PDPL and GDPR on One Website: A Privacy Brief for UAE Firms Serving EU Customers
Short Answer
A UAE company whose website targets people in the EU can fall under both Federal Decree-Law 45 of 2021 and the GDPR. Build the site around the stricter rule for consent, notices, retention and data requests.
A Dubai company starts selling to customers in Germany and France, and its website suddenly faces two privacy laws. The UAE's personal data law applies because the company is based here. The EU's General Data Protection Regulation can apply because the site targets people in the EU. Most website briefs handle one regime properly and quietly ignore the other one.
This guide shows where the two laws overlap on a single website and where the stricter rule should win. It covers consent, privacy notices, retention periods and requests from people about their data. It cites Federal Decree-Law 45 of 2021 and the GDPR directly. Treat it as general information, not legal advice, and confirm your position with a specialist lawyer.
When do both PDPL and GDPR apply to one website?
Federal Decree-Law 45 of 2021 covers UAE-resident controllers processing data of people inside or outside the country. GDPR Article 3(2) covers controllers outside the EU that offer goods or services to people in the EU. A UAE store shipping to Paris can meet both tests.
GDPR Recital 23 says mere accessibility from the EU is not enough. Prices in euros, an EU language option or references to EU customers can instead show targeting. Article 2 of the UAE law also excludes free zone companies with their own data protection legislation.
Quick Answer
Both Federal Decree-Law 45 of 2021 and GDPR Article 3(2) can cover one UAE-based website. GDPR applies when the site targets EU customers, not because EU visitors can reach it.
Which consent model works under both laws?
Article 4 of the UAE law prohibits processing without consent, then lists exceptions such as performing a contract. The GDPR instead offers six lawful bases in Article 6, including consent, contract and legitimate interests. The UAE list contains no general legitimate interests exception so far.
So a practical brief uses consent for marketing emails and non-essential tracking, and contract grounds for quotes and orders. Both laws require the controller to prove consent and let people withdraw it easily. Store when consent was given, the wording shown and any later withdrawal.
Quick Answer
Websites serving UAE and EU markets should use consent for marketing and tracking, as UAE law lacks a legitimate interests exception. Use contract grounds for orders and keep consent records.
What should one privacy notice cover?
One notice can serve both laws if it meets the longer GDPR checklist in Article 13. That means identity and contact details, purposes, legal basis, recipients, international transfers, retention periods and individual rights. It must also explain the right to complain to a supervisory authority.
The UAE law's Article 13 requires purposes, recipient sectors and cross-border safeguards to be explained before processing starts. A single bilingual notice in English and Arabic usually works well for both audiences. If GDPR Article 27 requires an EU representative, list their contact details too.
Quick Answer
One privacy notice can satisfy UAE and EU law by following GDPR Article 13's fuller checklist. Add the UAE law's recipient sectors and cross-border safeguards, plus any EU representative's details.
How long should a website keep form and order data?
Keep each type of personal data only as long as its purpose requires. Article 5 of the UAE law says personal data must not be kept after its purpose is exhausted, unless it is anonymised. GDPR Article 5(1)(e) sets out the same storage limitation principle.
GDPR Article 13 also expects the notice to state the period, or the criteria used to set it. Set separate retention periods for enquiries, orders, newsletter lists and server logs. Orders may need longer storage for tax records, so confirm that period with your accountant.
Quick Answer
UAE and EU rules both require deleting data once its purpose ends, unless anonymised. Set separate retention periods for enquiries, orders, newsletters and logs, and publish them in the notice.
How should requests about personal data be handled?
Give people one clear route, such as a form or email address, to exercise their rights. Article 19 of the UAE law requires controllers to provide clear contact methods. GDPR Article 12 sets a one-month response deadline, extendable by two further months for complex cases.
Run every request on the stricter GDPR clock, whichever country the person lives in. Verify identity before releasing data, then log the date received, action taken and reply sent. Your developer should make exporting and deleting a person's records possible without editing the database directly.
Quick Answer
Handle data requests through one clear route and answer within GDPR's one-month deadline, extendable by two months. The UAE law's Article 19 also requires clear contact methods for rights requests.
Main Takeaways
A UAE website targeting EU customers can face Federal Decree-Law 45 of 2021 and the GDPR together. Use consent for marketing and non-essential tracking, because the UAE law has no legitimate interests exception. Write one privacy notice following GDPR Article 13, then add the UAE requirements. Set retention periods per dataset and answer every rights request within GDPR's one-month deadline.
Building one privacy setup for two markets
Running two privacy setups for UAE and EU visitors is rarely worth the complexity. Build one website around the stricter rule for each topic, then document why you chose it. Keep consent records, retention periods and request logs from launch day. Revisit the setup once the PDPL executive regulations are published, since Article 29 then allows six months to comply.
Our guide to answering data residency questionnaires covers where website data is physically stored. The wider UAE laws that apply to business websites are summarised in a separate guide. Auronix Web Studio can build consent logging, retention rules and request tools into a UAE business website development project. Bring your lawyer's requirements, and we will turn them into working features.
Sources & References
FAQs
Questions readers usually ask next
These FAQs are written to match the topic of this post and to help readers move from understanding to action.
Does GDPR apply just because EU visitors can reach my website?
No, GDPR Recital 23 says mere website accessibility from the EU is insufficient. Euro pricing, an EU language option or references to EU customers can show the site targets them.
Have the PDPL executive regulations been issued?
As of 2 October 2026, the official UAE Legislation portal lists no executive regulations alongside the law. Article 29 gives controllers six months to comply once those regulations are issued.
Do we need an EU representative under the GDPR?
Article 27 requires one where Article 3(2) applies, with some limited exceptions. Occasional, low-risk processing that excludes large-scale sensitive data is exempt, so ask your adviser if your processing qualifies.
Does the UAE law apply to DIFC companies?
Article 2 excludes free zone companies that have their own data protection legislation. The DIFC has its own data protection law, so check carefully which regime covers your licence first.
Should a UAE site serving EU visitors use a cookie banner?
EU cookie rules, based on Article 5(3) of the ePrivacy Directive, require consent for non-essential cookies. Strictly necessary storage is exempt, but ask your adviser how the national rules apply.
Can we charge for answering a data access request?
Generally no, because GDPR Article 12 makes most responses free unless requests are manifestly unfounded or excessive. The UAE law's Article 13 also lets people request information without any charge.
Who should write the privacy notice?
A qualified lawyer or privacy adviser should draft it, because legal bases and transfers need judgement. Your developer then builds the consent records, forms and deletion tools the notice describes.
What records prove that someone gave consent?
Keep the date and time, the exact wording shown, the form version and the channel used. Record withdrawals the same way, because both laws require the controller to prove consent.
Does the UAE law restrict sending data to EU-based tools?
Article 22 allows transfers to countries with adequate data protection laws, in cases the UAE Data Office approves. Article 23 lists alternatives for other countries, including contracts and explicit consent.
What should a website brief say about privacy?
List the countries you target, the data each form collects and every third-party tool. That lets your developer and lawyer agree which law sets each technical requirement before building starts.
Related Resources
Need a compliance review for your live site?
We can help you audit privacy, VAT, accessibility, RTL, and security basics before they turn into user or legal risk.
Built for UAE websites that need clearer policies, safer forms, and cleaner conversions.
