When is consent not required under the UAE PDPL?

When one of the exceptions the law lists applies, such as performing a contract or meeting a legal obligation. Consent is the default basis under Federal Decree-Law No. 45 of 2021, and the exceptions are a closed list. Where you rely on consent, it must be specific, clear and unambiguous, and can be withdrawn at any time.

The law has no provision written for cookies, but analytics and advertising cookies that can identify a visitor collect personal data. Asking for consent before those tags run is the practical way to have a basis for them.

Some categories covered by other legislation are excluded from the law, and entities in free zones with their own data protection law, such as the DIFC and ADGM, follow that law instead. Much of the detail waits on executive regulations, which had not been published as of September 2026.