Regional8 November 20266 min read

PDPL and marketing in the UAE: what to do about consent

The federal data law still lacked regulations at the latest report, but SMS and call consent rules already apply. Which regime covers you, and what to do.

The short answer

Get explicit, recorded consent for every marketing message, whatever happens to the PDPL. Federal Decree-Law No. 45 of 2021 exists, but its implementing regulations had still not been issued at the latest source, June 2026, while TDRA already requires prior explicit consent for marketing texts. DIFC and ADGM have their own laws. This isn't legal advice.

The most useful fact about UAE data law for a marketer is a gap. Morgan Lewis reported on 15 June 2026 that the implementing regulations for Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, had still not been issued. That sounds like a reason to wait. It isn't, because the consent rules that bite on marketing today sit in other instruments, and none of them is waiting for the PDPL's regulations.

This page is dated 7 November 2026 and isn't legal advice. The status of the regulations can change, so recheck it before you rely on it.

Where does the PDPL stand?

The UAE government portal names Federal Decree Law No. 45 of 2021 as the federal personal data law and says the UAE Data Office will act as the federal data regulator. Morgan Lewis says that office never became fully operational in practice, and that no supervisory authority is clearly designated for the private sector. It also reports a new Federal Authority for Artificial Intelligence and Data, announced on 14 June 2026.

So the law exists, and how it will be supervised and what a breach will cost aren't settled in any source we could confirm. We don't quote PDPL fines or a breach-notification deadline because neither could be verified, and a guide that gives them should be read with caution. The PDPL glossary entry has the short definition.

Which regime covers your business: PDPL, DIFC or ADGM?

Three data regimes in the UAE, as of 7 November 2026
Regime	Where it applies	What the sources confirm	Status
PDPL, Federal Decree-Law No. 45 of 2021	Federal law. DLA Piper says it leaves the separate DIFC and ADGM laws in place	Named on the government portal as the federal personal data law	Implementing regulations not issued at the latest source, June 2026
DIFC Data Protection Law, DIFC Law No. 5 of 2020	Inside the DIFC, not the mainland	Enacted on 21 May 2020 and amended by DIFC Laws Amendment Law No. 1 of 2025. BSA Law reports that the amendments add an explicit private right of action for data subjects	Listed in the DIFC legal database, including the 2025 amendment
ADGM Data Protection Regulations 2021	Inside ADGM, not the mainland	The Commissioner of Data Protection can impose administrative fines of up to USD 28 million. That's a maximum, not a typical fine	CMS gives the effective date as 11 February 2021

Which regime governs a particular activity is a legal question, and we won't guess. The practical point is smaller: if your company is licensed in DIFC or ADGM, read that regime's rules and not only the federal law. The free zone your licence sits in decides which of these you start from.

Which consent rules already apply to marketing?

Channel by channel, this is what the sources confirm. None of it is the PDPL, and all of it is in force now.

Marketing consent rules by channel, as of 7 November 2026
Channel	What is confirmed	Source
SMS	Prior explicit consent, a free unsubscribe option, and sending only between 7 am and 9 pm UAE time. Providers apply penalties to violators; no fine amount is given	TDRA, FAQs
Phone calls	Marketing calls restricted to 9 am to 6 pm under Cabinet Resolutions No. 56 and No. 57 of 2024, effective from 27 August 2024. Clyde & Co also reports a Do Not Call Register and limits on repeat calls	Clyde & Co, 18 July 2024
Email	No UAE email consent rule is in the sources checked. Mailbox providers set their own: Google requires senders of more than 5,000 messages a day to Gmail accounts to use SPF, DKIM and DMARC, keep spam rates below 0.30% and support one-click unsubscribe on marketing mail. Yahoo asks bulk senders to keep spam rates below 0.3% and to honour unsubscribes within two days	Google Workspace Admin Help; Yahoo Sender Hub
WhatsApp	No UAE rule specific to WhatsApp marketing is in the sources checked. Meta has charged per delivered message since 1 July 2025, so an unwanted marketing message costs money as well as goodwill	Meta for Developers
Website tracking	Google updated consent mode in November 2023. Its EU user consent policy names the EEA, the UK and Switzerland, not the UAE, but a UAE site with visitors from those places still has to consider it	Google Tag Platform documentation

A consent record that satisfies TDRA today is also the record a data regulator is likely to ask for first. The channel guides go deeper: SMS marketing rules, email deliverability and bulk WhatsApp marketing. Google's consent mode is defined separately.

What should you do this month?

01Map where personal data comes in. List every form, lead ad, WhatsApp number, call tracker, event sign-up sheet and chat widget in a spreadsheet, with columns for what's collected, why, the wording shown, where it's stored and who can see it. It takes an afternoon and it's the first document a lawyer will ask for.
02Separate marketing consent from everything else. Use an unticked box or a keyword reply that says what you'll send, by which channel and how often. A line buried in the terms and conditions is hard to defend as explicit.
03Record every consent: the number or email, the date and time, the exact wording and where it was given. If you can't produce the record for a contact, don't message them. For a list you already hold with no records, ask for consent at the next natural contact, such as a booking or a purchase, and don't send a mass 'please opt in' message to numbers you have no record for.
04Run one suppression list. An opt-out in one tool has to reach every other tool, or the person gets the next message from the one that didn't hear. Honour it the same day. Yahoo's two days is a ceiling for Yahoo addresses, not a target.
05Write the privacy notice in Arabic and English and link it from every form. Have a native writer do the Arabic, and keep the wording plain enough that a customer would recognise their own agreement in it.
06Don't buy, scrape or rent lists. A contact with no consent record is a liability on the first send, and the first send is how you'd find out.
07Ask each agency and tool you use where your leads are stored, who can see them and what happens to them when you leave. Ad accounts, pages and files should stay in your name.
08Put a status date on the document and set a quarterly reminder to check whether the regulations have been issued and which authority supervises the private sector.

What can't anyone tell you yet?

PDPL penalty amounts, and the deadline for notifying a breach.
Which authority supervises the private sector, and when the regulations will arrive.
A UAE rule specific to WhatsApp or email marketing consent, beyond what the platforms require.
How a free zone company should treat customers who live on the mainland.

Write 'unknown' beside each one in your data map instead of a guess, and revisit it when the regulations land. The steps above won't need redoing. If your lifecycle messages run across SMS, email and WhatsApp, our email and lifecycle team can review the consent trail, and advertising law in the UAE shows where data rules sit among the others.

Questions people ask

01Does the UAE have a data protection law?

Yes. The government portal names Federal Decree Law No. 45 of 2021 as the federal personal data law. As of Morgan Lewis's report on 15 June 2026, its implementing regulations had still not been issued, and DIFC and ADGM have their own separate regimes. This isn't legal advice, so confirm the current status.

02Do I need consent to send marketing messages in the UAE?

For text messages, yes. TDRA says marketing messages may not be sent without prior explicit consent, should carry a free unsubscribe option, and may go out only between 7 am and 9 pm UAE time. Marketing calls have a separate 9 am to 6 pm window. Keep a record of every consent.

03Does the PDPL apply to free zone companies?

DLA Piper says the PDPL leaves the separate DIFC and ADGM laws in place, so a company licensed in either should start with that regime's rules. Which law governs a given activity is a legal question: ask your free zone authority or a UAE lawyer. This isn't legal advice.

04What is the penalty for breaching the PDPL?

No PDPL penalty amount could be verified, and the implementing regulations had still not been issued at the latest source, June 2026. Inside ADGM, the Commissioner of Data Protection can impose fines of up to USD 28 million, which is a maximum. Ask a UAE lawyer for the current position.

05Can I email a purchased list in the UAE?

No UAE email consent rule appeared in the sources checked, but Gmail and Yahoo expect bulk senders to authenticate, keep spam rates low and honour unsubscribes. A purchased list has no consent record, so it carries the most risk. Collect explicit consent yourself and keep the record.