UAE data protection law (PDPL) and your promotions: entries, SMS lists and photos
Every scan-and-win entry, receipt upload and sign-up sheet collects personal data. The UAE has a federal data protection law that applies to it, and a few habits at the stand and on the microsite keep a campaign on the right side of it.
Short answer
The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires consent that the business can prove, in clear language and with a way to withdraw it, and it lets people object to direct marketing. Promotions that collect names, numbers, receipts or photos should tell people why, ask for marketing consent separately and keep data only as long as needed.
What the law is
Federal Decree-Law No. 45 of 2021 on the protection of personal data came into force on 2 January 2022. It applies to businesses established in the UAE that process personal data, and to businesses outside the UAE that process the personal data of people in the UAE. It does not cover government data, data already governed by the data protection rules of the DIFC and ADGM, or certain data governed by special laws, such as health and banking data.
The law has been followed by executive regulations and guidance over time. Check the current position on the UAE Data Office and legislation portals, or with a UAE lawyer, before you rely on any detail. This guide is general information, not legal advice.
Consent has to be provable
According to a law-firm summary of the decree-law, processing personal data without the person's consent is prohibited unless an exception applies. Consent must be given in a clear, simple and accessible way, electronically or in writing, and the business must be able to prove it. People must be told that they can withdraw consent at any time.
For a campaign, that means a tick box that is not pre-ticked, wording in plain language and a record of who agreed to what and when. A name written on a sheet at a stand is not a record of marketing consent.
People can object to direct marketing
The decree-law gives people rights to access their data, have it corrected or erased, restrict its use and object to certain processing, including direct marketing. A promotion that adds every entrant to an SMS list without a separate yes breaks the spirit of that rule, and the SMS rules in our SMS marketing guide separately require registered sender names and consent.
A checklist for activation teams
- Tell people at the point of collection: who is collecting the data, for what purpose and for how long it is kept.
- Collect only what the campaign needs. A prize draw needs a contact detail. It does not need a date of birth or an Emirates ID number unless the winner claims a prize.
- Ask for marketing consent separately from the entry. Do not bundle them.
- Treat receipt photos as personal data. Receipts can carry card digits, loyalty numbers or names.
- Set a retention period and delete entries when the campaign and its prize claims end.
- Control who can see the data. Limit access to the people running the campaign, and agree the terms in writing with any microsite or SMS supplier.
- Have a way to delete or correct entries on request.
Photos and video at events
Photos of promoters are one thing and photos of shoppers are another. When a shopper can be identified in a photo or video you plan to publish, the safe routine is to ask permission and put a sign at the stand. Check the venue's own rules too, since malls often set filming conditions.
How this fits the rest of the campaign
A prize campaign needs the promotion permit, the microsite needs a privacy notice, the SMS needs a registered sender and the stand needs a script that tells people what happens to their data. One team owning all four avoids gaps between them. Read our guides to scan-and-win campaigns and the promotion permit, or see microsites and digital activations and send us the brief.
Questions
Does the UAE have a data protection law?
Yes. Federal Decree-Law No. 45 of 2021 on the protection of personal data came into force on 2 January 2022.
Do I need consent to add promotion entrants to an SMS list in the UAE?
Yes. Marketing messages need the recipient's consent under both the data protection law's consent rules and the telecom regulator's SMS rules. Ask for marketing consent separately from the entry.
Can people ask me to delete their data after a promotion?
The law gives people rights to have their personal data corrected or erased in certain cases. Build a way to handle such requests before the campaign starts.
Are receipt uploads personal data?
They can be. Receipts may show names, loyalty numbers or card digits, so treat them as personal data, restrict access and delete them when the campaign ends.
