores appointments, or a learning platform that registers students, you are a 'controller' in the law's terms and this checklist is for you. If you provide a technical service that processes data on behalf of other businesses, you are a 'processor' and have duties too.
One thing is in motion: the full picture of the executive regulations is not yet clear, and in June 2026 a Federal Authority for AI and Data was announced, which may reshape supervision. So we focus on the principles set in the law itself, which you need either way.
Does the law apply to your business?
The law is broad but has important exclusions. Use this table to place yourself quickly:
| Your situation | Federal PDPL? | Note |
|---|---|---|
| Store or app licensed on the mainland | Yes | The most common case |
| Company abroad processing data of people in the UAE | Usually yes | The law reaches processing of residents' data from outside |
| Company in DIFC or ADGM | No, the zone's law applies | Each has its own data protection law |
| Another free zone without its own data law | Yes | Check your zone's status |
| Health or banking and credit data | Governed by their own legislation | Protection principles still matter |
| Government entities or government data | Excluded | Covered by separate frameworks |
If your company sits in the Dubai International Financial Centre or Abu Dhabi Global Market, read DIFC and ADGM data protection vs the federal PDPL.
The checklist: from legal text to app features
| Requirement | What it means in practice | Where it shows up in your app |
|---|---|---|
| Purpose | Know why you collect each field | Internal notes for every database table |
| Data minimization | Do not ask for date of birth or ID unless needed | Short sign-up forms |
| Legal basis | Explicit consent, contract performance or legal obligation | Separate, unticked consent boxes |
| Transparency | A clear privacy policy in Arabic and English | Linked at sign-up, checkout and in the footer |
| Accuracy | Let people update their data | An editable 'My account' page |
| Retention | Do not keep data longer than needed | Automatic deletion or anonymization after a set period |
| Security | Appropriate technical and organizational measures | Encryption, roles, access logs, backups |
| Record of processing | Document what you process, why and who you share it with | An internal document updated with each new feature |
| Processors | Contracts with providers who handle your data | Hosting, messaging, payments, analytics |
Consent, marketing and cookies: how do you ask properly?
Under the law, consent must be specific, clear and unambiguous, and easy to withdraw. Not every kind of processing needs consent: delivering an order relies on performing your contract with the customer, but marketing messages by WhatsApp or email usually need separate consent.
- A separate, unticked marketing consent box
- A short line explaining what they will receive and how often
- An unsubscribe link in every message
- The consent date and wording saved in the database
- A cookie banner where rejecting is as easy as accepting
- Marketing consent bundled with accepting the terms
- A pre-ticked box
- No clear way to withdraw consent
- Adding customers' numbers to WhatsApp groups without permission
- Firing tracking tools before the visitor chooses
Sensitive data, such as health, biometric or religious data, needs extra care. If your app serves a clinic or a fitness center and stores health measurements, take specialist advice before launch, and see our clinics use case for how such apps are built with tighter permissions.
How do you handle customer requests about their data?
The law gives data subjects rights including information and access, portability, correction, erasure in certain cases, restriction of processing and objection, including objection to automated decisions. The best way to respect them is to build them into the app rather than handling them by hand over email.
- 1A 'My data' page
Customers see their personal data, orders and marketing preferences, and edit them themselves.
- 2An export button
Generates a structured file (JSON or CSV) of the customer's data to download.
- 3A delete-account request
Logs the request, verifies identity with an OTP, then deletes or anonymizes, keeping what the law requires, such as invoices.
- 4An admin requests queue
Shows each request with its date, status and response time so nothing gets lost.
- 5An action log
Record what was done for each request; it is your evidence if you are asked later.
Security, breaches and where data is hosted
- Encryption in transit over HTTPS and at rest for the database and backups.
- Roles and permissions: support staff do not need to see everything, and only the owner exports data.
- Secure sign-in with OTP or strong passwords, plus extra verification for admins.
- Access logs showing who viewed what and when.
- Daily backups, with restores actually tested.
- A breach response plan: who decides, who notifies the competent authority and affected customers, and within the time the regulations set.
- Impact assessments before high-risk processing, such as location tracking or large-scale sensitive data, and a data protection officer where the law requires one.
Transfers outside the UAE are allowed to countries with adequate protection or under specific conditions. That is one reason many businesses prefer to host customer data in the region, especially in regulated sectors or when selling to large buyers. See data hosting in the UAE, and how Fanann handles it on the hosting page.
Build privacy into your app from the start
Adding privacy after launch is expensive and messy. It is easier to ask for it in your first description of the app, so it becomes part of the database, pages and permissions from day one.
Add UAE PDPL data protection features to my app. At sign-up, ask only for name and mobile number with OTP verification. Add two separate unticked boxes: agreement to the privacy policy, and consent to marketing by WhatsApp and email; store the date and wording of each consent. Create an editable privacy policy page in Arabic and English. Add a 'My data' page where users see and edit their data, an export button that downloads a CSV, and a delete-account request confirmed by OTP. Automatically delete inactive customer accounts after a period I set in settings, keeping invoices. Set up owner, manager and support roles so support only sees what they need, and log every export or deletion. Add a cookie banner with accept and reject, and do not load analytics before acceptance. In the admin panel, add a list of privacy requests with status and response time.
Try it in Fanann- Map the data your app collects.
- Remove every field you do not really need.
- Separate marketing consent from accepting the terms.
- Build the 'My data' page plus deletion and export requests.
- Write a breach response plan and review it with a specialist.
Key takeaways
- The federal law is Decree-Law 45/2021, and it also reaches organizations abroad that process data of people in the UAE.
- Collect the minimum data for a defined purpose, and ask for clear, withdrawable consent where consent is the basis.
- Build user rights into the app itself: view, correct, export and request deletion of data.
- Encryption, access roles, backups and a breach response plan are part of compliance, not technical extras.
- The executive regulations and supervisory set-up are still evolving, so follow the UAE Data Office and take specialist advice.
Frequently asked questions
What is the UAE PDPL?
Does the UAE PDPL apply to foreign companies?
Do I need customer consent for everything?
Does the federal PDPL apply in DIFC and ADGM?
What should a privacy policy for a UAE website include?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “UAE PDPL checklist for websites and apps” https://fanann.com/en/blog/uae-pdpl-checklist/ My question: uae pdpl checklist Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.