Every business system stores personal data: customer names and numbers, staff records, passport copies, emails. The UAE’s federal Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, sets the rules for how that data must be handled. You do not need to become a lawyer, but you should know what to ask before buying or building software.

What the law is about

The PDPL covers the processing of personal data by organisations in the UAE and, in some cases, outside it when they process the data of people in the UAE. In broad terms it expects you to collect data for a clear purpose, keep it accurate and secure, keep it no longer than needed, and respect the rights of the people it belongs to. Specialised regimes apply in some places: DIFC and ADGM have their own data protection laws, and sectors such as healthcare and banking have additional rules.

Seven questions to ask any software vendor

  1. Where is the data stored? Know the country and the hosting provider. Self-hosting on a UAE server gives you the clearest answer.
  2. Who can see it? Look for role-based access so staff only open what their job needs, and an audit log that records who viewed or changed what.
  3. How is it protected? Encryption in transit (HTTPS), hashed passwords, protection against common web attacks, regular backups, and a tested restore.
  4. Can customers exercise their rights? You may need to find, export, correct or delete one person’s data on request. Check that the system can do it without a developer.
  5. Is consent recorded? For marketing emails and WhatsApp messages, you should keep proof of when and how someone agreed, and honour opt-outs. Our email and WhatsApp marketing systems include unsubscribe and suppression lists.
  6. What happens in a breach? Ask about monitoring, incident procedures and how quickly you would be told. The law expects breaches that put people at risk to be reported.
  7. What leaves the country? Analytics, email delivery, AI services and support tools often send data abroad. Ask for a list of third parties that touch your data.

Practical steps for your business

  • Keep a simple register of what personal data you hold, why, and where.
  • Collect only what you need. Do you really need a passport copy at the enquiry stage?
  • Set retention periods, and delete or anonymise old records.
  • Train staff on phishing, password hygiene and not sharing documents over personal chat.
  • Write a short privacy notice in English and Arabic and link it from your forms. See our website checklist.

Why self-hosting appeals to many UAE firms

Business-setup firms, clinics, law offices and accountants handle sensitive documents. Running the system on your own server, with source code you control, means no shared multi-tenant platform and no surprise about where data sits. It is not automatically more secure, because you still need patching and backups, but it puts the decisions in your hands. We cover the trade-offs in our self-hosted vs cloud guide.

This guide is general information, not legal or tax advice. Rules and thresholds change, so confirm current requirements with the relevant authority or a licensed adviser before you act.

Need software built around how your UAE business really works? Tell us what you need or browse our software and request a demo. We customise, install and support it.