Website Privacy Policy UAE: What to Publish and Include

A website privacy policy in the UAE should tell visitors what personal data you collect, why, who sees it, how long you keep it and how to withdraw consent or ask for correction. The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the PDPL) is what shapes those pages for most mainland and free zone businesses. Add a separate terms page if you sell online.

This is a practical guide, not legal advice. Have a UAE lawyer review your final text.

Do you need a privacy policy on a UAE website?

Yes, if your site collects anything that identifies a person. That includes a quote request form, a newsletter box, a WhatsApp click-to-chat link that logs numbers, a checkout and analytics tools.

Here is the nuance. The sources I checked disagree on whether the PDPL names a "privacy policy page" as a stand-alone requirement. What the law does require is that you can prove consent, and that consent is clear and easy to understand. A plain notice linked next to every form is the simplest way to do that.

Who is covered? The PDPL applies to controllers and processors based in the UAE. It also reaches those outside the UAE who process data of people in the UAE. DIFC and ADGM have their own data laws, and u.ae lists DIFC Data Protection Law No. 5 of 2020 among the related laws. The u.ae data protection page describes the PDPL as the framework for how personal data is processed and how companies keep it secure and confidential.

What does the PDPL say that affects your enquiry form?

Five parts of the PDPL text matter most for a business website. Check the exact wording in the official document before you rely on this summary.

u.ae also says the law lets data owners ask for corrections and ask to restrict or stop processing. So your policy should say how.

What should a website privacy policy UAE businesses publish include?

Cover the points below, in plain English. Keep it short enough that a buyer will actually read it.

1. Who you are. Legal name, trade licence number, licensing authority (DED of the emirate or the free zone) and a contact email.
2. What you collect. Name, email, phone, company, shipment details, delivery address, IP address, cookie data. List only what is true.
3. Why you collect it. One line per purpose: reply to a quote, process an order, send updates, measure site visits.
4. Your basis. Consent, or a contract or request from the person.
5. Who receives it. Your CRM, email tool, payment provider, couriers, analytics. Name the categories.
6. Transfers abroad. If your forms, CRM or hosting sit on servers outside the UAE, say so.
7. How long you keep it. A real period, for example "enquiries not converted are deleted after 12 months", if that is your rule.
8. Security. What you do, in a sentence or two. No big promises.
9. Their rights. Access, correction, erasure, restriction, withdrawal of consent, portability, and how to ask.
10. Cookies. If you run analytics or advertising pixels, list them and ask before switching on the non-essential ones. This is good practice, so check with your adviser on exact duties.
11. Review date. Show when you last updated the page.

What terms does a UAE website need?

If you sell to consumers online, you need terms and conditions, and they are not optional decoration. Three federal rules are relevant.

In practice, your terms page should cover:

• Your legal name, licence and licensing entity.
• What you sell, with specifications and prices.
• Payment methods and any fee. If there is a COD fee or card surcharge, state it before checkout.
• Delivery, returns, refunds and warranty.
• How to complain. u.ae gives the Ministry of Economy consumer line as 800 1222, and says each emirate's DED handles consumer complaints.
• Governing law and how disputes are handled.

Do not copy a clause such as "no refunds under any circumstances". Under the consumer law, a term that harms the consumer is void, so it protects nobody and looks bad.

How do you set up consent on your enquiry forms?

Say a Sharjah trading company has a "Request a quote" form. Here is a clean setup.

1. Keep the form to what you need: name, work email, phone, message.
2. Put one line under the button: "We use your details to reply to this enquiry. Read our [Privacy Policy]."
3. Add a separate, unticked box for marketing: "Send me product updates by email." If you also want WhatsApp updates, make that its own box.
4. Log the date, time, form version and the choice made. Article 6 puts the burden of proving consent on you.
5. Give people an easy way out. Every marketing message needs an unsubscribe route, and WhatsApp messages need the line "Reply STOP and we will not message you again."
6. Send WhatsApp broadcasts only to people who opted in. A quote request does not mean they agreed to promotions.

Quickship's Meta Messaging module gives you a shared inbox for WhatsApp, Instagram and Messenger. It does not replace consent. You still need the opt-in record.

What mistakes do UAE sites make most often?

• A policy that names tools you do not use, or leaves out ones you do. Check your forms, plugins and tracking before you write.
• Pre-ticked consent boxes. Article 6 asks for clear, unambiguous consent. A box the visitor never touched is hard to defend.
• Bundling marketing into the enquiry. A person asking for a freight quote has not asked for a newsletter.
• No way to withdraw. The right to withdraw must be stated, and it must be easy.
• Hidden fees. A COD or payment fee that appears only at the last step conflicts with the duty to announce fees in your terms.
• Keeping everything forever. Article 5 limits retention to the purpose.
• Pages with no date or owner. Someone on your team should own the page and review it.
• Assuming the rules are finished. The u.ae page describes the UAE Data Office in the future tense, with duties such as preparing policies and setting up complaints systems. Compliance guides also reported the Executive Regulations as still pending. Expect more detail later.

A checklist before you publish

• Privacy policy live, linked in the footer and next to every form.
• Terms and conditions live if you sell online, with fees and returns stated.
• Marketing consent separate and unticked.
• Consent log stored with date and form version.
• A named person and email for data requests.
• Arabic version planned if you sell to consumers.
• A lawyer has read it.
• Review date set.

If you need the pages built into a new site, Quickship's business websites start from AED 49 a month, or AED 99 with hosting and domain. We build the site and the forms. The legal text should still come from, or be checked by, your lawyer.