--- title: "UAE digital compliance" publisher: "Data Nexus Technologies Services FZ-LLC" canonical: https://www.datanexus.ae/uae-compliance licence: "Quote freely with attribution to Data Nexus and a link to the canonical URL." --- # UAE digital compliance Named instruments, named penalties, and the obligations whose machinery does not exist. Sources checked 2026-08-04; where an instrument could not be found on a government portal, that absence is stated rather than filled in. ## Advertising and influencers Where the named amounts actually are. A permit regime came into force in February 2026 and it reaches the brand, not only the creator. ### Anyone publishing advertising content online from within the UAE holds an Advertiser Permit from the UAE Media Council. **Instrument.** Federal Media Law No. 55 of 2023 and Cabinet Resolution No. 42 of 2025, in force from 1 February 2026 **Penalty.** Operating without a licence: AED 10,000 for a first offence, AED 40,000 for a repeat - The obligation reaches further than most brands assume. It applies to citizens, residents and visitors alike, to websites and blogs as well as social platforms, and — the part that catches people — to unpaid promotion as well as paid. - A personal account promoting its owner's own products or services is exempt. That exemption is exactly where the commercial risk sits: the moment a company pays or gifts a creator to promote it, the creator is advertising something that is not their own, and the arrangement is inside the regime. - The practical consequence for a business buying influencer placements is that the permit status of every creator on the campaign is now a procurement question, verified before the contract rather than after the post. Source: [Gulf News, 1 February 2026](https://gulfnews.com/uae/new-uae-law-advertiser-permit-now-mandatory-for-influencers-and-creators-for-social-media-1.500427938) ### Advertising content complies with the content rules attached to the permit regime. **Instrument.** Federal Media Law No. 55 of 2023 and Cabinet Resolution No. 42 of 2025 **Penalty.** Content breaches: AED 5,000 to AED 1,000,000. Breaches affecting state interests or national security: AED 50,000 to AED 500,000 - The upper bound is the reason this belongs on a checklist rather than in a policy document. A single campaign can carry an exposure two orders of magnitude above its media budget. Source: [Gulf News, 1 February 2026](https://gulfnews.com/uae/new-uae-law-advertiser-permit-now-mandatory-for-influencers-and-creators-for-social-media-1.500427938) ### Advertising does not carry false or misleading information. **Instrument.** Federal Media Law No. 55 of 2023 and Cabinet Resolution No. 42 of 2025 **Penalty.** AED 5,000 to AED 10,000 - A modest figure next to the others, and worth reading alongside them rather than alone: the same campaign that carries a misleading claim usually also carries the permit question, and the two are assessed together. Source: [Gulf News, 1 February 2026](https://gulfnews.com/uae/new-uae-law-advertiser-permit-now-mandatory-for-influencers-and-creators-for-social-media-1.500427938) ### The permit is current and used by the party it was issued to. **Instrument.** Federal Media Law No. 55 of 2023 and Cabinet Resolution No. 42 of 2025 **Penalty.** Expired licence: AED 150 per day, capped at AED 3,000. Misuse of a licence: AED 20,000 - The daily accrual is the mechanism worth understanding: an expiry nobody noticed is not a single event but a running total, and it stops only when it is renewed or the cap is reached. Source: [Gulf News, 1 February 2026](https://gulfnews.com/uae/new-uae-law-advertiser-permit-now-mandatory-for-influencers-and-creators-for-social-media-1.500427938) ## Newsletters and SMS Consent has to be provable, which is why a purchased list is a violation by construction rather than by accident. ### Marketing messages are sent only to recipients whose consent was obtained, clearly and verifiably, before the first message. **Instrument.** TDRA Regulatory Policy on Unsolicited Electronic Communications **Penalty.** Up to AED 400,000 per violation - Consent has to be demonstrable after the fact, which means a record of when it was given, by whom, and to what. A tick box with no log is the same as no consent when it is examined. - This is the clause that makes a purchased database indefensible rather than merely risky. Nobody on that list consented to hear from you, so every message is a violation at the moment it is sent — there is no volume at which it becomes compliant, and no wording that repairs it. - The same reasoning applies to a list acquired with a business, scraped from a directory, or exported from a previous employer. The question is never where the numbers came from; it is whether the person on the other end agreed, to you, before you wrote. Source: [TDRA, Regulatory Policy on Unsolicited Electronic Communications](https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/Unsolicited-Elrctronic-Commuincations--pdf.ashx) ### Marketing SMS carries the required sender prefix and a working opt-out, and is sent inside the permitted hours. **Instrument.** TDRA marketing SMS rules **Penalty.** Enforced under the same policy; up to AED 400,000 per violation - Promotional traffic is identified as such — the `AD-` prefix — and carries the published opt-out code. Classifying a promotional message as transactional to avoid the prefix is itself the violation, and it is visible to the operator carrying it. - Opt-outs are processed promptly rather than at the next campaign. A person who unsubscribed and received another message is the standard origin of a complaint. Source: [TDRA, marketing short message service](https://tdra.gov.ae/en/initiatives/marketing-short-message-service) ## Personal data In force since 2022, with the penalty schedule still unpublished — an obligation without a number attached, which is not the same as no obligation. ### Personal data is processed on a lawful basis, with the data subject rights the law grants, and cross-border transfers meet its conditions. **Instrument.** Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force 2 January 2022 **Penalty.** No penalty schedule has been published. The executive regulations that would set the amounts remain outstanding. - This is the finding rather than a gap in the research. The law has been in force since January 2022, and the executive regulations that were to specify administrative penalties had still not been issued as of reporting in early 2025. Any source quoting a specific PDPL fine is quoting something that has not been published. - An obligation without a published number is not an absence of obligation. It is an exposure whose size is not yet known, which is a worse planning position rather than a better one — and it can be set retrospectively in the sense that conduct today is judged against the law as it stands today. - The practical response is unchanged by the uncertainty: know what personal data you hold, why you are allowed to hold it, who can reach it, and how someone asks for it to be corrected or removed. None of that becomes cheaper by waiting for the number. Source: [DLA Piper, Data Protection Laws of the World — UAE](https://www.dlapiperdataprotection.com/countries/uae-general/law.html) ### Personal information is not published, intercepted or disclosed without authorisation through an information system. **Instrument.** Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, in force 2 January 2022 **Penalty.** Privacy violation through information technology: AED 150,000 to AED 500,000 and/or imprisonment from six months. Disclosure of confidential information obtained through work: imprisonment from six months and/or AED 200,000 to AED 1,000,000 - Where the data protection law has no published penalties, this one does — and it is the instrument under which misuse of personal information is actually prosecuted today. It applies to individuals as well as companies, including employees acting on their own initiative. - Its reported overall range runs from AED 20,000 to AED 3,000,000 across the offences it defines. Source: [Baker McKenzie, Global Data and Cyber Handbook — UAE](https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/key-data-and-cybersecurity-laws) ## The website itself What has to be on it, and the widely believed requirement that does not exist here. ### Understand what a cookie banner is doing on a UAE site before installing one, because the obligation it answers is not the one most people assume. **Instrument.** No UAE instrument equivalent to the EU ePrivacy consent rule was identified in this review **Penalty.** None identified - We could not identify a UAE requirement to obtain consent for cookies in the form the European rule imposes. That is an absence rather than a permission, and it is stated here as a limit of this review rather than as a legal conclusion. - What does apply is the data protection law: if a cookie or a tag collects personal data, the processing needs a lawful basis, and the notice describing it needs to be truthful. A banner copied from a European template usually describes a legal regime the site is not in, and lists processing the site does not perform — which is a false statement about your own business published on your own domain. - The defensible version is short and specific: say what is actually collected, why, where it goes and how long it stays. If that description does not need a consent wall, do not build one. Source: [DLA Piper, Data Protection Laws of the World — UAE](https://www.dlapiperdataprotection.com/countries/uae-general/law.html) ### The site identifies the legal entity behind it — the licensed name, the licensing authority and the licence number. **Instrument.** Trade licensing practice; requirements differ by emirate and by free zone **Penalty.** Set by the licensing authority rather than federally; verify against your own licence - Verify this one against your own licence and your own authority rather than against a general article, because the requirement and its wording differ between the mainland departments of economic development and the free zones, and between free zones. - It is worth doing beyond compliance. A site that names its entity and its licence number is publishing the only claim on it a reader can independently check, and search engines and assistants resolve an entity far more reliably when the identifiers are stated. Source: [Verify with your licensing authority](https://u.ae/en/information-and-services/business/starting-a-business) ## Access and continuity Not regulated as such, and the most common cause of a business losing its own presence. Included because the cost is real even where the fine is not. ### The domain, the advertising accounts, the analytics and the social profiles are registered to the company rather than to an individual or a supplier. **Instrument.** Not a regulatory requirement. A commercial one. **Penalty.** No fine. The cost is the asset itself, and it is usually discovered during a dispute. - Included on a compliance checklist deliberately, because it is the item that costs the most and carries no penalty at all. A domain registered to a former contractor is not yours in any sense that survives a disagreement, and no regulator will help. - The check is a single question per row of the register: whose name is on the account. Not who paid for it, and not who uses it. Source: [Glossary — digital asset register](/glossary/asset-register) ### Access is revoked on the last working day, ownership of what the person holds is transferred first, and shared credentials are rotated. **Instrument.** Not a regulatory requirement, and interacts with employment and visa timing in the GCC. **Penalty.** No fine. The exposure is unauthorised access after departure, which is prosecutable under the cybercrimes law. - The administrative side of a departure in the GCC runs on its own schedule — notice, visa cancellation, final settlement — and technical revocation should not wait for any of it. - Transfer before you revoke. A sole administrator removed from a business account can leave that account with no administrator at all, and recovering it is a support case measured in weeks. Source: [Glossary — offboarding](/glossary/offboarding) --- Canonical version: https://www.datanexus.ae/uae-compliance