UAE PDPL
compliance
The UAE's federal PDPL (Federal Decree-Law No. 45 of 2021) brings GDPR-style rules to the Emirates: consent as the core basis, data-subject rights, and a dedicated Data Office that is still being stood up, with the TDRA handling queries in the meantime. DIFC and ADGM run their own GDPR-like laws instead of the federal one.
Trusted by 2,000+clients worldwide
UAE PDPL at a glance
The law
Federal Decree-Law No. 45 of 2021, the UAE's first federal data-protection law.
Regulator
The UAE Data Office; DIFC and ADGM run separate regimes for their zones.
Penalties
Administrative fines set by Cabinet decision under the executive regulations.
Consent standard
Clear, unambiguous consent is the default basis, with defined exceptions.
This guide is general information for site owners, not legal advice. Check the current text of the law and your own counsel for your situation.
What the law requires on your website
Consent as the core basis
Processing rests on consent unless a statutory exception applies, and web tracking for marketing fits the consent case squarely.
Data-subject rights
Access, correction, deletion, restriction and objection, with consent withdrawal as easy as giving it.
Free-zone regimes
Companies set up in DIFC or ADGM fall under those zones' own GDPR-style data-protection laws and commissioners instead of the federal PDPL. Everyone else in the UAE, including companies in other free zones, sits under the federal law.
How Clickio Consent helps
Serve visitors from the UAE a consent flow configured for the PDPL: a localized dialog, granular purposes, equal-weight decline and stored records.
One tag, per-region rules
Clickio detects each visitor's location and serves the consent experience you configure for that region, this law included, without affecting any other market.
Multi-regulation →Localized dialogs
Language auto-detection and full text customization put the dialog in your visitors' language, with granular purpose choices and equal-weight decline.
Customization →Evidence on file
Every choice is stored as a consent record: the demonstrable-consent trail modern laws place on the controller.
Reporting →Frequently asked questions
Is cookie consent required in the UAE?
The federal PDPL makes consent the default basis for processing personal data, which covers marketing and profiling trackers; DIFC and ADGM regimes are explicitly GDPR-like. A consent dialog is the practical answer.
What about DIFC and ADGM companies?
They are carved out of the federal PDPL and follow their zone's own data-protection law, both modeled on GDPR with an active commissioner. A GDPR-grade consent flow is the practical fit for either regime.
What do the executive regulations cover?
The PDPL leaves fine levels and many details to executive regulations that, as of 2026, have not been issued. The core consent duties are in the law itself, so the consent layer does not wait on them.
Does the PDPL reach foreign companies?
Yes. It applies to processing of UAE residents' data by controllers abroad as well as within the Emirates.
Arabic or English?
Both are common; Clickio's language auto-detection serves each visitor the language they browse in, with every string customizable.
Explore other regulations
Every guide shows how the same Clickio tag serves the right consent experience for that market. Pick the next one that applies to your audience.
Add this market to your consent setup. Start with a 14-day free trial; per-region settings and multi-language dialogs start on Starter.
Per-region settings (own texts, choices and fallback) and multi-language dialogs start on the Starter plan.