Field notes on PDPL, compliance and digital operations.

The UAE has three data-protection regimes, not one. Where your business is established decides which law governs your website — and they differ.

The PDPL defers much operational detail to Executive Regulations that, as of 2026, are still not issued — and one widely-copied claim about them is wrong.

The UAE PDPL shares the GDPR's vocabulary but diverges on lawful basis, transparency and timelines — and it is not the Saudi PDPL either.

Federal Decree-Law No. 45 of 2021 in plain language — what personal data means, what consent requires, and which parts touch every website you run.

Why retrofitting a consent layer costs more than designing one — and how a compliant capture flow should behave.

How a lead should travel from a form into Zoho automatically — and where a human still belongs.