The UAE PDPL for B2B sales and marketing
Tadas Jurelevicius, Co-founder & CEO, b2n.ai ·
The UAE's Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. It makes consent the main basis for processing personal data, and it has no general "legitimate interests" basis. This guide sets out what that means for B2B sales and marketing, article by article.
Summary, not legal advice. For your own situation, ask a UAE-qualified lawyer.
Quick answers
- Does the PDPL apply to B2B contacts? It applies to personal data, meaning any data about an identified or identifiable natural person, including their name and electronic identifier (Article 1). It has no exception for business contacts.
- Is consent required? Processing personal data without consent is prohibited, except in 11 listed cases (Article 4).
- Is there a legitimate-interests basis, as in the GDPR? No. None of the Article 4 cases is a general legitimate-interests basis.
- Can people object to marketing? Yes. They can object to processing for direct marketing, including profiling related to it, and have it stopped (Article 17).
- Does it apply in the free zones? Not to companies in free zones that have their own data protection legislation, such as the DIFC and ADGM (Article 2(2)(g)).
- Are there rules on sales calls? Yes. Under Cabinet Resolution No. 56 of 2024, telemarketing calls are allowed only from 9:00 to 18:00, and numbers on the Do Not Contact Register must not be called.
Who the PDPL applies to (Article 2)
It applies to: processing personal data electronically or by other means, by controllers and processors in the UAE, and by those outside the UAE processing data of people in the UAE.
It does not apply to:
- government data and government entities;
- security and judicial authorities;
- personal use;
- health and banking data covered by their own laws;
- companies in free zones with their own personal data protection legislation (Article 2(2)(g)).
Consent and its exceptions (Articles 4 and 6)
Article 4 prohibits processing personal data without the owner's consent. The 11 exceptions include:
- the public interest;
- data the person has made public themselves;
- legal claims;
- occupational and preventive medicine, public health, and archives and statistics;
- protecting the person's own interests;
- employment and social-protection obligations;
- performing a contract the person is party to, or steps at their request before one;
- obligations under other UAE laws;
- cases set by the Executive Regulations.
Where processing relies on consent, Article 6 requires that:
- the controller can prove it;
- it's clear, simple, unambiguous and easily accessible;
- it includes the right to withdraw it easily.
The right to object to direct marketing (Article 17)
A person may object to processing of their data for direct marketing, including profiling related to direct marketing, and have it stopped.
What a controller has to tell people (Article 13)
Before processing starts, the controller must tell the person:
- the purposes;
- the sectors or establishments their data will be shared with, inside and outside the UAE;
- the protections for cross-border processing.
Telemarketing (Cabinet Resolution No. 56 of 2024)
The Ministry of Economy's summary of the resolution sets two rules relevant here:
- telemarketing calls only between 9:00 and 18:00;
- no calls to numbers on the Do Not Contact Register, managed by the TDRA.
When businesses must comply (Articles 28 and 29)
Controllers and processors must bring themselves into line within six months of the Executive Regulations being issued. The Council of Ministers can extend this by another six months (Article 29).
UAE PDPL vs GDPR: the differences that matter for B2B outreach
| UAE PDPL | EU GDPR | |
|---|---|---|
| Legitimate interests as a basis | No general basis (Art. 4) | Yes (Art. 6(1)(f)) |
| Consent conditions | Provable, clear, easy to withdraw (Art. 6) | Freely given, specific, informed, unambiguous (Art. 4(11), 7) |
| Right to object to direct marketing | Yes (Art. 17) | Yes, absolute (Art. 21(2)–(3)) |
| Free zones with their own law | Excluded (Art. 2(2)(g)) | n/a |
Is cold email legal in the UAE?
The PDPL doesn't mention cold email. It regulates the processing of personal data, and a named person's work email is personal data under Article 1.
- Outreach that processes personal data needs consent, unless one of the Article 4 cases applies.
- Recipients can object to direct marketing at any time (Article 17).
- Companies inside the DIFC and ADGM follow those free zones' own laws.
How b2n.ai works with these rules
- Every email says who it's from and has an unsubscribe link. The unsubscribe page explains where the contact details came from and links to our privacy policy.
- An opt-out or objection stops that client's outreach to the person straight away. Spam complaints and hard bounces are blocked across b2n.ai.
- Before our agents work in a market, we agree with the client how outreach runs there. The client is the sender, and decides with its own legal advice.