UAE Data Protection Law and Your Website: A Practical Checklist

Your website collects personal data every time someone fills in a form. Here is a practical checklist to handle that data in line with UAE data protection law and your customers' expectations.

Contact forms, newsletter sign-ups, booking systems and analytics all collect personal data. In the UAE, the main federal law is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, often called the PDPL. This checklist covers the practical website points. It is general information, not legal advice, so confirm your obligations with a qualified lawyer.

Who the law covers

The PDPL applies to processing personal data of people in the UAE, including by businesses outside the country. Some areas have their own rules: companies in the DIFC and ADGM free zones follow those zones' data protection laws, and sectors such as health and banking have additional regulations.

1. Collect only what you need

Review every form. If you do not need a date of birth or a passport number to answer an enquiry, do not ask for it. Less data means less risk.

2. Explain why, at the point of collection

Next to each form, explain briefly what you will use the data for and link to your privacy policy. Do not pre-tick consent boxes.

3. Separate service messages from marketing

Answering an enquiry and sending marketing are different purposes. Ask for marketing consent separately, record when and how it was given, and make it easy to withdraw.

4. Publish a clear privacy policy

Your policy should explain, in plain language:

• what data you collect and why;
• who you share it with, for example hosting, email and CRM providers;
• whether data is transferred outside the UAE;
• how long you keep it;
• how people can ask to access, correct or delete their data, and how to contact you.

5. Be careful with tracking

Analytics and advertising tags collect data about visitors. Use them transparently, explain them in your policy, and use a consent banner, especially if you have visitors from regions with strict cookie rules such as the EU.

6. Secure the data

• HTTPS on every page.
• Strong passwords and two-factor login for admin areas.
• Access limited to the people who need it.
• Regular updates and backups.
• Spam protection on forms.

7. Plan for incidents

Know who to call if data is exposed: who investigates, who decides whether to notify the authorities and the people affected, and how quickly. Write it down before you need it.

8. Check your suppliers

Your website host, form tools, email platform and CRM all process your customers' data. Choose reputable providers and understand where they store data.

Rights people can ask you to honour

Data protection laws give individuals rights over their personal data. Under the PDPL these include asking what data you hold about them, asking you to correct it, and in some cases asking you to delete it or stop processing it. Prepare a simple process:

1. A clear contact point, such as a dedicated email address, in your privacy policy.
2. A way to confirm the person's identity before sharing data.
3. A list of the systems where their data may be: website, CRM, email platform, spreadsheets.
4. A record of each request and how you responded.

Retention: do not keep data forever

Decide how long you keep enquiries, applications and marketing lists. Old data that serves no purpose is a risk without a benefit. Set retention periods, delete or anonymise data when they expire, and make sure your backups follow the same logic.

A quick self-assessment

Answer these questions honestly:

• Do we know every place our website sends personal data?
• Could we tell a customer what we hold about them within a few days?
• Can marketing contacts unsubscribe in one step?
• Are admin accounts protected with two-factor login?
• Do we know who to call if there is a data incident?

Any "no" is a good place to start improving.

How Hermitz can help

We build websites and systems with consent-based forms, secure admin areas, audit logs and clear data flows, and we can prepare a draft privacy policy for your lawyer to review. See web development in Dubai or contact us.

Frequently asked questions