UAE PDPL Compliance for Software: What to Ask Your Developer

UAE PDPL compliance for software means building apps and business systems that let your company meet its duties under the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. Software cannot make you compliant on its own, but it can make compliance practical: clear consent, controlled access, the ability to answer data requests, and good records. This guide explains what to build in and what to ask your developer. It is not legal advice.

What is the UAE PDPL and does it apply to your software?

The PDPL is the UAE's federal law on personal data, and it applies to many businesses that process personal data of people in the UAE. Whether it applies to your specific system depends on your sector, your location and what data you hold, so confirm that with a legal adviser.

Several areas are carved out or covered by their own rules. Commentary on the law notes exclusions for government data, health data and banking and credit data, which have their own legislation, and for companies in the DIFC and ADGM financial free zones, which have their own data protection laws. At the time of writing, published commentary also indicates that the law's executive regulations, which set out much of the practical detail, had not yet been issued. Check the current position with your adviser before you finalise requirements.

For software buyers, the practical message is simple. Personal data includes names, phone numbers, emails, Emirates ID numbers, locations, photos and account histories. Most business systems hold some of these, so privacy should be part of the design, not an afterthought.

Which privacy features should be built into your system?

Build features that let you collect only what you need, explain why you collect it, and respond when someone asks about their data. These features are far cheaper to include at the start than to add after launch.

• A clear privacy notice in English and Arabic, linked at sign-up and in account settings
• Consent captured and recorded where consent is the basis for processing, with a simple way to withdraw it
• Separate opt-ins for marketing messages, so service messages and marketing are not bundled
• Tools for staff to find, export, correct and delete or anonymise a person's data on request
• Retention rules that remove or anonymise data when it is no longer needed
• An audit log of who viewed or changed personal records
• Data exports in a common format when a person asks for a copy of their data

The rights the law gives individuals include access, correction, erasure in certain cases, restriction of processing and data portability. Your legal adviser will define your policy. The software's job is to make carrying out that policy quick and reliable.

Where should personal data be hosted?

Host data where you can justify it legally and protect it technically. The PDPL places conditions on transferring personal data outside the UAE, and some sectors have stricter rules of their own.

Major cloud providers offer regions in the UAE, which can simplify the conversation when data residency matters to you or your customers. Hosting outside the country may still be possible under the transfer conditions in the law, but that is a legal question to settle before the architecture is fixed. Remember that backups, logs, email services, analytics tools and support desks also hold personal data, and they may sit in other countries. List every service in the design and record where each one stores data.

Third-party tools deserve the same attention. Analytics, chat widgets, crash reporting, marketing platforms and AI services may receive personal data from your app, sometimes more than you expect. Review what each one collects, switch off what you do not need, and record each tool in your data inventory. Your contracts with these providers, and with your software developer, should state how they handle personal data on your behalf.

Which security measures support compliance?

Security is part of data protection: the law expects appropriate technical measures, and a breach is far harder to handle without them. The measures below are standard good practice for any business system.

• Role-based access, so staff see only the data their job needs
• Strong login for staff, including two-factor authentication for administrators
• Encryption of data in transit and at rest, including backups
• Masking of sensitive fields such as ID numbers in screens and exports
• Regular security updates for servers, frameworks and libraries
• Separate test environments that do not use real customer data
• Monitoring and alerts for unusual access, with a documented breach response plan

The PDPL includes duties to report certain data breaches to the regulator and, in some cases, to the people affected. Agree internally who decides and who reports, and make sure your system's logs can show what happened.

What should you ask your software developer?

Ask how the developer will protect personal data at each stage, from design to handover. Clear answers to these questions show whether privacy has been thought through.

• What personal data will the system collect, and why is each field needed?
• Where will data, backups and logs be stored, and by which providers?
• How will consent, withdrawals and marketing preferences be recorded?
• How will we answer a request to access, correct or delete someone's data?
• Who on your team can access production data, and how is that controlled and logged?
• How is test data kept separate from real customer data?
• Who owns the code and cloud accounts at the end of the project?

What does privacy by design look like in practice?

For example, a Dubai real estate brokerage might want a lead management system with a mobile app for agents. Privacy by design would mean capturing only the fields agents actually use, recording where each lead came from and what the person agreed to, limiting each agent to their own leads, masking ID numbers, and giving managers a screen to export or delete a person's data on request. Marketing messages would go only to people who opted in, with a record of that choice.

None of this slows the agents down. It makes the system tidier, reduces the damage if a phone is lost, and gives the business clear answers if a customer asks what data is held. This is the kind of work we handle in custom software solutions for companies across the UAE.

How is a privacy-aware project usually run?

Privacy decisions are made in discovery, written into the scope and checked at every release. Discovery takes place in video-call workshops where we map the personal data each feature needs and where it will live. The written scope records those decisions, including hosting regions and retention rules, so your legal adviser can review them before building starts.

Work runs in two-week sprints with a demo each time, and a named lead engineer is accountable for the architecture. Our quality assurance team tests access controls and data request features alongside normal functions. At handover, code and cloud accounts are registered to your company, so control of the data stays with you.

Frequently asked questions

Does using a UAE cloud region make us PDPL compliant?

No. Hosting location is one factor. Compliance also covers why you collect data, how you use it, how long you keep it and how you protect it.

Do free zone companies follow the PDPL?

Companies in the DIFC and ADGM follow their own data protection laws rather than the federal PDPL. If you are in another free zone, ask your adviser which rules apply to you.

Can our developer act as our data protection adviser?

A developer can explain technical options and build the features, but legal decisions belong with a qualified adviser. The two should work together during discovery.

What if our existing system was built without these features?

Start with an audit of what data it holds and who can access it, then add the most important controls in phases.

If you want a second opinion on how your system handles personal data, talk to us and we will walk through it with you.