PDPL website audit: what it should cover, and what it costs.
An audit should check what your website actually does, not hand you a template policy. Here is what a useful PDPL website audit covers, what UAE providers charge for each part, and how our free screening, a fixed-price fix and a retest fit together.
Three kinds of provider
A scanner, a consultant and a website builder answer three different questions.
An automated scanner lists the cookies and scripts it finds. Useful, but it does not tell you whether your forms, your policy and your CRM fit together.
A privacy consultant reviews documents and processes, often across the whole organisation. Thorough, and usually priced like it.
We look at the website from the outside, tell you what to fix first, and can fix it. The legal assessment stays with your counsel, and we hand over artefacts they can review.
What a useful audit covers
Six checks, and who does which.
This is the list to hold any provider against. The middle column is what our free screening covers from the outside; the right column is what happens when we fix it.
| Check | In the free screening | In the fixed-price fix |
|---|---|---|
| Cookies and trackers | Which third-party scripts and trackers the site loads, and where they send data. | Optional tags held back until the visitor agrees. |
| Consent | How consent is captured and whether it can be withdrawn. | A consent gate built in, with an auditable consent log. |
| Privacy notice against reality | Whether the policy describes what the site actually does. | A policy written to your regime, with a real controller and contact. |
| Forms and data flows | What the forms collect and where the data appears to go. | A documented data map, and enquiries routed into your CRM. |
| Prioritised gap report | A written report: risk level, your top three gaps, the next step. | A fixed scope and price against those findings. |
| Retest | Run the screening again after any change. | Compliance kept current in every care plan, with a quarterly written re-check in Care Extended. |
Not in either column: the legal assessment of your organisation. That stays with your counsel. An outside-in screening sees what a visitor sees; it does not see your back office.
Market prices, 2026
What UAE providers publish for PDPL work.
Ranges published for small businesses in 2026. They cover different scopes, so compare a quote against the row it actually matches.
| Service | Typical range | What it usually covers |
|---|---|---|
| Compliance audit, PDPL and GDPR | USD 4,000 to 12,000 (about AED 14,700 to 44,000) | One-off review of a web application against both laws. |
| Gap assessment and data mapping | AED 20,000 to 35,000 | For a business under 50 staff: what data you hold, where, and the gaps. |
| Data protection impact assessment | AED 12,000 to 25,000 | For a business under 50 staff, where a processing activity calls for one. |
| Privacy notices and policies | AED 8,000 to 15,000 | Drafting the notices and policy documents for a small business. |
| Cookie consent platform | AED 2,000 to 10,000, plus AED 1,500 to 6,000 a year | Setting up a consent management platform, then its licence. |
Sources, read on 16 October 2026: UAE Free Zone Finder (PDPL compliance guide and privacy compliance guide, both updated August 2026), Kolonell (data protection audit cost, 15 September 2026; USD converted at 3.6725). Published by providers and advisers: what is asked, not what is paid.
FAQ
PDPL website audits, answered honestly
What does a PDPL compliance screening for a website cost?
Ours is free: a written report on your website with a risk level, your top three gaps and the recommended next step, with no obligation. Published 2026 prices for paid work range from about AED 2,000 to set up a cookie consent platform, through AED 8,000 to 15,000 for policy documents, to AED 20,000 to 35,000 for a small-business gap assessment with data mapping.
Which companies in the UAE offer website PDPL audits?
Three kinds: automated scanners that list cookies and scripts, privacy consultants who review documents and processes, and website builders who screen the site and fix it. We are the third kind. For a legal opinion on your organisation, you need counsel.
Is an automated cookie scan enough?
It is a start. A scan shows what loads; it does not show whether your policy matches it, where form data ends up, or whether consent is recorded. Those are the questions an auditor or a regulator would ask next.
Do you certify that a website is PDPL compliant?
No, and be careful with anyone who does. We build the technical layer and hand over artefacts a lawyer can review: a data map, a consent log, policies written to your regime. The legal assessment stays with your counsel.
What happens after the screening?
You keep the report either way. If you want the gaps closed, we quote one fixed price, as a targeted retrofit or a rebuild, whichever is the sensible call. After any change you can run the screening again.
Does it matter whether we are in DIFC or ADGM?
Yes. DIFC and ADGM have their own data-protection laws; everywhere else, the Federal PDPL applies. Tell any provider your licence location before they quote, because it changes what the website has to do.
Next steps
Start with the screening.
Send your URL and get a written report: risk level, top three gaps, next step.
When you want the gaps closed: data protection built into the site, documented and defensible.
The data-protection part of a website price, and how it fits into one fixed quote.