UAE and Saudi Data Protection Laws: What Your Website Needs to Comply

Contact forms, newsletter sign-ups, online orders, WhatsApp chats and analytics all collect personal data. If your business serves customers in the UAE or Saudi Arabia, that data is now covered by dedicated data protection laws, and your website is usually the first place where compliance, or the lack of it, becomes visible.

The good news is that most of what these laws expect from a typical business website is practical and achievable: be clear about what you collect, collect only what you need, get consent where required, keep data secure and respect people's rights. This guide explains the UAE and Saudi data protection laws in plain English and turns them into a checklist for your website.

This article is general information, not legal advice.

Which data protection laws apply to your website?

The UAE: Federal Decree-Law No. 45 of 2021 (PDPL)

The UAE's federal Personal Data Protection Law is Federal Decree-Law No. 45 of 2021, which came into force on 2 January 2022. It is overseen by the UAE Data Office. It covers the processing of personal data of people in the UAE, and it can also apply to businesses outside the country that process their data. The government's overview of UAE data protection laws is a useful starting point.

The detailed Executive Regulations and enforcement timeline have been reported inconsistently, so check the current status before you plan around specific deadlines.

Two financial free zones run their own regimes. Businesses in the Dubai International Financial Centre follow DIFC Law No. 5 of 2020, and those in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021. Some sectors, such as health and banking, may also have their own rules.

Saudi Arabia: the Personal Data Protection Law (PDPL)

Saudi Arabia's Personal Data Protection Law was issued by Royal Decree M/19 in 2021 and amended in 2023. It came into force on 14 September 2023, and after a one-year grace period it became fully enforceable in September 2024. It is supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA), and it is supported by Implementing Regulations and separate rules on transferring personal data outside the Kingdom.

SDAIA's National Data Governance Platform offers registration, breach notification and self-assessment tools for organizations. The Saudi law applies to processing of personal data in the Kingdom and can also reach businesses abroad that process the data of people in Saudi Arabia.

If you also serve customers in Europe, the EU's GDPR may apply as well. Our GDPR-compliant website checklist covers that side.

What counts as personal data on a website?

Personal data is any information that identifies a person directly or indirectly. On a typical business website, that includes:

• Names, phone numbers and email addresses from contact and quote forms.
• Delivery addresses and order history from your online store.
• Account logins and saved preferences.
• IP addresses, device identifiers and cookie IDs collected by analytics and advertising tools.
• WhatsApp and live chat conversations.
• CVs and documents uploaded through careers pages.

Some categories are treated as sensitive and need extra care, such as health information, biometric data, religious beliefs and financial details. If your forms collect any of these, take advice before launch.

Your website privacy policy: what it should cover

A clear privacy policy is the most visible sign that you take data protection seriously. Write it in plain language, publish it in both Arabic and English if your site is bilingual, and link to it from the footer and from every form. It should explain:

1. Who you are and how to contact you about privacy.
2. What personal data you collect and from where.
3. Why you collect it and the legal basis, such as consent or fulfilling an order.
4. Who you share it with, including hosting, payment, delivery, analytics and marketing providers.
5. Whether data is transferred outside the country, and how it is protected.
6. How long you keep it.
7. How people can access, correct or delete their data, or withdraw consent.

A copied template from another company's website is a common shortcut and a common mistake. It must describe what your site actually does.

Consent, forms and marketing

Both laws place significant weight on consent, alongside other legal grounds for processing. For a website, that usually means:

• Ask only for the fields you really need. If you do not need a date of birth, do not ask for it.
• Do not pre-tick marketing checkboxes. Make newsletter or WhatsApp marketing consent a separate, clear choice.
• Explain briefly next to the form what the data will be used for, with a link to the privacy policy.
• Keep a record of when and how each person consented.
• Make it easy to unsubscribe or withdraw consent at any time.

For cookies and analytics, neither law follows the EU's cookie rules word for word, but the principles of transparency and consent still apply. A simple banner that explains non-essential cookies and lets visitors accept or decline is a sensible baseline. Our article on cookie banners and analytics under GDPR explains how to set this up well.

Hosting providers, data transfers and security

Most small business websites rely on international services: cloud hosting, email platforms, analytics, CRMs and AI tools. Each of these may store personal data outside the UAE or Saudi Arabia. Both laws regulate these transfers, and the Saudi rules in particular set out detailed conditions.

Practical steps:

• List every provider that receives personal data from your website and where they store it.
• Check whether the provider offers regional hosting or data residency options.
• Sign data processing agreements with providers that handle data on your behalf.
• Mention international transfers in your privacy policy.

This matters for AI features too. If you add a chatbot, its conversations are personal data, as we discuss in Arabic AI chatbots for customer service.

Security and breach response

Both laws expect appropriate technical and organizational security measures, and both include obligations to notify the regulator, and in some cases affected individuals, after certain data breaches. For a website, a sensible baseline is:

• HTTPS everywhere, with automatic certificate renewal.
• Up-to-date software, themes and plugins, or a simpler stack with fewer moving parts.
• Strong passwords and two-factor authentication for admin and hosting accounts.
• Regular backups stored separately from the live site.
• Limited admin access, removed promptly when staff leave.
• A short written plan for what to do if you suspect a breach.

We learned this first-hand when HEXACODES cleaned up a spam-injection compromise on its own WordPress site and moved to a fast static site with far fewer attack points.

A quick compliance checklist for your website

• Map the personal data your site collects and where it goes.
• Publish an accurate, bilingual privacy policy.
• Minimize form fields and separate marketing consent.
• Add a cookie notice with a real choice for non-essential cookies.
• Review international providers and data transfers.
• Secure admin access, updates and backups.
• Set up a simple process to respond to data requests and breaches.
• If you sell online, review checkout and order data too, as covered in our Saudi and UAE e-commerce guide.

How HEXACODES can help

HEXACODES builds secure websites, online stores and apps for businesses across the region, and offers cyber security services alongside development. We can audit what data your site collects, simplify forms, set up consent and harden hosting, working with your legal adviser on the policy wording.

For a new, privacy-conscious site, a full business website starts at $30/month. For an audit, contact us on WhatsApp at +961 81 924581 or info@hexacodes.net.

Frequently asked questions

Does the UAE PDPL apply to small businesses?

The UAE PDPL is not limited to large companies, so small businesses that collect personal data through their website should assume it is relevant. Businesses in DIFC or ADGM follow their own free zone data protection rules instead. Because the detailed regulations and enforcement timeline have been reported inconsistently, check the current status with a legal adviser.

Does the Saudi PDPL apply if my business is outside Saudi Arabia?

It can. The Saudi PDPL can apply to organizations outside the Kingdom that process personal data of people in Saudi Arabia, for example by selling to them online. If you target Saudi customers, review its requirements, including the rules on transferring data outside the Kingdom.

Do I need a cookie banner for a UAE or Saudi website?

Neither law copies the EU's detailed cookie rules, but both expect transparency and, in many cases, consent for processing personal data. Analytics and advertising cookies typically collect identifiers that count as personal data. A clear banner with a genuine choice for non-essential cookies is a sensible, low-cost safeguard.