How does the UAE PDPL differ from the GDPR for a website?

It follows similar principles, but consent is the default basis for processing, with a closed list of exceptions such as performing a contract or meeting a legal obligation. Much of the detail, including fine amounts, is left to executive regulations and Cabinet decisions that had not been published as of September 2026.

For a website, the cookie question works the same way in practice. The federal law has no provision written for cookies, but a cookie or tracker that can identify a visitor collects personal data, including online identifiers, so analytics and advertising tags need consent before they run unless an exception applies.

Free zones change the picture. Entities established in the DIFC follow the DIFC Data Protection Law No. 5 of 2020, which is closely modelled on the GDPR, and those in the ADGM follow the ADGM Data Protection Regulations 2021.