Start with what you collect
Contact forms, newsletter sign-ups, analytics, booking tools and payment pages all collect personal data. List what you collect, why, where it is stored and who can access it.
- Contact and quote forms
- Newsletter and marketing sign-ups
- Analytics and advertising cookies
- Accounts, bookings and payments
- Third-party tools such as chat and maps
The law behind it
The UAE’s federal personal data protection law (Federal Decree-Law No. 45 of 2021) sets rules on lawful processing, consent, security and the rights of the people whose data you hold, and free zones such as DIFC and ADGM run their own regimes. Check the current status of the implementing regulations and take advice for your sector.
Practical steps
Publish a clear privacy notice in the languages your visitors use, ask for consent where it is required, use HTTPS everywhere, limit who can see the data, and keep a process for access and deletion requests.
Use processors carefully
If a hosting, email or analytics provider handles data for you, record who they are and where the data is stored, and agree written terms with each of them. This page is general information, not legal advice.