UAE PDPL for Online Stores: What the Law Requires

The UAE PDPL is Federal Decree Law No. 45 of 2021 Regarding the Protection of Personal Data, and it applies to online stores that collect customer names, phone numbers, addresses and order history. In practice it means you need a lawful reason to collect data, a clear privacy notice, proper security, and consent before marketing on channels like WhatsApp.

The UAE Government portal says the law came into force on 2 January 2022. This guide covers what it means for a UAE online store, and what to check against the law text or with a UAE lawyer.

What is the UAE PDPL and does it apply to my store?

The UAE PDPL is the federal law that protects individuals' privacy and the confidentiality of their information in the UAE. The u.ae portal describes it as a framework for exactly that. The official PDF is available in Arabic only, so many businesses read English summaries. Treat those as guides, not the law.

Commentary from law firms and compliance sites (which we could not check against the law text) says:

• The law covers businesses in the UAE that decide how and why data is used (controllers) and those that process it for them (processors).
• It also reaches businesses outside the UAE that process data of people in the UAE. A foreign brand selling into the UAE is likely covered even without a local entity.
• Some data has its own rules, such as government, health and banking or credit data.
• Free zones with their own data law are outside it. DIFC has Data Protection Law No. 5 of 2020 and ADGM has Data Protection Regulations 2021.
• Other free zones without their own law are said to fall under the federal PDPL. If you sit in a zone like KEZAD or Dubai Silicon Oasis, ask your zone authority which law applies.

On the regulator, the UAE Government page on the PDPL says the UAE Data Office "will act as the federal data regulator". Sources differ on whether the Executive Regulations, which carry the detail, have been issued. Check the official pages before you rely on any deadline or procedure.

What counts as personal data in an online store?

Personal data is any data relating to an identified or identifiable person. The ai.gov.ae page lists name, voice, image, ID number, online identifier and geographical location as examples. So an order record, a phone number and a delivery location are all personal data.

Cash on delivery adds a twist. Your courier needs the customer's name, phone and address to deliver and collect cash. You are sharing personal data with that courier, so decide what they get and why.

What does the UAE PDPL require of an online store?

It requires a lawful basis for each use of data, transparency, security, and a way for people to exercise their rights. Commentary maps the main duties as follows: Articles 4 to 6 cover lawful processing and consent, Articles 7 and 8 cover controller and processor duties, Article 9 covers breach reporting, and Articles 13 to 18 cover data subject rights. Verify article numbers against the law itself.

Consent is described as the default basis, with listed exceptions. Commentary points to legitimate purposes and contract necessity, such as using an address to deliver an order the customer placed.

Here is a practical sequence for a store:

1. Map your data. List every place customer data lives: your store platform, payment tool, courier dashboards, email tool, ad pixels, WhatsApp inbox, spreadsheets.
2. Write down why you collect each item. "To deliver the order" is clear. "Just in case" is not.
3. Publish a privacy notice. Say what you collect, why, who receives it, where it goes and how customers can contact you. Link it at checkout and in the footer.
4. Separate consent from order terms. Marketing consent should be a separate, unticked choice. Do not bundle it into "I agree to the terms".
5. Secure the data. Use unique logins, two-step verification, role-based access and removal of ex-staff accounts. Commentary cites Article 20 on data security.
6. Set a process for customer requests. Commentary lists rights to access, correction, erasure, restriction, portability and objection. Decide who handles requests and where you log them.
7. Prepare a breach plan. Know who to tell internally, how to contain the incident, and how you would report it. Check the current official reporting requirements.
8. Put terms in place with suppliers. Couriers, payment providers and software vendors that handle customer data for you should be bound by written terms.

Response times for rights requests depend on the Executive Regulations according to some commentary. One site cites 30 days, but we cannot confirm that as law. Check the official source.

How does the UAE PDPL affect cookies and tracking?

Tracking tools handle online identifiers, which the law lists as personal data. Commentary says the PDPL does not single out cookies, but IP addresses and device IDs are still personal data and non-essential cookies need consent.

For a store, this means:

• Load analytics and ad pixels only after the visitor agrees, where consent is your basis.
• Keep essential cookies (cart, login, security) separate from marketing ones.
• List the tools in your privacy notice.

How does the UAE PDPL affect WhatsApp marketing?

You may message customers on WhatsApp for marketing only if they opted in. This matches both Meta's rules and the consent approach in the PDPL.

Meta's opt-in guidance says a business may contact someone only if the person gave their mobile number and agreed to receive later messages or calls. The opt-in must clearly say the person is opting in to communication from your business and must name the business. You choose the method (Meta lists SMS, website, phone/IVR, and in person or on paper), but you must make sure it complies with applicable law.

The WhatsApp Business Messaging Policy says the business is solely responsible for the opt-in method and any notices or permissions the law requires. Its best practice:

• Cover the message types you will send, such as order updates and offers.
• Use a separate opt-in for each message category, and a separate one for calls.
• Give clear opt-out instructions and honour them.

A simple checkout wording: "Send me order updates on WhatsApp from [Store name]" as one box, and "Send me offers on WhatsApp from [Store name]" as another. Keep a record of when and how each customer agreed.

Do not add scraped numbers, bought lists or people who only gave their number for a delivery to a broadcast list. Delivery contact is not marketing consent.

If your team replies to customers on WhatsApp, Instagram and Messenger, a shared inbox helps keep conversations in one place with clear access. Quickship's Meta Messaging Module is software for that. It does not make you compliant by itself. Opt-in wording, records and opt-out handling remain your responsibility.

Can I send customer data outside the UAE?

Yes, in defined cases. The ai.gov.ae page says transfer abroad is allowed to a country with similar data protection legislation, if that country upholds its own legislation. For a country with different or no legislation, transfer is allowed through agreements with the foreign party to comply with UAE law. It also needs either consent or contractual necessity.

This matters if your store platform, email tool, analytics, CRM or support software stores data on servers abroad. Ask each vendor:

• Where is the data stored and processed?
• Do you have a data processing agreement?
• What happens to the data if we end the contract?

Record the answers. Update your privacy notice to mention transfers abroad.

What mistakes do UAE online stores make?

• Copying a privacy policy from a UK or US site. It will not match UAE law or your own practice.
• Treating delivery details as marketing permission. Order data is for the order.
• Keeping data forever. Decide how long you keep order, chat and COD records, and delete or anonymise after that.
• Sharing too much with couriers. Send only what delivery needs.
• Shared logins. One password for the whole team leaves no trail and no control.
• Ignoring free zone rules. Confirm whether your zone has its own data law.
• Assuming the law is settled in detail. Executive Regulations and regulator guidance may change what you must do. Re-check official pages regularly.

This article is general information, not legal advice. For a firm answer on your setup, speak to a UAE data protection lawyer.