UAE PDPL for Small Business Websites: Consent, Contact Forms, WhatsApp, Cookies and the DIFC and ADGM Exceptions

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, in force since 2 January 2022) generally prohibits processing personal data without the person’s consent, which for a small business website means contact forms, WhatsApp buttons, newsletters and tracking tools. Its Executive Regulations, which hold the detail on deadlines and penalties, were still reported as not issued in 2026, and businesses in the DIFC and ADGM follow their own separate data laws instead.

This guide explains what that means in practice for an ordinary business site. It is a plain-words summary, not legal advice, and where details are still unsettled we say so. If you process sensitive data or large volumes, speak to a data protection adviser.

What is the UAE PDPL, in plain words?

The PDPL is the UAE’s federal data protection law. According to the UAE Government portal, it applies to the processing of personal data inside or outside the country, it names the UAE Data Office as the federal regulator, and it gives people rights over their data, including asking for corrections and asking you to restrict or stop processing. Summaries of the law also list rights of access, erasure, portability and objection.

Three things make it different from Europe’s GDPR, which many owners have heard of:

• 1The detail is still missing. The law called for Executive Regulations within six months, which would have been 2022. As of mid-2026, several sources report they have not been issued, and businesses get a period to comply once they are.
• 2The regulator landscape is moving. A new federal authority for artificial intelligence and data was set up in 2026, and how it will affect the PDPL is not yet clear.
• 3There are carve-outs. Health and banking data covered by their own laws, and free zones with their own data protection laws, sit outside the PDPL.

None of that means you can ignore it. The law is in force, consent is its starting point, and good habits now cost almost nothing to build into a website.

Which data protection law applies to my business?

If you sell to people in Europe, Europe’s GDPR can apply to you as well, even with no office there. A website that takes orders from European customers should be checked against both.

What personal data does a small business website actually collect?

More than most owners think. Personal data is anything that identifies a person, directly or indirectly. On a typical small business site that includes:

• 1Names, phone numbers and emails typed into contact, quote or booking forms.
• 2Phone numbers and messages when someone taps your WhatsApp button and starts a chat.
• 3Email addresses for newsletters or offers.
• 4Order details, delivery addresses and payment references if you sell online.
• 5Analytics data, such as device identifiers and IP addresses, gathered by tracking tools.
• 6Data shared with advertising platforms through tracking pixels, if you run ads.
• 7Job applications and CVs, if you have a careers page.

What counts as consent under the PDPL?

The law defines consent as agreement given in a specific, clear and unambiguous way, through a clear positive statement or action. In website terms, that points to:

• 1Telling people what you will do with their details at the point they hand them over, in a sentence next to the button.
• 2Separate tick boxes for separate purposes. Replying to an enquiry and sending marketing are different things.
• 3Boxes that start unticked. A pre-ticked box is not a positive action by the visitor.
• 4An easy way to withdraw: an unsubscribe link, a reply of “stop”, or an email address on the privacy page.
• 5Asking only for what you need. A quote form rarely needs a date of birth or Emirates ID number.

The law also lists situations where processing without consent is allowed, for example to perform a contract with the person. Exactly how those apply will be clearer once the Executive Regulations are published, so when in doubt, ask.

Does a UAE website need a cookie banner?

The PDPL does not have a separate cookie rule of the kind Europe has, and no federal cookie guidance had been published as of this writing. But tracking that identifies people is still processing personal data, and consent is the PDPL’s starting point. A sensible, proportionate approach for a small business:

• 1Keep essential cookies, such as those that make a basket or a form work, without asking.
• 2Ask before loading advertising pixels and cross-site tracking, with “accept” and “reject” buttons that are equally easy to press.
• 3Use privacy-friendly analytics settings where your tool offers them.
• 4If you target European customers, follow the stricter European cookie rules for those visitors.

How do WhatsApp chats and broadcasts fit in?

When a customer taps your WhatsApp button and writes to you, they have started the conversation, and replying to them is what they asked for. Adding them to promotional broadcasts is a different purpose. WhatsApp’s own Business Messaging Policy says you may only contact people who have given you their number and opted in to receive messages from you. Ask first, for example with a tick box on your form or a simple question in the chat, and keep a record of the yes.

What should a UAE privacy page say?

• 1Who you are: legal name as on your trade licence, address and a contact email for privacy questions.
• 2What you collect through the website, WhatsApp and any booking or order system.
• 3Why you collect it, and the basis, such as consent or carrying out an order.
• 4Who you share it with: payment providers, delivery partners, booking or email tools, advertising platforms.
• 5Whether data leaves the UAE, for example because a tool is hosted abroad.
• 6How long you keep it.
• 7People’s rights and how to use them, with a real email address that someone reads.
• 8Cookies and tracking, and how to change choices.
• 9The date it was last updated.

Are there fines for breaking the PDPL, and when do they start?

The PDPL provides for administrative penalties, but the penalty schedule was left to the Executive Regulations, which were still reported as unpublished in 2026. You may see specific fine amounts quoted online. We could not trace them to a primary legal source, so we do not repeat them. The practical risk today is less about fines and more about trust and future readiness: when the regulations arrive, businesses will have a limited window to comply, and a website that already asks properly will need no rework.

A 12-point website privacy checklist for UAE businesses

• 1Know which regime you are under: PDPL, DIFC or ADGM.
• 2Publish a privacy page and link it in the footer of every page.
• 3Add one plain sentence next to every form button saying what happens to the details.
• 4Use separate, unticked boxes for marketing consent.
• 5Remove form fields you do not need.
• 6Never ask for medical, financial or identity document details on open web forms.
• 7Set your WhatsApp pre-filled message to ask only for booking or enquiry details.
• 8Ask before adding anyone to a WhatsApp or email broadcast, and keep the record.
• 9Load advertising pixels only after consent.
• 10Make sure the site runs on HTTPS so form data is encrypted in transit.
• 11Name one person who answers privacy requests, and test the email address.
• 12Review the privacy page whenever you add a new tool, and at least once a year.

For example, a small tutoring centre in Al Ain with a contact form and a monthly newsletter would need a privacy page, one sentence under the form, an unticked newsletter box, and an unsubscribe link. That is an afternoon’s work, not a project.

What Adyft Sites sets up, and what stays your job

Every Adyft Sites plan includes a privacy page, a contact page and an FAQ page at no extra cost. We add the privacy page, keep the enquiry form short, and run the site on HTTPS with SSL; when you add a new tool or feature, you can send the change on WhatsApp. The legal wording of the privacy page should be checked by your adviser. In the UAE, Starter is AED 3,499 plus AED 199 a month and Growth is AED 7,999 plus AED 449 a month.

What we cannot do is act as your lawyer or data protection officer. Deciding your legal basis, handling a data request and registering in the DIFC or ADGM where required are your responsibilities. If your business processes health records, financial data or large volumes of customer data, get specialist advice; a website provider is not the right person for that.

Sources: UAE Government portal, Data protection laws — https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws · Business Dubai, UAE Personal Data Protection Law (reviewed August 2026) — https://www.businessdubai.ae/blogs/uae-pdpl-data-protection · Morgan Lewis, UAE establishes federal authority for AI and data (June 2026) — https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data · Modulos, UAE PDPL scope and Executive Regulation — https://docs.modulos.ai/frameworks/uae-pdpl/scope-enforcement-and-the-executive-regulation · Linklaters, Data protected: DIFC — https://www.linklaters.com/insights/data-protected/data-protected---difc · Taylor Wessing, New ADGM data protection law — https://www.taylorwessing.com/de/insights-and-events/insights/2021/04/new-abu-dhabi-global-market-data-protection-law---key-changes-you-need-to-consider · WhatsApp Business Messaging Policy — https://whatsappbusiness.com/policy/