Skip to content
Free template · no sign-up

Consent platform RFP and vendor questionnaire for Saudi Arabia and the UAE

43 questions to send any cookie consent or consent management platform before you buy: Arabic banner, Saudi PDPL and UAE rules, Google Consent Mode v2, consent records, security, contract and pricing. Copy one section or the whole list, in English or Arabic.

43 questions in 10 sections

Last updated:

Short answer

What should an RFP for a consent platform in Saudi Arabia or the UAE ask?

Ask how the platform handles Arabic and right-to-left text, whether it applies Saudi PDPL, UAE and GDPR rules by visitor country, whether it sends all four Google Consent Mode v2 signals before any Google tag loads, what it records for each consent decision and how you export it, and the usual security, contract and pricing questions. The 43 questions below cover all of these.

The questions

43 questions in 10 sections

Laws and regions

  1. 7.Does the platform apply different rules by visitor country (Saudi PDPL, the UAE federal law, GDPR, others)? How is the visitor's country detected?
  2. 8.How are visitors from the DIFC, ADGM and other UAE free zones handled?
  3. 9.Can we override the automatic rules for a given site or country?
  4. 10.Who updates the rules when a law or regulation changes, and how are we told?

Google, Meta and other tags

  1. 11.Does the platform send all four Google Consent Mode v2 signals (analytics_storage, ad_storage, ad_user_data, ad_personalization)?
  2. 12.Is the default consent state set before any Google tag loads? How can we verify it?
  3. 13.Are basic and advanced Consent Mode both supported?
  4. 14.How are Meta, TikTok, Snap and LinkedIn tags held until the visitor consents?
  5. 15.Can scripts, cookies and network requests be blocked until consent, and can blocking be switched off per site?
  6. 16.Is server-side consent forwarding available (to Google, Meta, TikTok), and what does it require from us?
  7. 17.Is the IAB Transparency and Consent Framework supported, and which version?

Consent records and evidence

  1. 18.What is stored for each consent decision (time, choice per category, banner version, page, pseudonymous identifier)?
  2. 19.How long are consent records kept, and can we set the retention period?
  3. 20.Can we export the records, and in which formats?
  4. 21.Is there an audit log of changes to banner settings, showing who changed what and when?
  5. 22.How would we show a regulator or an auditor that a given visitor consented?

Cookie scanning and classification

  1. 23.How often is the site scanned, and does the scan use a real browser?
  2. 24.How are unknown cookies classified, and does the database recognise regional services (local payment, instalment and delivery providers)?
  3. 25.Does the platform produce a cookie declaration in Arabic and English?

Platforms and installation

  1. 26.Which platforms have a native app or plugin (Salla, Zid, Shopify, WordPress)?
  2. 27.How is the platform installed on a custom-built site or a single-page app?
  3. 28.Is there an SDK for iOS and Android apps?
  4. 29.Can the vendor install and test the setup for us, and what does that include?

Security

  1. 30.How is data encrypted in transit and at rest?
  2. 31.How is access to our account controlled (roles, two-factor authentication)?
  3. 32.When was the last independent security test, and can we see a summary?
  4. 33.What is the incident-response process, and how quickly are customers told about a breach that affects them?
  5. 34.Which security certifications are held, and which are in progress?

Contract and data handling

  1. 35.Is a data processing agreement provided?
  2. 36.Is there a list of sub-processors, and how are customers told about changes to it?
  3. 37.What happens to our data when the contract ends?
  4. 38.Who owns the consent records?

Performance and availability

  1. 39.What is the size of the script that loads on every page, and does it load without blocking the page?
  2. 40.What is the published uptime, and is there a status page?

Support and pricing

  1. 41.Is support available in Arabic, and through which channels?
  2. 42.What is the price based on (pageviews, domains, sessions), and what happens when we exceed a limit?
  3. 43.Is there a free plan or a trial, and what does it leave out?

A procurement template, not legal advice. Add your own legal, security and sector requirements.

How to use it

How to use this questionnaire

Send the same list to every vendor
Comparable answers matter more than long ones. Ask vendors to answer each question in one or two sentences, with a link to documentation where one exists.
Test the answers that can be tested
Banner layout, Reject all, Consent Mode signals and script blocking can be checked on a trial site in an hour. Ask for a trial before the contract.
Ask for evidence on records
Ask for a sample consent-record export. It is what you would show a regulator or an auditor.

From Arqam360

We publish this template free and without a form. Arqam360 is a consent platform for websites in Saudi Arabia and the UAE, and we answer these questions for our own product on request.

Arqam360 securityAsk us to answer the questionnaire

Related

Saudi PDPL vs GDPR, side by sideUAE data protection law guideGoogle Consent Mode v2 in Saudi Arabia and the UAE: the 2026 numbersCookie banner text in Arabic and English