The UAE Personal Data Protection Law (PDPL) is not a cookie banner fashion trend — it is about how you collect, store, transfer, and delete personal data. This checklist covers what we implement on client websites. It is operational guidance for builders and marketers, not legal advice — confirm edge cases with your counsel.
Quick answer
A PDPL-ready Dubai website typically needs: a clear privacy notice, lawful basis / purpose statements for forms, cookie/consent controls for non-essential trackers, a way to receive access/deletion requests (DSAR), retention limits, secure hosting with access control, and vendor processing awareness (CRM, email, ads pixels). Hide nothing essential behind 'contact us for privacy'.
Minimum website surfaces
- Privacy policy — Arabic or EN (match your audience); last updated date
- Cookie / consent UI — distinguish essential vs analytics/ads
- Form notices — why you collect phone/email; link to privacy
- Contact path for data requests — email or form monitored
- Security basics — HTTPS, hardened headers, no plaintext passwords
Forms and lead capture
WhatsApp click-to-chat still creates personal data when chats continue. CRM dumps of every lead forever without retention rules are a common Dubai SMB failure. Define how long quotes live in HubSpot/Zoho/WhatsApp Business, and who can export them.
Hosting and processors
- Know where personal data is stored (UAE vs overseas)
- Limit admin accounts on WordPress / Shopify / hosting panels
- Turn off unused plugins that phone home
- Document ad pixels (Meta, Google) as processors in your notices
Launch checklist
- 1Privacy + cookie pages live and linked in footer
- 2Consent mode tested (reject analytics → tags do not fire)
- 3DSAR inbox monitored
- 4Backup encryption and access logging for the CMS
- 5Staff briefed: do not paste lead lists into public ChatGPT chats
Building or rebuilding a Dubai site?
We ship PDPL-aware consent, privacy pages, and secure hosting as part of web design and development — not as an afterthought PDF.
