Buying an email list and mailing it are both processing under the UAE's PDPL, Federal Decree-Law No. 45 of 2021, in force since 2 January 2022. The law's default is consent. Article 4 prohibits processing personal data without the owner's consent, and on our reading none of its exceptions gives a general ground for marketing to a bought list. Article 6(1)(a) requires the controller to be able to prove each person's consent, and Article 17(1) lets anyone on the list object to direct marketing and have it stopped. A seller's word that the list is opted in does not meet that duty, because the controller is the business that mails the list.
What the PDPL sees in a bought list
Article 1 defines personal data as "Any data related to a specific natural person or related to a natural person that can be identified directly or indirectly". A work address built from a buyer's name and a company domain identifies that buyer, so a B2B list of named contacts is personal data. Counsel can say whether a role address such as info@ identifies anyone.
Article 1's definition of processing takes in collecting and storing data as well as sharing and using it. The seller processes the data when it hands the list over, and you process it from the moment it lands in your email platform. The law also reaches both ends of a cross-border sale. It applies to a controller or processor in the UAE whatever the location of the people in the data (Art. 2(1)(b)), and to one outside the UAE that processes the data of people inside it (Art. 2(1)(c)). A company on the Dubai mainland buying contacts in Riyadh is covered, and so is a London seller of UAE contacts.
Article 2(2) has an exclusion that matters for some buyers. Companies in free zones with their own data protection legislation are outside the PDPL. DIFC and ADGM have such laws, and our guide to UAE data protection for marketers sets out what they ask instead. Small senders get no shortcut yet. Article 3 lets the regulator exempt establishments that do not process a large volume of personal data, under standards the Executive Regulations are to set, and until those standards exist nobody can say who qualifies.
The exceptions a seller might point to
The government portal sums up the rule: the law "prohibits the processing of personal data without the consent of its owner, except for some cases in which the processing is necessary to protect a public interest". Article 4 itself lists 11 exceptions. On our reading, none of them is a general legitimate-interests ground, so a seller's case for its list has to rest on a named exception. For a bought list, 2 of them deserve a close look.
The first is Article 4(2), for personal data "which has become available and known to all by an act of the Data Subject". A list compiled from websites and directories invites the argument that the data is public anyway. The clause covers data made public by the person's own act, so on our reading it does not reach an address that an employer or a directory published. Whether a given source fits, and whether marketing use fits the exception at all, are questions for counsel.
The second is Article 4(9), for processing "necessary to perform a contract to which the Data Subject is a party". The people on a bought list have no contract with you. Even for your own customers, on our reading the exception covers order processing and service messages and stops short of marketing.
Proof of consent, for your marketing
Article 1 defines consent as a specific and unambiguous indication, given "through a clear positive statement or action". A pre-ticked box or silence is not a positive action. Consent must be clear and simple, in writing or electronically (Art. 6(1)(b)), and it must carry the right to withdraw it easily (Art. 6(1)(c)). Article 6(1)(a) then puts the burden on the controller: "The Controller shall be able to prove the consent of the Data Subject".
Specific is the word to test a bought list against. A seller's form that asks for consent to offers from selected partners names neither your business nor your sector, and whether that counts as specific consent to your marketing is for counsel to judge. Purpose limitation adds a second test. Article 5(2) says personal data "shall be collected for a specific and clear purpose", and allows processing for a purpose that is "similar or close" to that one. Data gathered for a webinar sign-up and sold on for another firm's marketing has to pass that test as well.
Article 13 adds a question of timing. Before processing starts, the controller must give the person the information Article 13(2) lists, which includes the sectors or establishments in the UAE or abroad that will receive the data (Art. 13(1)(d)). Storing a list is already processing on Article 1's definition, hence the problem for a buyer. How you meet Article 13(2) for data you never collected is a question to settle with counsel before the list is loaded.
Before you buy, put these questions to the seller and ask for the answers in writing:
- What wording did each person see when they consented, and did it name your business or your sector?
- What positive act did each person take, and can the seller show when it happened?
- What purpose was the data first collected for?
- Were people told their data would go to establishments outside the UAE, where the seller or your email platform sits abroad?
- How will a withdrawal or an objection sent to the seller reach you?
Every address arrives with rights attached
Article 17(1) gives a person the right to object to processing "for the purposes of direct marketing, including profiling related to direct marketing", and to have it stopped. The official Arabic text says the same. A bought list can include people who have already objected to your marketing. Run it against your suppression list before it reaches any sending tool, because importing those people again restarts the processing they asked you to stop.
The other rights follow the address too. A person can ask, free of charge, for the information Article 13(1) lists, which covers the purposes of the processing and who receives the data. A withdrawal of consent and an objection are both grounds for erasure (Art. 15(2)(b) and (c)), subject to the exceptions in Article 15(3). The controller must give people clear ways to contact it (Art. 19), and anyone who believes the law has been broken may complain to the regulator, which the English text calls the Bureau (Art. 24(1)).
Some lists arrive with scores or segments attached. Article 1 defines profiling as automated processing that uses personal data "to assess certain personality aspects associated with the Data Subject", and the right to object covers profiling for direct marketing. Whether a seller's scoring counts as profiling, and what that means once the scores sit in your CRM, are points to put to counsel.
How we build a list without buying one
We do not buy or rent contact lists. The forms we build state the purpose beside an unticked consent box, and each consent is stored with a timestamp and the wording shown, so the proof Article 6(1)(a) asks for exists from the first contact. The forms are fed by paid search and social campaigns built around enquiries, and every objection or unsubscribe goes on a single suppression list that each sending tool checks.
A list that carries mobile numbers brings in a second set of rules. Cabinet Resolution No. 56 of 2024 counts marketing texts as telemarketing, and our page on the UAE's telemarketing rules covers calls and texts.
Which of your contacts the PDPL covers, and whether any exception fits a list you already hold, are questions for your counsel. The Arabic text of the law is authoritative, and the English versions are translations.
Sources
- UAE Legislation portal, Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, 2021
- UAE Government portal and Dubai Judicial Institute, Federal Decree-Law No. 45 of 2021, official Arabic text, 2023 edition
- UAE Government portal, Data protection laws, updated 4 December 2025
- Ministry of Economy and Tourism, Cabinet Resolution No. 56 of 2024 on the Telemarketing Regulations, 2024
Last reviewed 23 October 2026.
