The UAE has one federal consent-first regime — PDPL — whose Executive Regulations landed in 2026 with enforcement ramping through January 2027, plus two free-zone regimes of their own (DIFC and ADGM), sector data-residency statutes and a media regulator that reads the creative. In our builds this is an engineering constraint, not a legal opinion — so we state what changes in the funnel, and route interpretation to your counsel or ours.
SurfaceLaw / codeIn forceTriggerWhat changes in your funnel
Federal data lawUAE PDPL — Federal Decree-Law 45 of 2021In force Jan 2022 · regs 2026Processing personal data of people in the UAEExplicit opt-in is the default for marketing; there is no soft opt-in and no legitimate-interests catch-all. Documented lawful bases, purpose limitation, records of processing — and administrative fines (published schedules run AED 50K–5M) set by Cabinet decision.
The 2026 activationPDPL Executive RegulationsPublished 2026 · 90-day windowsAll UAE controllers and processorsThe regulations start the clocks: breach-notification timelines, DSR response SLAs, DPO appointment criteria and tightened cross-border transfer rules. The stack has to absorb them as configuration, not as a rebuild.
Enforcement horizonUAE Data Office (UAEDO)Ramping into Jan 2027Every UAE-facing funnel after the grace windowComplaint-driven then audit-driven enforcement. The proof-of-consent record — timestamp, wording version, source — is the artefact the regulator asks for first, so we build it as a table, not a folder.
DIFCDIFC Data Protection Law No. 5 of 20202020, as amendedProcessing in the DIFC or by DIFC entitiesA GDPR-style regime with its own Commissioner: data-subject fees restricted, export controls, and direct marketing rules of its own. If your buyer works in the free zone, this is the layer that reaches them.
ADGMADGM Data Protection Regulations 20212021, as amendedProcessing in ADGM or by ADGM entitiesThe second free-zone regime, similarly GDPR-shaped, with its own regulator and penalties. One UAE funnel can sit under PDPL, DIFC and ADGM at once — the consent layer is built to route, not to pick one.
Marketing consentPDPL + telecom marketing rulesongoingAny marketing email, SMS, WhatsApp or pushOpt-in must be unbundled and provable; pre-ticked boxes don't count; marketing mixed into transactional messages re-classifies the whole send. WhatsApp journeys run on documented opt-in with per-message opt-out honoured.
Health dataICT in Health Fields Law (Federal Law 2 of 2019)2019 · Cabinet exceptionsHealth data in clinic, pharma and wellness funnelsHealth data default-resides in the UAE. A telehealth funnel that syncs an offshore CRM without checking the residency rule is the most common finding in healthcare audits.
Financial promotionsCentral Bank · SCA · VARA · DFSA/FSRAongoing · VARA marketing regs 2024+Any regulated financial or virtual-asset promotionApproval and disclosure standards per regulator — VARA's marketing rules for virtual assets are specific and enforced. Claims gated before creative ships; some breakfasts with compliance save the quarter.
Real estate adsDLD/RERA Madhmoun permits · Abu Dhabi DARIongoingEvery property listing advertisedEvery advertised unit carries a permit, a QR and a licensed broker of record. Media plans in this vertical are built around permit inventory, or the account gets flagged mid-flight.
Media & influencerMedia Council — Federal Decree-Law 55 of 20232023 · licensing activePaid creator content and published mediaInfluencer and advertiser licensing, paid-content disclosure, and content standards (culture, religion, decency) sit on top of platform policy. The creative review step is in the media plan, not beside it.
Consumer & pricingConsumer Protection Law 15 of 2020 · VAT 5%2020 ongoingAny consumer offerMisleading promotion, price-display and total-cost rules: the advertised price is the VAT-inclusive price, or the funnel is a liability. Discounts need a defensible 'was' price.
