UAE data protection rules for marketers

The PDPL, Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, was issued on 20 September 2021 and has been in force since 2 January 2022 (Art. 31). Its definition of processing includes sharing and exchanging data, so passing a list to an agency or a sister company is processing too.

It applies to controllers and processors in the UAE, wherever the people in their data are (Art. 2(1)(b)), and to those abroad who process the data of people in the UAE (Art. 2(1)(c)). Article 2(2) leaves out:

• government data, and government entities that control or process personal data
• data held by the security and judicial authorities, and a person processing their own data for personal purposes
• banking and credit data, and health data, where another law regulates their protection
• companies in free zones with their own data protection legislation, which is where DIFC and ADGM sit

The PDPL sets no fines. Article 26 leaves the violations and the administrative penalties to a Cabinet decision. The regulator it names is the UAE Data Office, created by Federal Decree-Law No. 44 of 2021. On 14 June 2026 the Cabinet approved a new Artificial Intelligence and Data Authority, which "will bring together under one mandate the functions previously held by three separate entities", the Data Office among them. No published text yet settles whether it enforces the PDPL against private companies.

The Executive Regulations were due within 6 months of the law's promulgation (Art. 28), and the compliance window runs up to 6 months from their issue (Art. 29). As of 22 October 2026, no official source shows the Executive Regulations or the Article 26 decision as issued. Trowers & Hamlins (June 2026) call the PDPL "in force but unenforceable" pending the Regulations, and GLA & Company (August 2026) write that "the enforcement regime remains uncertain". The breach deadline (Art. 9) and the transfer controls (Art. 23(2)) wait on the Regulations too, so this page states no PDPL fine, breach deadline, compliance date or list of approved countries.

Article 4 prohibits processing personal data without the owner's consent, then lists 11 exceptions. They include the public interest, data the person has made public, a contract with the person and obligations under other UAE laws. On our reading, none of them is a general legitimate-interests ground, and the contract exception (Art. 4(9)) covers order processing and service messages without reaching marketing.

Article 1 defines consent as a specific and unambiguous indication, given through "a clear positive statement or action". On our reading, a pre-ticked box or silence does not fit. The controller must be able to prove consent, and consent must carry the right to withdraw it easily (Art. 6(1)). A withdrawal leaves earlier processing lawful (Art. 6(2)). This site records each visitor's consent choices and keeps enquiry data on its own servers. Our privacy policy and cookie policy give the detail.

In the CRM, data serves the specific and clear purpose it was collected for, or a similar or close one (Art. 5(2)), and is not kept once that purpose is exhausted (Art. 5(7)). Before processing starts, people must be told which sectors or establishments in the UAE and abroad will receive their data (Art. 13). Article 22 allows transfers to a country with data protection legislation, in cases the regulator approves. Otherwise Article 23 offers routes such as a contract binding the recipient to the law's standards, or the person's explicit consent. That matters whenever a CRM or an ad platform stores contacts outside the UAE.

A group gets no exception for sharing between its own companies, on our reading of Article 4. Our work for multi-brand groups starts by mapping which company collected each contact and what the person was told.

The Consumer Protection Law, Federal Law No. 15 of 2020, adds a rule of its own for goods and services across the UAE and its free zones (Art. 3). Article 4(5) lists among the consumer's rights "Protecting the privacy and security of his data and not using it for promotional and marketing purposes", and the government portal says the law "prohibits suppliers from using it for marketing". How that sits beside a consent given under the PDPL is a question for your counsel. What an advertisement may say is covered in our page on UAE advertising law.

Article 17(1) gives a person the right to object to processing "for the purposes of direct marketing, including profiling related to direct marketing", and to have it stopped. The official Arabic text says the same. An objection logged in 1 tool and missed in another has not stopped anything, hence a single suppression list read by every tool.

Retargeting and lookalike audiences raise the profiling question. The PDPL defines profiling as automated processing that uses personal data to assess certain personality aspects of the person (Art. 1). Whether a given audience is profiling is a question for counsel, and the answer shapes how we set up analytics and measurement and paid media.

The other rights, and what each means for a list:

• Information (Art. 13(1)). A person can ask, free of charge, what types of data you hold and who receives it.
• Portability (Art. 14(1)). The data they gave you has to come out in an orderly, machine-readable form.
• Correction (Art. 15(1)). A fix made in the CRM belongs in every copy of the list.
• Erasure (Art. 15(2)). It can follow a withdrawal or an objection. Whether a suppression entry may stay after erasure is a question for counsel.
• Restriction and human review (Art. 16, Art. 18). A person can oblige you to restrict processing in the cases Article 16 lists, and can ask for a human to review an automated decision.

People can also complain to the regulator (Art. 24(1)).

TDRA regulates spam through regulatory policies, which bind telecom licensees and, through their contracts, the businesses that send bulk messages. For text messages the current text is Version 1.1 of the policy, issued on 13 June 2022, and it applies to every text with a UAE link (s.3.1). Its rules for marketing texts:

• Opt-in only. Without consent a person is deemed not to have agreed (s.1.17), and the operator verifies consent before a marketing text goes out (s.8.2.3).
• A business sending through an operator may not ask for consent by text or by voice call (s.9.2.5), so SMS consent is gathered on a form or in an app.
• The sender name carries the code AD- followed by the sender's name (s.8.8).
• No marketing texts between 9 pm and 7 am (s.8.3, s.9.2.4).
• Every marketing text carries an opt-out, and unsubscribing costs nothing (s.5.8, s.5.10).
• Consent records hold the date and time along with the wording and the person's identity. Operators keep them for 2 years after the last message and produce them within 3 working days of a TDRA request (s.5.6, s.10.1, s.10.3).

A business that breaks these terms has its messaging service suspended and is reported to TDRA (s.12.3). TDRA's FAQs tell consumers that only senders whose names start with AD can be blocked. Telemarketing has regulations of its own, covered in our page on UAE telemarketing rules.

For email marketing, TDRA's texts say less. The 2009 policy, Version 1.0, covers electronic communications with a UAE link, and its definition of an address includes email (s.1.5, s.3.1). It asks for opt-in consent before marketing (s.5.5, s.6.8) and an unsubscribe route in every marketing message (s.6.10). Those duties fall on telecom licensees, and the 2022 version rewrote only the text-message rules. We found no TDRA statement on whether the 2009 policy still applies to email. The PDPL's consent and objection rules apply to the data behind every email, which is how email runs across our digital marketing work.

The DIFC Data Protection Law, DIFC Law No. 5 of 2020, has been in force since 1 July 2020 (Art. 4). The text used is the July 2025 consolidation. It applies to processing in the DIFC and to DIFC-incorporated controllers and processors wherever they process (Art. 6). The Commissioner of Data Protection administers it (Art. 8).

Unlike the PDPL, it has a legitimate-interests basis, which gives way where the person's interests or rights override it (Art. 10(f)). A company in a group may have a legitimate interest in moving data within the group for internal administrative purposes (Art. 13(2)). The article does not mention marketing.

Consent must be freely given by a clear affirmative act, and obtained for each purpose in a clearly distinguishable way (Art. 12(1), Art. 12(3)). Withdrawing it must be at least as easy as giving it (Art. 12(5)), and the right to withdraw is absolute (Art. 32(2)).

A person must be told before their data first goes to third parties for direct marketing, and be expressly offered the right to object (Art. 34(1)(b)). They may object to direct marketing at any time, profiling included (Art. 34(1)(c)), and these rights must be put to them prominently and separately by the first communication (Art. 34(4)). Schedule 2 sets the maximum fine per contravention at USD 100000 for Article 34 and USD 50000 for Article 12. Article 62(3) also allows a general fine not limited to the schedule.

The ADGM Data Protection Regulations 2021 apply to processing in the context of an ADGM establishment, whether or not the processing takes place in ADGM (s.3(1)). The text used is the February 2024 consolidation, and the amendments published up to September 2025 leave these sections unchanged.

ADGM also has a legitimate-interests basis beside consent (s.5(1)(f)). Consent must be freely given and specific (s.6(1)). It must also be informed and unambiguous, and under section 6(2) silence and pre-ticked boxes do not constitute consent. The controller must be able to demonstrate consent (s.6(4)), and withdrawing it at any time must be as easy as giving it (s.6(7), s.6(8)).

A person may object at any time to processing for direct marketing, including profiling (s.19(3)). The data must then not be processed for that purpose (s.19(4)). No later than the first communication, the right must be presented to them clearly and separately from any other information (s.19(6)).