If your website collects names, emails or personal data from visitors in the UAE, the PDPL applies to you. Here is a simple guide focused on websites and hosting.
If you run a website in the UAE, or your website collects names, emails, phone numbers, or any personal information from visitors in the UAE, the UAE Personal Data Protection Law applies to you.
This law is called the PDPL (Federal Decree-Law No. 45 of 2021). It has been in force since 2 January 2022. It tells you how you must collect, store, use, and protect personal data on your website.
This guide explains the main points in simple language, with special focus on websites and hosting. It is for business owners, website managers, and marketers. This is not legal advice. For your specific case, speak to a UAE lawyer.
Who Does This Law Apply To?
The PDPL applies if:
Your company is in the UAE mainland or most free zones
Your website collects data from people in the UAE (even if your company is outside the UAE)
You use forms, newsletters, contact forms, booking systems, or payment systems on your website
It does not apply to companies in DIFC or ADGM (they have their own laws).
What Counts as Personal Data on a Website?
Any information that can identify a person, such as:
Name, email, phone number
IP address
Cookie data that can identify someone
Location data
Photos or voice recordings
Payment details
Sensitive data (health, religion, biometric data, etc.) needs extra care.
Key Rules for Website Owners
1. You need a clear reason to collect data
The most common reasons are:
The visitor clearly agrees (consent)
You need the data to deliver a service or product
The law requires you to keep it
Consent must be clear. Pre-ticked boxes or silent acceptance are not enough. Visitors must be able to withdraw consent easily.
2. People have rights over their data
Website visitors can ask you to:
See what data you hold
Correct wrong data
Delete their data (in some cases)
Stop using their data for marketing
Get a copy of their data
Your website and support process must make it easy for people to send these requests.
3. You must keep records
Write down what data your website collects, why you collect it, who you share it with, and how long you keep it.
4. You must keep data secure
Use strong security on your website: HTTPS, secure forms, limited access, regular backups, and staff training.
5. If data is leaked, you must report it
If personal data is stolen or exposed and it can harm people, you must notify the UAE Data Office. In serious cases, you must also tell the affected visitors.
Why Hosting Location Matters a Lot
This is one of the most important points for website owners.
When your website or database is hosted outside the UAE, moving personal data abroad is treated as a cross-border transfer. The PDPL has strict rules for this.
You can freely transfer data only to countries that the UAE officially accepts as having good protection. That list is not yet published.
If the country is not on the list, you need extra legal steps such as special contracts or clear consent.
Keeping your website and customer data on servers inside the UAE removes this problem completely. There is no international transfer, so compliance becomes much simpler.
This is why many UAE businesses choose local hosting providers that keep data in Dubai or Abu Dhabi data centres.
Practical Steps for Your Website
Add a clear and easy-to-read privacy policy
Check every form (contact, newsletter, booking, checkout)
Make sure consent is real and easy to remove
Prefer UAE-based hosting when possible
Sign a proper data processing agreement with your hosting provider
Keep a simple list of the personal data your website collects
Train your team on basic data protection
Have a plan ready in case of a data breach
Free Zones Reminder
If your company is registered in DIFC or ADGM, you follow their own data protection laws, not the federal PDPL.
Final Note
The PDPL is already in force. Even though some detailed regulations are still pending, the main rules apply today.
Start with the practical steps above. Updating your privacy policy, checking forms, and choosing the right hosting location are the fastest improvements you can make.
This article gives general information only. For advice that fits your exact website and business, speak with a qualified UAE data protection lawyer.
