UAE PDPL Compliance Checklist for Small Business Websites 2026

The UAE PDPL enforcement deadline is January 1, 2027, roughly 90 days from today. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to any website that collects, stores, or processes personal data from UAE residents, which means your contact form, cookie scripts, and WhatsApp button are all in scope. This UAE PDPL compliance checklist for small business websites breaks down the five specific things your site must display and do before the fine kicks in, with examples of what non-compliant and compliant versions look like.

What UAE PDPL Actually Requires From Your Website

The law defines personal data broadly: any information that identifies a natural person directly or indirectly. For a typical small business website in Dubai, this includes names and phone numbers from contact forms, email addresses from newsletter signups, IP addresses captured by analytics scripts, and WhatsApp numbers collected when a visitor initiates a chat.

Processing that data without a valid legal basis is the violation. Consent is the legal basis most small businesses rely on, and the law is specific: consent must be informed, specific, freely given, and easy to withdraw. If your site collects data without meeting those four conditions, it is non-compliant.

The UAE PDPL Compliance Checklist for Small Business Websites

1. Privacy Policy Page

UAE PDPL privacy policy requirements for 2026 are more detailed than most small businesses expect. A one-paragraph disclaimer buried in a terms page does not meet the standard. Your policy must cover who collects the data, what categories of data are collected, the purpose of collection, any third parties the data is shared with, how long data is retained, and how a user can request access, correction, or deletion.

Non-compliant: A short paragraph in a terms-of-service page that says the site collects information to improve user experience, with no further detail.

Compliant: A dedicated Privacy Policy page linked from your footer and from every form on the site, covering all six categories in plain language. For a Dubai clinic, this means listing your booking platform as a data processor. For a real estate agency, it means naming the CRM you route leads into.

2. Cookie Banner

UAE PDPL website cookie banner requirements mean you cannot set non-essential cookies before the visitor consents. Tracking pixels, analytics scripts, and advertising tags all count as non-essential. A footer notice that says the site uses cookies does not satisfy the law.

Non-compliant: A banner that says the site uses cookies and disappears on scroll, while Google Analytics and Meta Pixel fire on page load.

Compliant: A banner with two clear options, Accept All and Reject Non-Essential, where no third-party scripts fire until the visitor has made a choice. The visitor can change their preference at any time through a visible cookie settings link in the footer.

3. Contact Form Consent Checkbox

Does UAE PDPL apply to contact forms on a website? Yes, without exception. A name and phone number submitted through a contact form is personal data under Federal Decree-Law No. 45 of 2021, and collecting it requires specific, informed consent.

The consent checkbox on that form must be unticked by default, separate from any terms-of-service agreement, and worded to describe exactly how the data will be used. These are not optional refinements; they are the conditions the law sets for valid consent.

Non-compliant: A pre-ticked checkbox that reads I agree to the terms and conditions. This fails on two counts: a pre-ticked box is not valid consent, and terms acceptance is not the same as consent to data collection.

Compliant: An unticked checkbox with specific wording such as: I consent to [Business Name] storing my contact details and using them to respond to this enquiry. I can withdraw this consent at any time by emailing [email address].

4. WhatsApp Lead Capture Consent

WhatsApp is the primary lead channel for most small businesses in Dubai, and it has the largest compliance gap of any element on this list. When a visitor clicks a WhatsApp button on your site, you capture their number and sometimes their name in WhatsApp Business or your CRM. That is data collection and it requires prior notice before the visitor clicks.

Non-compliant: A floating WhatsApp icon with no surrounding text, no consent notice, and no link to a privacy policy.

Compliant: A short consent note alongside the button, for example: By messaging us on WhatsApp, you agree that [Business Name] may store your contact details to respond to your enquiry. Include a visible text link to your privacy policy next to or below the button before the visitor initiates contact.

5. CRM Data-Retention Setting

The PDPL prohibits keeping personal data beyond the period necessary for the original purpose. Most small business CRMs used in Dubai (HubSpot, Zoho, GoHighLevel) have no deletion schedule configured by default. Leads from two or three years ago sit in active contact records with no plan for removal, and that is a violation in plain sight.

Non-compliant: Thousands of old leads in your CRM with no activity and no scheduled deletion or anonymisation workflow.

Compliant: An automated workflow that flags contacts inactive for 24 months and either deletes them or sends a re-consent email before deletion. The retention period is documented in your privacy policy.

What Dubai-Based Businesses Frequently Miss

Several compliance gaps appear repeatedly when auditing small business websites across the UAE:

• Embedded booking tools: Fresha, Calendly, and similar platforms process personal data on your behalf. Your privacy policy must name them as data processors and link to their own policies.
• Google Reviews widgets: A live reviews embed loads Google scripts on page load. These need to be gated behind your cookie consent layer before they render.
• Instagram feed embeds: Meta scripts load before the visitor has consented to non-essential cookies. The same rule applies as with the Meta Pixel.
• Portal leads: Leads arriving from Bayut, Property Finder, or Dubizzle fall under PDPL once they are stored in your CRM. The source does not exempt you from retention rules.
• Old landing pages: Promotional pages built for past campaigns often have no consent layer and are forgotten after the campaign ends. They are still live and still collecting data.

How to Check Your Own Site Before the Deadline

1. Open your site in a private browser window and watch which network requests fire before you click anything. Analytics and pixel scripts should not appear.
2. Submit your own contact form and note the confirmation message. Does it explain how your data will be used and by whom?
3. Read your privacy policy against the six categories listed above and count the gaps.
4. Click your WhatsApp button and check whether any consent language or privacy link appears nearby before the chat opens.
5. Log into your CRM and filter contacts by date created. Check whether any deletion or archiving automation is configured for inactive records.

Three or more gaps means your site needs retrofitting before January 1, 2027. The UAE PDPL allows the regulator to issue warnings before fines, but there is no guaranteed grace period once enforcement begins. Businesses that wait until after the deadline are accepting a calculable risk for no reason.

Get a Compliant Website Before January 2027

Antox builds and retrofits websites for small businesses across Dubai, including salons, clinics, and real estate agencies. Every project covers the five elements in this checklist: privacy policy structure, cookie consent layer, form wording, WhatsApp opt-in language, and CRM data connection. If you want to see what a compliant version of your current site looks like before committing to a build, request a free website preview and we will walk you through exactly what needs to change.