UAE Data Protection Law and Your Website: Forms, Cookies and the Privacy Policy

The UAE has had a federal data protection law since January 2022, and most business websites still behave as if it did not exist: a contact form with no purpose stated, an analytics tag nobody can explain, a privacy page copied from a template. The law is real. What is less clear is how much of it can be applied in practice today, and that matters for what you build and how you word it.

This is what we could confirm from official sources, what we could not, and what we do on every site regardless.

1. What the federal law says

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the UAE's main data protection law. The UAE government's own portal says it came into force on 2 January 2022 and that it covers personal data processed fully or partly through electronic systems, inside or outside the country. A website form is an electronic system. So the starting assumption for any UAE business site is that the law is relevant to you.

From the government portal and the law's text on the UAE Legislation portal, the points that touch a website are:

• Consent is the default. The law prohibits processing personal data without its owner's consent, with listed exceptions. One article is headed "Cases of Processing Personal Data without the Consent of its Owner". Do not assume your case is one of them.
• Consent has conditions. Article 6 says the controller must be able to prove consent, that it must be clear, simple and easily accessible, and that it must include the right to withdraw it easily. A person may withdraw at any time, and that does not make earlier processing unlawful.
• Some information must come first. Article 13 says that before processing starts, the controller must tell the person the purpose, the sectors or establishments their data will be shared with inside and outside the UAE, and the protection measures for any cross-border processing. On a website, that is the job of the form wording and the privacy policy.
• People must be able to reach you. Article 19 requires clear and appropriate ways for a person to contact the controller to exercise their rights, and Article 17 gives them the right to object to direct marketing.
• People have rights over their data. The government portal names the right to correct inaccurate data and to restrict or stop processing. Someone will eventually email you to ask.
• Breaches must be reported. Article 9 requires a controller that becomes aware of a breach that would prejudice the privacy or security of personal data to notify the regulator, and to tell affected people when their privacy is at risk. A processor, such as your host or CRM vendor, must tell the controller as soon as it knows.
• Cross-border transfers are regulated. Article 22 allows transfers to countries with their own data protection legislation, or covered by an agreement the UAE has joined, in cases approved by the regulator. Article 23 allows others in listed cases, including a contract binding the recipient to the law's standards, the person's explicit consent, or where the transfer is needed to perform a contract with them. Its detailed controls are left to the executive regulations.

Who is outside it

The law carves out several groups, each by reference to other legislation. Government data and bodies, security and judicial authorities, and individuals handling their own data for personal purposes are excluded. So are health data and banking and credit data where separate legislation already covers them, and companies in free zones that have their own data protection law. That last point matters in two places. The DIFC has its own law, DIFC Law No. 5 of 2020, enforced by its Commissioner of Data Protection. ADGM enacted its own Data Protection Regulations 2021. If your company is licensed in either, read those instead. Other free zones are not covered by that carve-out unless they have their own data protection legislation, so check yours.

2. Is it enforceable? What we could and could not confirm

This is the question owners actually ask, and a straight answer is more useful than a confident one.

The law is in force. But it leaves important detail to executive regulations that the law itself says will be issued. Breach reporting is the clearest example: Article 9 requires notification "within the period and in accordance with the measures and requirements set by the Executive Regulations". Without them, there is no official number of hours to put in a breach plan. The same applies to the criteria for appointing a data protection officer and to exemptions for small establishments that do not process large volumes of data.

Many commercial articles state penalties, grace periods and deadlines with confidence. We found none of them on an official source, so we leave them out. The practical reading is narrow. The obligations are on the books, the timing rules are unfinished, and a business that builds to the law now will not need to rebuild when the detail arrives. We take the same view with AI tools, which we cover in what genuinely governs business AI use in the UAE.

3. What to do on your website

The sections below are our working practice. Where the law is explicit, we say so. Where it is not, we say that too, because good practice is not the same as a legal requirement.

Contact and lead forms

• Collect only what you need. A first enquiry needs a name, a way to reply and a message. A date of birth or Emirates ID number does not belong on it. Every extra field is data you must protect, and report on if it leaks.
• State the purpose next to the button. One short sentence: "We will use your details to reply to this enquiry. See our privacy policy." Clear and in the form, not buried in the footer.
• Separate consent for marketing. An unticked box for newsletters or follow-up offers, kept apart from the enquiry itself. Because consent is the default under the law, bundling is the habit most likely to count against you.
• Make withdrawal easy. An unsubscribe link in every email and a named contact for data requests. The law lets people withdraw consent at any time.
• Keep a record. Store the time, the form and the wording each person agreed to. If someone challenges you, that record is your answer.

Cookies and analytics

We did not find a UAE rule on official sources that specifically governs cookie banners. So we do not claim that the law requires one. What we do is treat anything that can identify a person as personal data, and handle it as the federal law's consent rules would.

• Load analytics and advertising pixels after a visitor chooses, not before.
• Say in plain words what each category does. "Measures which pages are used" is better than "improves your experience".
• Make refusing as easy as accepting.
• List the actual tools. If your tag manager is firing six pixels no one remembers adding, that is the first problem to fix.

The privacy policy

The law does not set out a privacy policy template, but Article 13 lists what a person is entitled to know, and three items (purpose, who receives the data, and cross-border protection) must be given before processing begins. Our standard covers all of them:

1. who you are and how to contact you about data;
2. what you collect, and why;
3. which third parties receive it (CRM, email platform, payment provider, analytics);
4. where it is stored, including any transfer outside the UAE;
5. how long you keep it;
6. how a person asks to see, correct, restrict or delete their data, or withdraw consent;
7. how they reach you with a complaint.

Publish it in Arabic and English. A policy people cannot read is not a notice. That is how we build bilingual sites, covered in our web development work across the GCC.

Where the data lives, and who else touches it

Every form submission travels: to your host, to a CRM, to an email inbox, often to a WhatsApp number. Map each hop. The law has rules on transfers outside the UAE, and your CRM or email tool may well store data abroad. WhatsApp enquiries are the same data in another channel, so the consent and purpose wording applies to a click-to-chat button too. If you use an AI chatbot or an AI vendor, ask where the data goes and what it is used for, as we explain in our piece on the one question to ask your AI vendor.

Retention and breaches

We did not verify a retention period in the law, so pick one yourself and write it down. Enquiries that never became clients do not need to live in your inbox for ever. Then plan for the day something goes wrong. Article 9 means the first step is knowing what data you hold and who to call. Our guide to website security for UAE businesses covers the response plan, and a custom build lets us strip unneeded data collection out at the source. If you are also selling into Saudi Arabia, that market has a separate law with a defined breach clock, covered in our Saudi website guide.

A checklist for your site

1. Check whether you sit in DIFC, ADGM or another free zone with its own law.
2. Cut every form down to the fields you use.
3. Put the purpose and a privacy link beside each submit button.
4. Keep marketing consent separate and unticked.
5. Load analytics and pixels only after a choice.
6. Publish a privacy policy in Arabic and English that names your real tools and storage locations.
7. Set a retention period and a named contact for data requests.
8. Write a breach plan now. Add the deadline when the executive regulations set one.
9. Re-check the legislation portal for executive regulations before your next site review.

If you want this built into a site rather than bolted on, tell us what you are launching and we will map the forms, the tools and the policy as part of the build.

This article is general information, not legal advice. It reflects the UAE government portal, the UAE Legislation portal, DIFC and ADGM as read on 13 November 2026, with the limits described above. Confirm your obligations with a qualified adviser in the UAE.