he UAE Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, has applied since 2 January 2022 and makes consent the default legal basis for processing personal data, with a short list of exceptions that does not include marketing. For SMS and WhatsApp campaigns that means opt-in consent you can prove, an easy way to withdraw it, and a right for every recipient to stop direct marketing. The executive regulations that set breach deadlines, transfer controls and the six-month compliance clock were still not listed on the UAE Legislation portal when we checked in September 2026, while the TDRA's spam policy already sets hard rules for every marketing text with a UAE link.
This guide summarises public legal texts as of 26 September 2026. It is general information, not legal advice — confirm your obligations with counsel or the competent authority before relying on it.
Key takeaways
- The PDPL was issued on 20 September 2021, published in the Official Gazette on 26 September 2021 and came into force on 2 January 2022. It covers businesses inside the UAE and businesses abroad that process the personal data of people in the UAE.
- Article 4 prohibits processing personal data without the data subject's consent, then lists exceptions such as performing a contract or meeting a legal obligation. Marketing is not one of them, so opt-in consent is the practical basis for promotional SMS and WhatsApp.
- Article 17 gives everyone the right to object to, and stop, processing for direct marketing, including related profiling.
- The executive regulations were due within six months of the law but, as of our check, were not listed on the federal legislation portal. Companies get six months from their issuance to regularise their status (Article 29).
- Companies in free zones with their own data-protection legislation — the DIFC and ADGM — are outside the PDPL and follow their own laws.
- Separately, the TDRA's policy requires opt-in consent records, an opt-out in every marketing text, an AD- sender prefix and no marketing texts between 21:00 and 07:00.
What is the UAE PDPL and who does it apply to?
Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data is the UAE's federal data-protection law. The UAE Legislation portal lists it as active, issued on 20 September 2021, published in Official Gazette No. 712 (supplement) on 26 September 2021 and effective from 2 January 2022. Under Article 2 it applies to every data subject residing or doing business in the UAE, to every controller or processor in the UAE (for data subjects inside or outside the country), and to every controller or processor outside the UAE that processes the personal data of data subjects inside it. A brand in Europe or Asia that texts customers in Dubai is therefore in scope.
Personal data is defined broadly — name, voice, image, identification number, electronic identifier and location are all listed — so a mobile number tied to a customer record is personal data. Article 2 excludes government data and entities, security and judicial data, purely personal use, health and banking data governed by their own legislation, and free-zone companies with their own data-protection legislation.
Is the PDPL fully in force in 2026?
The law is in force; the detail is missing. Article 28 required executive regulations within six months, and several obligations depend on them: the breach-notification deadline (Article 9), the thresholds for a data protection officer (Article 10) and the controls for cross-border transfers (Article 23). Article 26 leaves violations and administrative penalties to a separate Cabinet decision.
When we checked on 26 September 2026, no executive regulations were listed on the UAE Legislation portal: the law's page, as captured on 27 August 2026, still showed 20 September 2021 as its last update, and its related-legislation list named no implementing regulation. The government portal u.ae (updated 4 December 2025) says the UAE Data Office, established by Federal Decree-Law No. 44 of 2021, "will act as the federal data regulator". Some commercial websites say the regulations were issued in 2026; treat that as unconfirmed unless it cites a Cabinet Resolution number you can open on the official portal.
Article 29 then gives controllers and processors six months from their issuance to comply, extendable once by the Cabinet — so programmes that already meet the law's text will have little to change.
Do you need consent for marketing SMS and WhatsApp in the UAE?
Yes, in practice. Article 4 opens with a prohibition — "It is prohibited to process Personal Data without the consent of its owner" — then lists eleven exceptions, such as performing a contract with the data subject or meeting an obligation under another UAE law. There is no general "legitimate interests" exception like the one in the DIFC law, so a promotional campaign to people who never opted in has no obvious legal basis.
Consent must be given in a "specific, clear and unambiguous manner" through "a clear positive statement or action" (Article 1). Under Article 6 the controller must be able to prove it, the request must be "clear, simple, unambiguous and easily accessible", and it must include the right to withdraw easily, at any time. Article 13 adds that, before processing starts, people must be told the purposes, who the data is shared with inside and outside the UAE, and the protections for cross-border processing.
The telecom rules point the same way: the TDRA's Regulatory Policy on Unsolicited Electronic Communications (version 1.1, 13 June 2022) covers all text messages with a UAE link, including any whose recipient is in the UAE, and bars delivery of a marketing text without evidenced consent. WhatsApp adds Meta's policy: businesses must obtain opt-in permission "confirming that they wish to receive subsequent messages or calls from a particular business", name that business and comply with applicable law. See WhatsApp Business API.
What does the TDRA require for marketing texts?
The policy binds the licensed operators, which must write it into every messaging-service contract, so every brand sending through them inherits it:
| Requirement | What the TDRA policy says | Clause |
|---|---|---|
| Opt-in consent | No marketing text unless the recipient's consent was obtained, verified and evidenced | 8.2, 9.2.2 |
| Consent record | Date, time, the words or content by which the customer consented, identity and phone number; kept while marketing texts are sent | 5.6, 5.7 |
| Consent requests | A brand (messaging-service subscriber) may not ask for consent by SMS or voice call | 9.2.5 |
| Opt-out | Every marketing text carries a free way to opt out; texts may not be used to talk people out of unsubscribing | 5.8–5.10 |
| Sender name | Marketing senders carry the AD- code followed by the sender's name | 8.8 |
| Sending hours | No marketing texts between 9:00 pm and 7:00 am | 8.3, 9.2.4 |
| Recycled numbers | Consents attached to a number that changes hands are cancelled | 8.11 |
One further rule applies to telemarketing. Cabinet Resolution No. 56 of 2024 limits marketing calls to 9:00 am–6:00 pm and bars contact with numbers on the Do Not Call Register, and its definition of telemarketing also covers marketing text messages. We explain the overlap in UAE Cabinet Resolution 56 explained; the country summary is on UAE SMS regulations, and the full sender-ID process is in how to register a UAE sender ID.
Does the PDPL treat OTPs and transactional messages differently?
The law does not name message types, but its exceptions do the sorting. A one-time password the user just requested, a delivery update or a receipt is processing needed to perform the service, which fits the contract exception in Article 4(9). Promotions have no such exception, and Article 17 lets the recipient stop them at any time. The TDRA policy likewise targets only marketing texts — those offering or advertising goods, services or business opportunities, or soliciting donations.
Keep the streams apart: separate sender IDs (AD- is for marketing only), separate templates, and no offers inside an OTP or order update — that turns it into marketing. Banks have an extra authentication regime, covered in Is SMS OTP banned?; see also OTP.
| Message | Typical basis under the PDPL | TDRA marketing rules apply? | Opt-out |
|---|---|---|---|
| OTP or login code the user requested | Contract / service the user asked for (Art. 4(9)) | No — not a marketing text | Not applicable to the code itself |
| Order, delivery or appointment update | Contract (Art. 4(9)) | No, as long as it contains no offer | Offer a preference setting |
| Legally required notice | Legal obligation under another law (Art. 4(10)) | No | Not applicable |
| Promotion, offer or newsletter | Consent (Art. 4, Art. 6) | Yes — opt-in, AD- sender, opt-out, 07:00–21:00 | Mandatory; honour at once (Art. 17) |
Can customer data leave the UAE?
Yes, within limits. Article 22 allows transfers, in cases approved by the UAE Data Office, to a country that has data-protection legislation with a judicial or regulatory authority able to enforce it, or with which the UAE has a bilateral or multilateral data-protection agreement. Where no such protection exists, Article 23 still allows a transfer under a contract that binds the recipient to the law's standards, with the data subject's explicit consent (provided the transfer does not conflict with the UAE's public or security interest), or where the transfer is needed to perform a contract with the data subject, among other cases. The detailed controls are, again, left to the executive regulations.
The PDPL sets no blanket localisation rule, but Article 7 requires your processing record to include "any data related to the cross-border movement and processing" of personal data. Ask each vendor where contact lists, message content and delivery reports are stored; BroadNet's options are on our data residency page.
What about companies in DIFC and ADGM?
Article 2 of the PDPL excludes "companies and establishments located in free zones" that have their own data-protection legislation. Two financial free zones do: the Dubai International Financial Centre applies its Data Protection Law, DIFC Law No. 5 of 2020 (consolidated in July 2025 after amendments in 2022 and 2025), to controllers and processors incorporated in the DIFC and to processing in the DIFC; Abu Dhabi Global Market enacted its Data Protection Regulations 2021 on 14 February 2021, supervised by its own Office of Data Protection.
The practical differences for marketers: the DIFC law lists legitimate interests as a lawful basis alongside consent (Article 10) and gives individuals the right to object at any time to processing for direct marketing. An entity in these zones follows its own zone's law for data protection — but its marketing texts still travel over UAE networks, so the TDRA's consent, opt-out, AD- and time-window rules still apply to the SMS itself.
UAE PDPL checklist for SMS and WhatsApp marketing
- Map which systems hold UAE numbers, message content and delivery reports, and record a basis for each flow — contract for OTPs, consent for marketing (Article 7).
- Collect marketing consent through a clear positive action on a web form, app screen or in store, never by an unsolicited SMS or call, and name your business.
- Store proof of consent: date, time, wording shown, identity and number (TDRA 5.6), and keep it for as long as you send.
- Put a free, working opt-out in every marketing SMS and honour objections to direct marketing immediately (PDPL Article 17).
- Use an AD- sender ID for promotions and a separate sender for OTPs and alerts; keep offers out of transactional templates.
- Schedule promotional sends between 07:00 and 21:00 UAE time, and check the narrower Resolution 56 window with counsel.
- Tell people before processing where their data goes, including abroad, and put transfer clauses in every vendor contract (Articles 13, 22 and 23).
- Prepare a breach-response plan now; the executive regulations will fix the notification deadline, and you will have six months to comply once they are issued.
BroadNet, operating since 2003, is headquartered in Dubai Internet City, holds ISO 27001, ISO 27018 and SOC 2 Type II, and handles UAE sender-ID registration with the operators as part of onboarding. See A2P SMS and UAE coverage.
Frequently asked questions
Is the UAE PDPL in force?
Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022; only its executive regulations are still awaited.
Have the PDPL executive regulations been issued?
Not as far as the official record shows. Article 28 required them within six months of the law, but no implementing regulation was listed on the UAE Legislation portal as of our September 2026 check. Once they are issued, Article 29 gives companies six months to comply.
Do I need consent to send marketing SMS in the UAE?
Yes. The PDPL prohibits processing personal data without consent unless an exception applies, and marketing is not one of the exceptions. The TDRA's policy separately bars delivery of a marketing text unless the recipient's consent has been obtained, verified and evidenced.
Does the PDPL apply to companies outside the UAE?
Yes. Article 2 covers controllers and processors outside the UAE that process the personal data of data subjects inside the UAE, so a foreign brand texting UAE residents is in scope.
Are OTP messages covered by the PDPL?
The law applies, but an OTP the user requested fits the contract exception in Article 4, and OTPs are not marketing texts, so the TDRA's opt-in, AD- and sending-hour rules do not apply to them.
What are the fines under the UAE PDPL?
The law does not set them. Article 26 leaves the list of violations and administrative penalties to a Cabinet decision, which we could not find published as of September 2026. Treat any specific fine amount you see quoted without a decision number with caution.
Does the PDPL apply in DIFC and ADGM?
No. Free-zone companies with their own data-protection legislation are excluded. The DIFC applies DIFC Law No. 5 of 2020 and ADGM its Data Protection Regulations 2021; the TDRA's SMS rules still apply to marketing texts sent from those zones.
What hours can I send marketing SMS in the UAE?
The TDRA policy bars marketing texts between 9:00 pm and 7:00 am. Cabinet Resolution No. 56 of 2024 limits marketing calls to 9:00 am–6:00 pm and defines telemarketing to include marketing texts, so many senders use the narrower window; confirm with counsel.
We read every text below on 26 September 2026, using web.archive.org copies where an official site blocked our servers; see our editorial standards.
Sources
- Federal Decree-Law No. (45) of 2021 Concerning the Protection of Personal Data, official English text, UAE Legislation portal (read 26 September 2026 from the web.archive.org copy of 7 September 2026): uaelegislation.gov.ae.
- UAE Legislation portal — law page (status, issue, gazette and effective dates) as captured on 27 August 2026 and related legislations as captured on 5 January 2026: uaelegislation.gov.ae.
- The Official Portal of the UAE Government — Data protection laws, updated 4 December 2025 (accessed 26 September 2026): u.ae.
- TDRA — Regulatory Policy on Unsolicited Electronic Communications, version 1.1, 13 June 2022 (read from the web.archive.org copy): tdra.gov.ae.
- DIFC — Data Protection Law, DIFC Law No. 5 of 2020, consolidated version July 2025 (accessed 26 September 2026): difc.com.
- ADGM — ADGM enacts its new Data Protection Regulations 2021, 14 February 2021: adgm.com.
- Meta — WhatsApp Business Platform, getting opt-in (accessed 26 September 2026): developers.facebook.com.
- Ministry of Economy — briefing on Cabinet Resolutions No. 56 and No. 57 of 2024, 29 August 2024: moet.gov.ae.