Privacy policy, cookies and analytics for a UAE website

Almost every business website we are asked to rebuild in the UAE arrives with a privacy policy that was copied from somewhere else. It mentions a company in another country, a regulator that has no authority here, and cookies the site does not set. It is not the worst thing on the site, but it is the one page that makes a specific promise to every visitor, and a promise nobody read is worth nothing.

The UAE has had its own data protection law since the start of 2022. Here is what it says, what it does not yet say, and the small number of changes that put a normal business website on the right side of it.

This is a studio's practical summary, not legal advice. For a specific situation, and especially for anything involving health, financial or children's data, use a lawyer.

The law that applies to you

The federal statute is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. The government's own summary describes its reach plainly: it covers the "processing of personal data, whether in full or part through electronic systems, inside or outside the country", processing is prohibited "without the consent of its owner" apart from specified cases such as protecting a public interest or carrying out legal procedures, and a person may ask for inaccurate data to be corrected and for processing of their data to be restricted or stopped (UAE Government portal, data protection laws).

Two operational duties matter to a website owner. Under Article 9 a controller must report a breach that would prejudice the privacy, confidentiality or security of personal data to the UAE Data Office as soon as it becomes aware of it. Under Article 10 a data protection officer has to be appointed where processing carries a high risk to privacy, where it involves a systematic overall assessment of sensitive data including profiling, or where it involves sensitive personal data at scale. Most brochure and catalogue sites are nowhere near that threshold; a clinic, a school or a recruiter may well be.

One honest caveat. Article 28 provides for executive regulations to fill in the detail — the deadlines, the procedures, the penalty scale. At the time of writing they have not appeared on the UAE Legislation portal or on the government portal's data protection page, which was last updated in December 2025. Treat the obligations in the law as real and the fine print as unsettled, and check the UAE Data Office before relying on a specific number you read anywhere, including here.

If you are licensed in DIFC or ADGM, a different law applies

This catches people out. The federal law does not govern the two financial free zones: a company established in the Dubai International Financial Centre follows DIFC Data Protection Law No. 5 of 2020, in force since July 2020, and a company in Abu Dhabi Global Market follows the ADGM Data Protection Regulations 2021, in force since February 2021. Both are closer to the European GDPR in structure, both have their own regulator, and both have registration and notification duties the federal law does not. If your trade licence says DIFC or ADGM, your privacy policy should name that law, not the federal one.

And if you sell to people in Europe or the United Kingdom, their rules can reach you regardless of where you are licensed. A UAE company with a checkout that ships to Germany is processing the data of people in the EU, and the GDPR says so.

Start with a data map, not a policy

A privacy policy is a description. You cannot describe what you have not listed. For a typical business site the list takes an afternoon:

• Forms. Contact, quote request, careers, newsletter. What each one asks for, where it is delivered, who can read it, how long it stays there.
• Third parties the page loads. Analytics, a chat widget, a map, a font host, a video embed, reCAPTCHA, an ad pixel. Every one of them sees the visitor's IP address and often sets a cookie.
• Tools behind the scenes. The mailbox that receives enquiries, the CRM, the newsletter platform, the invoicing system, the backup location.
• Where the servers are. The answer decides whether you are transferring data out of the country and what you say about it.
• Who has access. Named people, not "the team". Remove the agency that built the site in 2019 while you are at it.

Write it as a table. It becomes the privacy policy, the answer to a customer who asks what you hold, and the document you need on the worst day.

What a policy for a UAE business should actually contain

• Who you are, with the legal entity name, the licence jurisdiction and a real email address for privacy questions.
• What you collect, split by purpose: an enquiry form, an order, a job application, analytics.
• Why you are allowed to collect it: consent, a contract, a legal obligation.
• Who else sees it, by name and category, including the processors above.
• Whether it leaves the UAE, and where to.
• How long you keep it, with a number. "As long as necessary" is not a retention period.
• The rights the law gives: access, correction, restriction, stopping processing, withdrawing consent, and how to exercise them.
• How to complain, including to the regulator.
• The date it was last updated.

Say it in the plainest language you can. A privacy policy that reads like a contract is a privacy policy that was written to be ignored.

Cookies: what actually requires a banner

The UAE has no separate cookie statute of the European kind, so there is no automatic requirement here to interrupt every visitor with a consent dialogue. The duty that does apply is the general one: if what you are loading collects personal data, you need a basis for it, and consent is the usual one.

In practice the answer depends on what your site loads.

• Nothing beyond your own site. No banner needed. A cookie that only remembers the language or the theme is not the problem the rules were written for.
• Advertising or cross-site tracking pixels. Ask first. These exist to follow people between sites, which is exactly what consent rules exist to control.
• Any of the above plus visitors in Europe or the UK. Ask first, properly, with a real "reject" that is as easy as "accept".

A banner that sets the trackers before you answer, or that only offers "accept", is worse than none: it documents the problem without solving it.

Analytics you can run without the awkward conversation

Most sites in the UAE install the same analytics script, accept the cookie banner it forces on them, and then look at the numbers twice a year. There is a lighter option, and it is what this site runs.

Our analytics is first-party: the page reports to our own API, on our own domain, and no third party is involved. There is no cookie and no persistent identifier. A visitor is counted by a keyed hash of the address and the browser string that is re-keyed every day, so the same person is one visit today and an unrelated one tomorrow, and the address itself is never stored. Bots are detected and excluded rather than counted. Individual rows expire on a schedule; the aggregates stay.

What that buys, beyond a cleaner conscience: no banner to negotiate, no third-party script in the critical path, numbers that are not silently reduced by ad blockers, and a much shorter privacy policy. What it costs: no cross-site audience data for ad platforms. For a studio, a clinic, a law firm or a manufacturer, that is not a loss.

The half-hour that fixes most sites

• Replace the copied policy with one that names your entity, your jurisdiction and your actual tools.
• Put a link to it in the footer and beside every form's submit button.
• Add a line above the button saying what happens to the message and how long it is kept.
• Delete the tools you no longer use, starting with the pixel from a campaign that ended two years ago.
• Set a retention rule for the enquiry mailbox and follow it.
• Put a privacy address on the site that reaches a person.
• Check TLS is on every page. Let's Encrypt made certificates free in 2016; there is no excuse left.

None of this is difficult. It is simply nobody's job, until a customer asks a question that starts with "what exactly do you do with".

Sources

• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, on the UAE Legislation portal.
• UAE Government portal, data protection laws: scope, consent, the rights of a data subject and the role of the UAE Data Office.
• DIFC Data Protection Law No. 5 of 2020 and the ADGM Office of Data Protection: the two financial free-zone regimes.
• The description of this site's own analytics is our implementation, not a standard.