The UAE Personal Data Protection Law (PDPL) is not a cookie banner fashion trend — it is about how you collect, store, transfer, and delete personal data. This checklist covers what we implement on client websites. It is operational guidance for builders and marketers, not legal advice — confirm edge cases with your counsel.
Quick answer
A PDPL-ready Dubai website typically needs: a clear privacy notice, lawful basis / purpose statements for forms, cookie/consent controls for non-essential trackers, a way to receive access/deletion requests (DSAR), retention limits, secure hosting with access control, and vendor processing awareness (CRM, email, ads pixels). Hide nothing essential behind 'contact us for privacy'.
Minimum website surfaces
- Privacy policy — Arabic or EN (match your audience); last updated date
- Cookie / consent UI — distinguish essential vs analytics/ads
- Form notices — why you collect phone/email; link to privacy
- Contact path for data requests — email or form monitored
- Security basics — HTTPS, hardened headers, no plaintext passwords
Forms and lead capture
WhatsApp click-to-chat still creates personal data when chats continue. CRM dumps of every lead forever without retention rules are a common Dubai SMB failure. Define how long quotes live in HubSpot/Zoho/WhatsApp Business, and who can export them.
Hosting and processors
- Know where personal data is stored (UAE vs overseas)
- Limit admin accounts on WordPress / Shopify / hosting panels
- Turn off unused plugins that phone home
- Document ad pixels (Meta, Google) as processors in your notices
Launch checklist
- 1Privacy + cookie pages live and linked in footer
- 2Consent mode tested (reject analytics → tags do not fire)
- 3DSAR inbox monitored
- 4Backup encryption and access logging for the CMS
- 5Staff briefed: do not paste lead lists into public ChatGPT chats
Building or rebuilding a Dubai site?
We ship PDPL-aware consent, privacy pages, and secure hosting as part of web design and development — not as an afterthought PDF.
Frequently asked questions
Does every brochure site need PDPL work?
If you only publish static info with no forms or trackers, scope is lighter. Most commercial Dubai sites collect emails/phones and run ads pixels — those need notices and controls.
Is a EU GDPR template enough?
It is a starting point, not a paste job. Align language to UAE PDPL concepts and your actual tools (WhatsApp, Tabby, local hosts).
Can Azizi Technologies give legal sign-off?
No — we implement technical and UX controls. Your lawyer should review high-risk processing (health, finance, children’s data).
Shafeeq A.
· Senior Apple Repair EngineerSenior Apple repair engineer at Azizi Technologies. 12+ years board-level repair on MacBook Pro, MacBook Air, iMac, Mac Studio, Mac mini. Apple-certified diagnostics, JBC NASE-2C micro-soldering specialist. Frequently mentioned by name in Google reviews.
Want Web Development Dubai done for you?
Send your domain. We reply with a go or no-go and a written fee for Web Development Dubai. WhatsApp is fastest.