UAE Website Compliance: The Laws That Apply to Business Websites
Short Answer
A UAE business website usually needs to follow the Personal Data Protection Law for forms and tracking, the ecommerce law if it sells online, FTA tax invoice rules if VAT registered, and sensible security and accessibility standards.
Most UAE business owners think of compliance as a trade licence and a VAT registration. Then a client asks for the website's privacy notice, or a payment gateway rejects the store for missing refund terms. The website has its own obligations, and they depend on what the site actually does. Collecting enquiries, selling products and issuing invoices each bring different rules.
This guide maps the main UAE laws that apply to business websites, and what each means in practice. It covers personal data, online selling, VAT invoices, security and accessibility. Each rule is linked to its official government source below. This is general information, not legal advice, so ask a qualified adviser about your specific business, sector and free zone.
Which law governs personal data collected by a UAE website?
Federal Decree-Law 45 of 2021 on the Protection of Personal Data applies to most UAE websites collecting contact details. It came into force on 2 January 2022. The UAE Government portal says it generally requires consent before processing personal data, with specific exceptions.
In practice, publish a clear, plain privacy notice explaining what you collect, why, who receives it and how long you keep it. Collect only what each form needs. Some free zones, such as the DIFC, have their own data protection laws, so check which regime applies first.
Quick Answer
Federal Decree-Law 45 of 2021 governs personal data on most UAE websites and generally requires consent. Publish a clear privacy notice and collect only what each website form genuinely needs.
What must a UAE website disclose if it sells online?
Federal Decree-Law 14 of 2023 on Trading by Modern Technological Means applies to online selling in the UAE. Article 6 expects online merchants to make their licence, address, contact numbers and website publicly available. It also expects a complaints channel with a tracking mechanism.
Article 5 requires published prices, delivery fees, payment fees and terms of sale before purchase. Articles 14 and 15 prohibit charging delivery or payment fees beyond those announced. Article 7 sets out when consumers can return goods, such as items that arrive damaged, defective or misdescribed.
Quick Answer
UAE online sellers must publish their licence, address, contact details, prices, fees and terms under Federal Decree-Law 14 of 2023. Unannounced delivery or payment fees added at checkout are prohibited.
What do VAT rules mean for invoices issued through a website?
If you are VAT registered and issue invoices online, they must meet the UAE Federal Tax Authority's tax invoice requirements. A full tax invoice includes your tax registration number, a sequential number, dates, descriptions and the VAT amount. The standard VAT rate is 5%.
The Federal Tax Authority's guide allows simplified tax invoices when the customer is not VAT registered, or the supply is AED 10,000 or less. Invoices issued in another currency must show the VAT amount in AED and the exchange rate. Build them into templates before launch.
Quick Answer
VAT-registered UAE businesses issuing online invoices must follow Federal Tax Authority rules, including the tax registration number and VAT amount. Foreign-currency invoices must also show the VAT amount in AED.
What security standard should a UAE business website meet?
UAE law expects reasonable protection for the data a website handles. Federal Decree-Law 14 of 2023 requires online merchants to provide a technically secure environment. The personal data law also expects controllers to protect personal data against loss or unauthorised access.
Practical basics include HTTPS on every page, updated software and plugins, strong administrator passwords with two-factor login and regular tested backups. Limit who can read form submissions, and remove former staff accounts promptly. Keep a simple log of updates and incidents, because it shows care if anything goes wrong.
Quick Answer
UAE business websites should use HTTPS, updated software, two-factor administrator logins and regularly tested backups. Federal Decree-Law 14 of 2023 requires online merchants to provide a technically secure trading environment.
Does a UAE business website need to be accessible?
The Telecommunications and Digital Government Regulatory Authority says its own platforms follow WCAG 2.2 at level AA. That is a useful benchmark for private business websites, even where no specific rule names them directly. Accessible sites also work better for older visitors.
Start with readable colour contrast, text alternatives for meaningful images, keyboard-friendly navigation and properly labelled form fields. If you publish Arabic content, test right-to-left layouts carefully with real Arabic text rather than placeholders. An accessibility statement explaining your standard and a contact route shows good faith to visitors.
Quick Answer
TDRA states its own platforms follow WCAG 2.2 level AA, a sensible benchmark for UAE business websites. Prioritise colour contrast, image text alternatives, keyboard navigation and clearly labelled form fields.
Main Takeaways
Federal Decree-Law 45 of 2021 governs personal data on most UAE websites, so publish a clear privacy notice and minimise form data. Online sellers must also meet disclosure and fee rules under Federal Decree-Law 14 of 2023. VAT-registered businesses must issue invoices that follow Federal Tax Authority requirements. Use HTTPS, tested backups and WCAG 2.2 AA as your practical benchmark.
Reviewing your website's compliance
Start by listing everything your website actually does: forms, tracking, payments, invoices, logins and newsletters. Match each activity to the rules above, and note which pages, notices or settings are missing today. Fix data collection and security gaps first, because they usually carry the most risk. Then update policies, consent settings and invoice templates to match what the site does.
Our website maintenance team handles updates, backups and security fixes for UAE business and ecommerce websites. We also document what we changed, so your adviser can review it quickly. For new builds, our website development service plans consent, invoices and accessibility from the start. Send us your website address, and we will list the technical gaps we find in writing.
Sources & References
FAQs
Questions readers usually ask next
These FAQs are written to match the topic of this post and to help readers move from understanding to action.
Does every UAE website need a privacy policy?
Any website collecting personal data, even through a contact form, should publish a privacy notice. Federal Decree-Law 45 of 2021 expects individuals to understand how their data is actually used.
Do UAE websites need a cookie banner?
The personal data law generally requires consent before processing, with exceptions. Non-essential tracking such as advertising cookies is usually safest behind consent, but confirm your approach with a qualified adviser.
Must a UAE website be hosted inside the UAE?
Not generally, but international cross-border transfers of personal data have conditions, and health data has stricter rules. Check your sector rules and client contracts before choosing any hosting location abroad.
What happens if a website breaks UAE data protection rules?
The UAE Data Office oversees the personal data law and handles complaints. Consequences depend on the breach, so fix gaps early and clearly document what data you collect and why.
Do free zone companies follow the federal data protection law?
Some free zones have their own regimes, such as the DIFC's Data Protection Law. Other companies generally follow the federal law, so confirm which applies with your free zone authority.
What must an ecommerce website publish under UAE law?
Publish your trade licence, physical address, contact numbers, prices, delivery and payment fees, terms and returns information. Federal Decree-Law 14 of 2023 also expects a trackable complaints channel for consumers.
Can a UAE website send marketing emails to enquirers?
Only where you have a lawful basis, usually clear consent. The ecommerce law also gives consumers the right to choose whether to receive marketing by phone, email or social media.
How often should a website compliance review happen?
Review the website at least yearly, and whenever you add new forms, tracking tools, payment methods or markets. Laws and guidance change, so check the official sources during each review.
Does an Arabic version of the website affect compliance?
It does not remove any obligation, but policies should say exactly the same thing in both languages. Inconsistent translations confuse customers and complicate any later complaint, refund or legal dispute.
Can Auronix make my website compliant?
We implement the technical side, such as secure forms, consent tools, invoice fields and accessibility fixes. Your legal adviser should review all policies and confirm obligations specific to your business.
Related Resources
Need a compliance review for your live site?
We can help you audit privacy, VAT, accessibility, RTL, and security basics before they turn into user or legal risk.
Built for UAE websites that need clearer policies, safer forms, and cleaner conversions.
