UAE PDPL Website Checklist: Forms, Cookies, CRM and Analytics

UAE PDPL website compliance starts with the places your site collects personal data: enquiry forms, cookies and tags, the CRM those leads flow into, and the analytics tools watching every visit. Federal Decree-Law No. 45 of 2021 sets the general rules on consent, transparency, security and individual rights, and this checklist puts the fixes in a practical order so you can close the most visible gaps first. It is a technical and operational guide, not legal advice; confirm how the law applies to your organisation with qualified counsel.

What the UAE data protection law covers, in brief

The UAE data protection law, published as Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, applies to processing of personal data of people in the UAE and to controllers and processors established in the country, with some exceptions. Published summaries highlight these points that matter most for websites:

• Processing needs a lawful basis, and consent is one of them. Where consent is relied on, it must be specific, clear and unambiguous, and the person must be able to withdraw it.
• Controllers must tell people what is collected, why and who receives it.
• Individuals have rights, including access, correction and erasure in defined cases, and the ability to object to certain processing.
• Controllers must apply appropriate security measures and report certain breaches to the UAE Data Office.
• Some organisations must appoint a data protection officer, for example where processing is large scale or high risk.
• Transfers of personal data outside the UAE are subject to conditions.

Where the federal law may not apply

Businesses in the DIFC and ADGM are covered by those financial centres' own data protection regimes. Summaries of the law also note exclusions for certain government data and for some health and banking data that is governed by its own legislation. If you operate in one of these areas, the checklist below is still useful, but the legal reference points change. The guide to DIFC data protection website fixes covers that regime separately.

Check the implementation status

Some operational details, such as breach reporting timelines, were left to executive regulations. Check the current status of those regulations and any compliance dates on the UAE Legislation portal or with the UAE Data Office before setting internal deadlines.

Fix first: the priority order for UAE PDPL website compliance

Not every gap carries the same risk. Start with the issues that are visible to visitors and regulators, then work inwards to systems and processes.

1. Privacy policy UAE checklist

A privacy policy for a UAE website should describe what you actually do, not what a template assumes. Review it against your real data flows.

• Name the controller, with a contact method for privacy questions and, where appointed, the data protection officer
• List the categories of data collected through each channel: forms, chat, WhatsApp links, cookies and account areas
• State the purpose and lawful basis for each type of processing
• Name the categories of recipients, such as CRM, email, hosting and analytics providers
• Explain whether data is transferred outside the UAE and on what basis
• Describe retention periods or the criteria used to set them
• Explain how people can exercise their rights and withdraw consent
• Publish the policy in Arabic and English if your site serves both audiences
• Date the policy and keep previous versions on file

2. Forms: collect less, record more

Forms are where most website personal data begins, and they are often built by different people over several years. Audit each one.

Minimise fields

Ask only for what the stated purpose needs. A brochure request rarely needs a job title, date of birth or nationality. Removing fields also tends to make forms easier to complete.

Separate consent from submission

• Use an unticked checkbox for marketing consent, separate from the button that sends the enquiry
• Write the consent wording in plain language, naming the type of messages and channels
• Link to the privacy policy next to the form
• Do not make marketing consent a condition of getting a reply to an enquiry

Keep proof of consent

Record what the person agreed to, the wording shown, the date and time, and the form it came from. Pass this record to the CRM with the lead so it is not lost when data moves between systems.

Secure the transport and storage

Serve every form over HTTPS, protect it against spam and abuse, and avoid sending full form contents by plain email to shared inboxes. Check that form plugins and builders are not storing copies of submissions in the website database without anyone knowing.

3. Cookie consent UAE: tags, pixels and scripts

The federal law does not set out a separate cookie rule in the way some European regimes do. Where cookies and tracking scripts collect personal data, the general rules on lawful basis, transparency and consent are the reference point. Organisations that also serve European visitors may already run a consent banner, and a well configured banner is a practical way to meet the transparency and consent expectations of the federal law too. Confirm your approach with counsel.

Cookie checklist

• Scan the site and list every cookie, tag, pixel and embedded third party script
• Classify each as strictly necessary, preferences, analytics or advertising
• Block non essential tags until the visitor makes a choice, and test that blocking really works
• Give an equally easy way to accept or reject, and a way to change the choice later
• Store the visitor's choice and pass it to your tag manager so tags respect it
• Remove tags from old campaigns, abandoned tools and previous agencies
• Review embedded maps, video and chat widgets, which often set cookies of their own

Hypothetical example: a Dubai retailer runs a banner, but its advertising pixel is hard coded in the page template rather than loaded through the tag manager. The pixel fires before any choice is made, so the banner gives a false impression of control. Moving the pixel into the tag manager and linking it to the consent state fixes the gap.

4. CRM data retention and access

CRM data retention is where websites create long term exposure. Leads from forms, chat and campaigns accumulate in the CRM, often with no end date.

Map the flows

Draw how data moves from each form, store or chat tool into the CRM, email platform and any data warehouse. Every arrow is a place where consent records, retention rules or access controls can be lost.

Set retention rules you can enforce

• Define how long unconverted leads, customers and unsubscribed contacts are kept
• Automate deletion or anonymisation where the CRM supports it
• Apply the same rules to exports, spreadsheets and backups

Control access

• Give staff the minimum access their role needs
• Enable multi factor authentication for all CRM users
• Review user lists when people leave or change roles
• Keep consent fields synchronised so an unsubscribe in one tool is honoured in all of them

If your CRM runs on Microsoft Dynamics 365 or a similar platform, these controls are usually configuration work rather than new development.

5. Analytics without collecting more than you need

Analytics tools are often installed once and never reviewed. A short configuration pass reduces personal data without losing the reports that matter.

• Load analytics according to the visitor's consent choice where your approach requires it
• Check that URLs, page titles and events do not capture email addresses, phone numbers or names from form fields or query strings
• Set the shortest data retention period in the analytics tool that still meets reporting needs
• Review user access to analytics accounts and remove former staff and agencies
• Document which analytics providers process data outside the UAE

Hosting location also matters for transfers. The guide to UAE region cloud hosting and data residency explains the trade offs.

6. Rights requests and breach readiness

Handling individual requests

• Publish a clear contact route for privacy requests
• Agree who verifies identity, who searches each system and who replies
• Keep a log of requests, actions and response dates
• Test the process once with an internal request to find the systems you forgot

Preparing for a breach

The law requires controllers to notify the UAE Data Office of breaches that affect privacy or confidentiality, and in some cases to inform affected individuals. Timelines and procedures depend on the executive regulations, so confirm them. Practically, prepare now: an incident contact list, a decision process for assessing severity, logging on website and CRM systems, and contracts that require your suppliers to tell you promptly about incidents on their side.

If you are planning AI features such as chatbots or lead scoring, the same principles apply to the data those tools process. See enterprise AI integration and compliance boundaries.

Getting the fixes built and maintained

Most items on this list are a mix of policy decisions and technical changes. The policy decisions belong to your legal and compliance owners. The technical work, such as rebuilding forms, configuring consent in the tag manager, tightening CRM settings and tidying analytics, is where Codeeo can help. Its teams work on website design and development, WordPress development, Microsoft Dynamics 365 and CRM and digital marketing, with an office in Dubai where you can meet the team. A website audit is a sensible first step to list the forms, tags and integrations on your current site, and it pairs well with an audit before a website rebuild. To discuss your site, contact Codeeo.