The UAE Personal Data Protection Law (PDPL) and implementing regulations put real obligations on anyone processing personal data about individuals in the UAE — not only banks. If your startup runs a mobile app, SaaS dashboard, or performance marketing funnel, you are likely a data controller even when servers sit in AWS Ireland. This guide translates PDPL into product and growth decisions founders actually control.

What counts as personal data

Anything identifying a person: name, email, phone, device IDs, IP addresses used to profile, location trails, Emirates ID copies, payroll files, and AI embeddings that can single someone out.

Pseudonymised data can still be personal if re-identification is easy.

30-day practical audit (no law firm required)

  1. List systems — product DB, analytics, email, CRM, support, HR folder, Slack exports.
  2. Mark data categories — customers, employees, leads, device telemetry.
  3. Note where data leaves the UAE — US SaaS defaults count as transfers.
  4. Find orphan spreadsheets — “launch_list_final_v3.xlsx” is still personal data.
  5. Assign an owner — one founder or ops lead accountable for deletion requests.

If you ship AI features, add training data provenance to the same spreadsheet — see our enterprise AI ranking for vendor posture, not legal advice.

Controller vs processor

  • Controller decides why and how data is processed (usually your company).
  • Processor processes on your instructions (cloud host, email tool, analytics SDK).

You need Article 28-style agreements (processing terms) with processors — AWS, Google Analytics, HubSpot, Intercom, Mixpanel, etc. Vendor DPAs are not optional paperwork for enterprise sales; they are baseline compliance.

Lawful bases (pick one per use case)

You cannot rely on “we need the data for the product” for everything. Common bases:

| Use case | Typical basis |
|----------|----------------|
| Account login & billing | Contract performance |
| Optional marketing email | Consent (clear opt-in) |
| Fraud prevention | Legitimate interest (document balancing test) |
| HR payroll | Legal obligation + contract |

Consent must be granular for marketing — pre-ticked boxes fail. Keep timestamped consent logs.

Privacy notice (what users must see)

Your app store listing and website need a in plain English (Arabic for some sectors) covering: