UAE and Saudi data protection: a working summary for marketers
What the UAE's PDPL, the free-zone regimes in DIFC and ADGM, and Saudi Arabia's PDPL mean for consent, CRM, analytics and adtech: a plain-English starting point for marketing teams.
- Both the UAE and Saudi Arabia now have comprehensive personal-data laws, and free zones such as DIFC and ADGM have their own regimes.
- For marketers the practical themes are familiar: a lawful basis (usually consent) for marketing, transparency, opt-outs, vendor contracts and care with cross-border transfers.
- This is a starting point, not legal advice. Involve your legal team, as rules and implementing regulations continue to evolve.
For years, data protection was something Gulf marketers mostly associated with European campaigns. That has changed. Both the UAE and Saudi Arabia now have comprehensive personal-data laws, and regulators, partners and customers increasingly expect marketing teams to know the basics. This is a working summary to help you ask the right questions. It is not legal advice.
The map
| Jurisdiction | Main law | Who oversees it |
|---|---|---|
| UAE (onshore) | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) | The UAE Data Office |
| Dubai International Financial Centre | DIFC Data Protection Law No. 5 of 2020 | DIFC Commissioner of Data Protection |
| Abu Dhabi Global Market | ADGM Data Protection Regulations 2021 | ADGM Office of Data Protection |
| Saudi Arabia | Personal Data Protection Law (PDPL), in force since September 2023 with enforcement from September 2024, plus its implementing and transfer regulations | Saudi Data & AI Authority (SDAIA) |
Sector rules (for example in banking, health and telecoms) can add further requirements. If your company sits in a free zone, check which regime applies to which processing.
What it means for marketing, in practice
Consent and lawful basis
Direct marketing (emails, SMS, WhatsApp and push messages promoting your products) generally needs a clear legal basis, and in practice that usually means consent. Make consent specific, keep a record of when and how it was given, and make opting out as easy as opting in.
Transparency
Your privacy notice should explain, in plain language and in the languages your users use, what you collect, why, who you share it with, and how people can exercise their rights. Arabic versions matter.
Analytics, SDKs and adtech
- Know every SDK and tag in your app and website, and what data each one sends where.
- Make sure contracts (data processing agreements) are in place with vendors who handle personal data for you.
- Respect platform-level choices such as Apple's App Tracking Transparency. They sit alongside, not instead of, local law.
Cross-border transfers
Much marketing technology is hosted outside the Gulf. Both UAE and Saudi laws contain rules on transferring personal data abroad. Check where your CRM, CDP, analytics and ad platforms store and process data, and what safeguards apply.
Data subject rights
People can ask what you hold about them, ask for corrections, and in many cases ask for deletion or object to marketing. Someone needs to own these requests, and your tools need to be able to fulfil them across systems.
A ten-question self-check for marketing teams
- Do we know which data-protection regime(s) apply to us, onshore and free zone?
- Do we have a current list of all personal data we collect for marketing, and where it goes?
- Is marketing consent captured separately, recorded and easy to withdraw?
- Is our privacy notice clear, current and available in Arabic and English?
- Do all marketing vendors have data processing agreements?
- Do we know where our martech stores data, and what the transfer basis is?
- Can we honour an access or deletion request across CRM, analytics and ad platforms?
- Do we minimise what we collect in forms and events?
- Do we have retention periods for marketing data, and do we enforce them?
- Has legal reviewed our marketing data flows in the last twelve months?
This article summarises publicly available information to help marketers frame questions. It is not legal advice and may not reflect the latest implementing regulations or regulator guidance. Always confirm with qualified counsel.