UAE data protection (PDPL) and marketing consent: what a small business should do

This is a practical guide, not legal advice. Laws and their implementing rules change. Check your obligations with a qualified adviser, especially if you handle health, financial or children’s data, or operate in a free zone with its own data protection law.

Email lists, WhatsApp broadcasts, retargeting audiences and CRM records all involve personal data. The UAE has a federal data protection law, and the safest marketing habits also tend to be the most effective: people who chose to hear from you open, click and buy more.

The law in brief

The Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, came into force on 2 January 2022. From the official text:

• Who it covers: processing of personal data of people in the UAE, by businesses inside or outside the UAE (Article 2).
• Who it doesn’t cover (among others): government data, health and banking data that have their own legislation, and companies in free zones that have their own data protection laws, such as DIFC and ADGM (Article 2).
• Consent is the default: processing personal data without consent is prohibited unless an exception applies, such as performing a contract with the person or meeting a legal obligation (Article 4). Marketing isn’t one of the listed exceptions.
• Valid consent must be provable by you, given clearly through a positive statement or action, in clear and simple language, and include an easy way to withdraw it (Articles 1 and 6).
• Right to object to direct marketing: people can object to processing for direct marketing, including related profiling, and you must stop (Article 17).
• Information rights: people can ask what data you hold, why, and who you share it with (Article 13).

What’s still pending

Article 28 provided for executive regulations to set out much of the detail (breach notification periods, exemptions for smaller businesses, cross-border transfer controls). As of October 2026, legal commentators report these regulations still haven’t been published. Article 29 gives businesses six months to comply after the regulations are issued. That isn’t a reason to wait: the law’s principles are clear and already in force.

Marketing calls and messages: telemarketing rules

Separately, Cabinet Resolution No. 56 of 2024 regulates telemarketing. According to law-firm summaries, it applies to marketing calls and, as reported, marketing text messages and messages through social media apps. It sets rules such as:

• Marketing calls only between 9am and 6pm
• No contact with people on the Do Not Call Registry (DNCR), managed by the TDRA
• Identifying the business and the purpose of the call at the start, and not calling back someone who refused
• Using registered business numbers, not personal phones

If you do outbound calling or messaging to people who haven’t contacted you first, read the resolution in full with your adviser.

What to do in practice

1. Collect clear opt-in

• Separate, unticked checkbox for marketing on forms and at checkout, not hidden in terms and conditions.
• Say who will contact them, how (email, WhatsApp, SMS) and about what: “Send me offers and new arrivals from [Business] by email and WhatsApp.”
• For WhatsApp, Meta’s policy also requires opt-in that names your business. See WhatsApp marketing that doesn’t get you blocked.

2. Record it

The law says you must be able to prove consent. For each contact, store:

Most email platforms and CRMs can store this. Make sure your form-to-CRM workflow carries it across. See form-to-CRM lead workflow.

3. Make opting out easy, everywhere

• Unsubscribe link in every marketing email (one-click unsubscribe is required by Gmail for bulk senders).
• “Reply STOP” or a clear opt-out in WhatsApp and SMS.
• When someone opts out on one channel, update the CRM so other tools respect it too.

4. Write an honest privacy notice

Before you collect data, tell people the purpose, who you share it with and how cross-border transfers are protected (Article 13 requires these points to be given up front). Include:

• What you collect and why (orders, enquiries, marketing)
• Who you share it with: email platform, CRM, payment provider, advertising platforms if you use Meta’s Conversions API, Google’s enhanced conversions or customer-list audiences
• That data may be processed outside the UAE by these providers
• How to contact you to exercise their rights

5. Keep only what you need

The law requires data to be limited to what’s necessary and not kept after the purpose is exhausted (Article 5). Delete old, unengaged lists rather than keeping them “just in case”. It also improves deliverability.

6. Check your providers

Your email platform, CRM and automation tools process data for you. Check their data processing terms, where data is stored, and security features. Note that Zoho now offers UAE data centres for some products.

Common grey areas

• Existing customers: the law doesn’t contain a specific “existing customer” exception for marketing. Get marketing opt-in at checkout and treat order emails (transactional) separately from marketing.
• Business cards and B2B contacts: individuals at companies are still people with personal data. Ask before adding them to newsletters.
• Bought lists: avoid them. You can’t prove consent, and they damage deliverability.
• Retargeting and customer-list audiences: say so in your privacy notice and respect opt-outs.

Frequently asked questions

Does the PDPL apply if we’re in a free zone?

If your free zone has its own data protection law (DIFC, ADGM), that law applies instead. Other free zones without their own law fall under the PDPL. Check with your adviser.

What are the penalties?

The PDPL leaves penalties to a Cabinet decision (Article 26). The telemarketing rules have their own penalties under a separate Cabinet resolution. Both are reasons to keep good records now.

Is double opt-in required?

Not by the PDPL text. It’s still good practice for email, because it proves consent and keeps fake addresses off your list.

If you’d like your forms, CRM and marketing tools set up to collect and respect consent properly, that’s part of our growth funnel service.