The laws we detect, and what each one demands.
Written for the region that enforces them.

For a website, PDPL compliance starts with the tags it runs. A cookie or tracker that can identify a visitor, directly or indirectly, collects personal data, so analytics and advertising tags normally need the visitor's consent first: asked for each purpose separately, recorded, and open to withdrawal at any time. This page sets out what the law and its Implementing Regulation require, and links to SDAIA's own text.

What the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) asks of businesses, what still waits on its executive regulations, and how the DIFC and ADGM regimes sit beside it.

Businesses established in the Dubai International Financial Centre follow the DIFC's own data protection law, not the UAE federal one. Its Regulation 9 is unusually specific about cookie banners: colour-neutral buttons, an unticked box or another positive action, and no consent from pre-ticked boxes, silence or inactivity. The Commissioner of Data Protection has already applied it to a cookie banner, in a decision notice issued to Careem Group.

Entities in Abu Dhabi Global Market follow ADGM's own Data Protection Regulations 2021, not the UAE federal law. Consent must be a clear affirmative action, silence, inaction and pre-ticked boxes do not count, and you must keep records of consent and of withdrawals. ADGM's guidance lists cookie identifiers among the identifiers that make data personal, and fines can reach $28 million.

Everything you need to know about Qatar's Personal Data Privacy Protection Law — the first comprehensive data protection law passed in the GCC.

Everything you need to know about Bahrain's Personal Data Protection Law — the GCC's second data protection law, and the one that voids cookie-wall consent outright.

Kuwait has no single data protection law. It has three instruments, criminal penalties, and no data protection authority — which changes what compliance means here.

Oman's data protection law has applied since February 2023, its two-year grace period ended on 5 February 2026, and an amendment in force since 7 September 2026 now reaches processing outside Oman and requires explicit consent. The law does not mention cookies, but it lists electronic identifiers as personal data, so a website's analytics and advertising tags need the visitor's explicit opt-in before they run.

Everything you need to know about Jordan's Personal Data Protection Law — consent-first by default, with penalties tied to a percentage of annual revenue.

Egypt's data protection law has applied since October 2020, but the date that matters is 1 November 2026: the Executive Regulations issued on 1 November 2025 gave businesses one year to comply. The law does not mention cookies, but it names online identifiers as personal data and requires explicit consent to process them, so a website's analytics and advertising tags need the visitor's opt-in before they run.

Morocco's data protection law dates from 2009, but its regulator, the CNDP, set out how cookies are handled only in Deliberation D-939-2025 of 28 November 2025. A website must inform visitors before placing the first cookie, ask consent for personalised-advertising and social-sharing cookies, keep cookie data no longer than six months, and file a simplified declaration with the CNDP before placing cookies.

The complete guide to EU General Data Protection Regulation compliance for MENA businesses selling to European customers.

What MENA businesses need to know about the California Consumer Privacy Act when selling to US customers.

A comprehensive guide to privacy regulations across the Gulf Cooperation Council — Saudi Arabia, UAE, Bahrain, Kuwait, Oman, and Qatar.