UAE Data Protection Law for Online Stores: Consent, Customer Rights, Marketing Data and What You Should Put on Your Website

The UAE's federal personal data protection law is Federal Decree-Law No. 45 of 2021. The government portal says it applies to the processing of personal data "inside or outside the country", including processing done in full or in part through electronic systems. For an online store that means: get consent before you process a customer's data, keep it secure, let customers correct or restrict it, and be careful about sending it abroad. Two things we could not confirm from an official page are the penalty amounts and whether the executive regulations have been issued, so this page does not quote them.

Does the UAE data protection law apply to your website?

If your store collects names, phone numbers, addresses, emails, order history or payment details from people, it processes personal data. The portal describes the law as a framework for confidentiality and privacy that covers processing inside or outside the UAE, including electronic processing.

Free zones can have their own data rules. We did not open a free zone authority's data regime for this page, so ask your zone whether it adds anything to the federal law. Your trade license route is covered in what license you need to sell online in the UAE.

What does consent mean for a store?

The portal says the law prohibits processing personal data without the consent of its owner, with exceptions where processing is necessary to protect a public interest or to carry out certain legal procedures and rights. The portal summary does not define the form consent must take, so use a safe approach:

• Checkout. Tell the customer why you need each data item, such as delivery or payment, before they submit it.
• Marketing. Use a separate, unticked box for emails and WhatsApp offers. Do not bundle it into the terms.
• Cookies and pixels. Describe advertising and analytics tools in your privacy policy.
• Records. Keep a time-stamped record of what each customer agreed to.

This is our practical recommendation built on the consent rule, not a published formula.

Can you use customer data for marketing?

The Ministry of Economy and Tourism's consumer protection page lists, among consumer rights, the protection of personal data, which may not be used for promotion or marketing. That page is in Arabic and we are reading its summary of the right, not the article text. The cautious reading for sellers: do not email or message a customer for promotions unless they agreed.

If you advertise on social media or influencers, check the separate rules in advertiser permits in the UAE. For marketplace advertising, your customer targeting happens inside Amazon.ae and noon; see marketplace ads management.

What rights do customers have over their data?

According to the portal, the data owner can request correction of inaccurate personal data and can restrict or stop the processing of their data. Set up a simple process:

1. Publish a contact address for privacy requests in your privacy policy.
2. Verify who is asking before you change or delete anything.
3. Correct, restrict or stop processing as requested, and tell your processors, such as your courier or gateway, where needed.
4. Keep a log of requests and the date you answered each one.

The portal summary does not give a response deadline, so do not promise a number of days that you cannot back with a source.

Can you send customer data outside the UAE?

The portal says the law sets requirements for cross-border transfer and sharing of personal data for processing. The summary does not list the conditions. Many store tools host data abroad: Shopify, email platforms, analytics, customer chat and some couriers. List every tool that touches customer data in a simple register, note where it processes the data, and ask each vendor for its data protection terms. When the UAE Data Office issues guidance, update the register.

What must you do to keep data secure?

The portal says companies that hold personal data must secure it and maintain its confidentiality and privacy. Minimum steps for a store:

• Use two-step authentication on your store admin. Shopify requires this for Shopify Payments.
• Give staff access only to the data they need, and remove access when they leave.
• Never store card numbers yourself. Use a payment gateway; see payment gateways for UAE stores.
• Do not collect more than you need. A COD order needs an address and phone number, not an ID copy; see cash on delivery for UAE sellers.
• Delete exports and spreadsheets when finished.

What is the status of enforcement and penalties?

The government portal summary does not mention penalties. It says the UAE Data Office, affiliated with the UAE Cabinet, will prepare guidelines and instructions for implementing the law, and does not state whether they have been issued. We searched for the status of the executive regulations, and the secondary sources conflict: most say they had not been issued by mid-2026, one says they had. Figures such as AED 50,000 to AED 5 million, a 72-hour breach window or a headcount threshold for a data protection officer appear in blogs, but we could not trace them to a primary instrument, so we do not repeat them.

Check the UAE Data Office and the official legislation portal for any new instrument before you rely on any penalty or deadline.

What should your privacy policy and checkout say?

Include, in Arabic and English:

1. who you are (trade name, license number, contact);
2. what data you collect and why;
3. who receives it (courier, gateway, marketplace, analytics);
4. whether it leaves the UAE;
5. how long you keep it;
6. how a customer can correct, restrict or stop processing;
7. how marketing consent works and how to withdraw it.

The consumer protection law also requires Arabic information about products and contract terms, so keep your policy pages consistent with the rules in UAE consumer protection and online returns and the UAE e-commerce law guide.

FAQ

Does the UAE have a data protection law for websites? Yes. Federal Decree-Law No. 45 of 2021 governs personal data processing inside or outside the UAE, including electronic processing. It requires consent, security and rules for cross-border transfers, and gives data owners rights to correct and restrict processing.

Do I need customer consent to collect data at checkout? The law prohibits processing personal data without the owner's consent, with exceptions for a public interest or certain legal procedures. Tell customers what you collect and why, and keep a record. Use a separate box for marketing.

Can I send promotional messages to my customers? Only with their agreement. The ministry's page lists protection of personal data from use for promotion or marketing as a consumer right. Use an unticked opt-in and a simple way to opt out.

Can I store customer data on servers abroad? The law sets requirements for cross-border transfer and sharing of personal data, but the government summary does not list them. Map where each tool processes data, ask vendors for their terms and check the UAE Data Office guidance when published.

What is the fine for breaching the UAE data protection law? The official summary does not state any penalty. Figures quoted online could not be traced to a primary source, so we do not give one. Check the UAE Data Office or a UAE lawyer for the current position.

Can customers ask me to delete or change their data? They can request correction of inaccurate data and can restrict or stop processing, according to the portal. Provide a contact address, verify the requester and keep a log. The summary does not give a response deadline.

Does a Shopify store need a privacy policy? The portal does not name privacy policies as such, but transparency and consent depend on telling customers how you use their data. A clear policy is the simplest way to do that, and Shopify provides places for policy pages in the store admin.

What to do next

Map the data you collect, add a bilingual privacy policy and a separate marketing opt-in, and set up a process for correction and stop requests. If you also sell on Amazon.ae and noon, Blooprint can run your marketplace ads management and Amazon.ae account management. Confirm legal points with the UAE Data Office or a lawyer.