UAE PDPL for Online Stores: What the Data Protection Law Requires

Every order hands you a name, a phone number and an address. In the UAE, the PDPL (Personal Data Protection Law) sets the rules for using them.

The good news? The rules are familiar if you know GDPR, and most of them are one-time setup work.

The law has applied since January 2022. Its Executive Regulations and fines are still on the way, which gives you a head start, not a free pass.

You'll see who the law covers, what to put in your privacy notice, how to handle cookies and marketing consent, and a checklist for Shopify, Salla and Zid. It's part of our UAE regulations guides.

Does the UAE PDPL apply to your online store?

Almost certainly, yes. Article 2 covers any business that processes personal data of people in the UAE, wherever the business sits.

That includes:

• Mainland stores licensed by the Dubai DET or another emirate.
• Most free-zone companies, such as those in IFZA, Meydan, RAKEZ or DMCC.
• Foreign stores shipping to UAE customers from Riyadh, London or Shenzhen.
• Your service providers, like 3PLs, payment gateways and email tools, as processors.

A few areas sit outside it: government data, health and banking data under their own laws, and free zones with their own data law. The two big zones are DIFC (Dubai International Financial Centre) and ADGM (Abu Dhabi Global Market), covered in the notes at the end.

Not sure which zone your licence sits in? Our free zone vs mainland guide explains the options.

Where the PDPL stands in October 2026

The law itself is live. The detail that fills it in isn't yet.

Breach deadlines, the list of approved countries for transfers and fine amounts will come with the regulations.

Everything else is already law. Stores that set up consent, notices and contracts now will have little to change when the regulations land.

What lawful bases can an online store use?

Consent is the default under Article 4. You need it unless one of the listed exceptions applies.

The exceptions that matter to a store are:

• Performing a contract. Processing a customer's name, address and phone to deliver their order.
• Legal duties. Keeping tax invoices and records that UAE law requires.
• Legal claims. Holding data needed for a dispute or chargeback.
• Data the customer made public.

Unlike GDPR, there's no "legitimate interests" basis. That's the key difference for marketers: retargeting, profiling and promotional messages need consent.

Article 6 sets the bar for valid consent. It must be specific, clear and unambiguous, and given by a clear action like ticking a box. You must be able to prove it, and customers can withdraw it at any time.

Skip pre-ticked boxes and bundled "I agree" buttons. Use one unticked box per purpose.

What must your privacy notice say?

Article 13 says customers must know, before you start processing, why you use their data and who receives it, inside or outside the UAE. Customers can ask for more detail, so put it all in one notice.

A store's privacy notice should cover:

1. Who you are and how to contact you about privacy.
2. What data you collect: account, order, payment, delivery, support chats and cookies.
3. Why you use each type and on what basis (contract, consent, legal duty).
4. Who receives it: couriers, 3PLs, payment gateways, BNPL providers, email and ad platforms.
5. Which countries it goes to and how you protect it there.
6. How long you keep it.
7. The customer's rights and how to use them, including how to complain.

Publish it in Arabic and English, link it in your footer and at checkout, and date it. Our UAE e-commerce law guide covers the wider duties for online sales.

Do UAE online stores need a cookie banner?

Yes, in practice. There's no separate cookie law on the UAE mainland, but tracking pixels and analytics collect personal data like device IDs and browsing behaviour.

A sensible setup looks like this:

• Strictly necessary cookies (cart, login, fraud checks) load straight away.
• Analytics and advertising tags (Meta Pixel, TikTok Pixel, Google Ads) wait for an opt-in.
• Accept and Reject carry equal weight on the banner.
• A cookie settings link in the footer lets people change their mind.

Use your platform's consent mode, so tags really stay off until people say yes. A banner that still fires every pixel proves nothing.

Marketing consent: email, SMS and WhatsApp

Four sets of rules cover marketing, and they all point the same way:

• PDPL Article 17 lets customers object to direct marketing and related profiling.
• The e-commerce law (Decree-Law 14/2023) gives online shoppers the right to accept or refuse marketing by call, email or social media.
• Cabinet Resolution 56 of 2024 requires consent before marketing through social-media messages.
• TDRA's anti-spam policy treats any marketing SMS sent without consent as spam.

For SMS, the customer has to start the opt-in, and you can't ask for it by SMS or phone call. Every message needs a free opt-out.

Promotional texts can't go out between 9pm and 7am. Only UAE-registered companies may send them, using a sender ID that starts with "AD-".

The SMS marketing rules guide covers sender IDs, sending hours and costs in detail.

What rights do your customers have?

UAE customers get a GDPR-like set of rights under Articles 13 to 18:

• Access. What you hold, why and who receives it.
• Portability. Their data in a machine-readable format, where processing is based on consent or a contract.
• Correction and erasure. For example, after they withdraw consent.
• Restriction. Pausing use while a dispute is sorted out.
• Objection. To direct marketing, profiling and some automated decisions.

Answer within one month. Complex requests can take two more months if you tell the customer.

For example, a customer asks you to delete their account. You erase marketing and profile data, but keep the tax invoice, because UAE VAT law requires it. Tell them what you kept and why.

What to do after a data breach

Article 9 asks you to report a breach to the UAE Data Office as soon as you become aware of it, if it affects the privacy, confidentiality or security of personal data. You also tell affected customers when the breach could harm them.

The report covers what happened, which data and how many people were affected, and what you've done about it.

Aim to report within 72 hours. It matches the Saudi deadline and GDPR, so one playbook covers all three.

Sending data abroad: Shopify, Klaviyo, Meta and Chinese ERPs

Most stores move customer data out of the UAE all day. Shopify, Klaviyo, Meta, Google Analytics and many Chinese ERP tools sit abroad.

The PDPL allows this in two main ways:

• Article 22: adequate countries. Transfers to countries with adequate data protection laws, or with a data agreement with the UAE. The official list hasn't been issued yet.
• Article 23: other safeguards. Without adequacy, you can rely on a contract that binds the recipient to PDPL-level protection, the customer's express consent, or a transfer needed to perform the customer's contract.

So what should you do? Sign each provider's data processing agreement (DPA). Most big platforms offer one in their admin or legal pages.

For a tool with no DPA, replace it or keep customer data out of it.

Do you need a data protection officer?

Most small and mid-size stores don't. Article 10 requires a DPO (data protection officer) for:

• High-risk processing with new technology or large volumes of data.
• Systematic assessment of sensitive data, including profiling.
• Large-scale processing of sensitive data.

Sensitive data includes health, biometrics, religion and ethnic origin. A pharmacy, supplements or wellness store that profiles customers by health needs should check this carefully.

A DPO can be an employee or an outside service based anywhere. Even without one, name someone who owns privacy questions.

Penalties: what's enforceable today?

Article 26 leaves PDPL fines to a Cabinet decision. That decision hadn't been issued by late October 2026.

Other UAE laws already bite:

• The federal cybercrime law carries fines of AED 150,000 to 5 million for misusing electronic data and spam.
• The consumer and e-commerce laws penalise misleading practices and ignored marketing opt-outs.
• Platforms enforce too. Meta, gateways and SMS providers block senders who can't prove consent.

Build to the law now, and the fines schedule won't change much for you.

Worked example: a Dubai skincare store on Shopify

Take a mainland Dubai skincare brand selling across the UAE. Its data map looks like this:

The skin quiz is the sleeper issue, because skin conditions can count as health data.

Total setup time? A few days of admin and one afternoon with a lawyer to review the notice.

UAE PDPL vs Saudi PDPL

Selling into both countries? The two laws share a backbone, but Saudi Arabia is further along on enforcement.

	UAE	Saudi Arabia
Law	Federal Decree-Law 45/2021	Royal Decree M/19 (2021), amended 2023
Fully enforceable	In force since Jan 2022; regulations pending	Since 14 Sep 2024
Regulator	UAE Data Office	SDAIA
Covers foreign stores
Marketing	Right to object; TDRA opt-in rules for SMS	Prior opt-in and free opt-out (Art. 25)
Breach deadline	Immediately; regulations will set the time	72 hours to SDAIA
Answer data requests	1 month, extendable	30 days
Transfer tools	Adequacy list pending; contracts or consent	SDAIA standard contractual clauses
Maximum fine	Set by a future Cabinet decision	SAR 5 million per violation, doubled for repeats
Free zones	DIFC and ADGM have their own laws	Applies Kingdom-wide

If you build for Saudi rules, you'll meet most UAE ones too. Our Saudi PDPL guide covers the Kingdom's version.

PDPL checklist for Shopify, Salla and Zid stores

Want a hand with the setup? Our Shopify development team in Dubai builds consent banners, Arabic policy pages and opt-in flows into UAE stores.

Notes for DIFC and ADGM companies

• The federal PDPL doesn't apply to you. DIFC's Data Protection Law of 2020 or ADGM's Data Protection Regulations of 2021 do.
• Both are closer to GDPR and already have commissioners who enforce and fine.
• Expect registration or notification duties with your zone's commissioner.
• Still choosing a zone? Our UAE business setup consultants can compare them.

Notes for foreign stores selling into the UAE

• Your GDPR setup covers most of it. Add an Arabic notice and name UAE-specific recipients.
• Without a UAE entity you can't send promo SMS there, so run offers through email and WhatsApp with opt-in.