Every enquiry form collects personal data: a name, a phone number, an email. In the Gulf, there are laws about that. This guide names the laws and covers the practical steps for a small business website.
This is not legal advice. We build websites, we are not lawyers. If your business handles health, financial or children's data, or sells across borders, ask a lawyer who works in your country.
The laws, in one line each
- UAE: Federal Decree-Law No. 45 of 2021 on the protection of personal data came into force on 2 January 2022. The detailed executive regulations had not been clearly published when we checked in November 2026. Companies in the DIFC and ADGM free zones follow those zones' own data protection laws.
- Qatar: Law No. 13 of 2016 on Personal Data Privacy Protection, overseen by the National Cyber Security Agency. In general, you need consent or another legitimate purpose to process personal data.
- Saudi Arabia: the Personal Data Protection Law took effect on 14 September 2023 and became enforceable on 14 September 2024, with SDAIA as the regulator.
What that means for your website
Say what you collect and why. A privacy page in plain language: what the form collects, what you use it for, who you share it with (your email provider, your CRM), how long you keep it, and how someone can ask you to delete it.
Ask only for what you need. A quote form rarely needs a date of birth or a home address. Fewer fields also means more people finish the form.
Keep it secure. The site should run on HTTPS. Form entries should go to a secure inbox or CRM, not a spreadsheet anyone can open.
Be careful with tracking. Analytics and advertising pixels collect data about visitors. Ask for consent before loading non-essential tracking, and let people say no as easily as yes.
Mind WhatsApp. A WhatsApp button is fine; the customer chooses to message you. Adding someone's number to a broadcast list is a different thing. Get their agreement first.
Mind where data goes. If your form sends data to a service hosted outside your country, mention that on your privacy page. Some sectors have stricter rules on data leaving the country.
What we can set up
On sites we build: HTTPS, forms that ask only for what is needed, a cookie banner that holds back non-essential tracking until the visitor agrees if you use any, and a privacy page drafted for you to check with your adviser. You own the final wording.
More for Gulf businesses: web design for Gulf businesses and online shops for Gulf businesses.