Technical
Privacy policy, PDPL and cookies: what a Gulf website must publish
Ilyes Massoudi7 min readThe short answer
Any Gulf website that collects personal data, even a phone number in a form or a cookie from Google Analytics, falls under Saudi Arabia's Personal Data Protection Law, the UAE's federal data protection law and Qatar's personal data privacy law. The minimum a site must publish: a privacy policy in the customer's language naming the entity, what it collects, why, who it shares it with, the data subject's rights and how to get in touch; a notice for non-essential cookies before they run; terms of use; and for stores, return, shipping and payment policies. That is what the audit detects as presence and placement; whether the texts comply with the law needs a legal adviser.
A note before anything else
This article is a practical checklist for the business owner on what must appear on the site and where. It is not legal advice, and the laws and their implementing regulations change. Whether your policy texts comply with your country’s and sector’s law needs a legal adviser. Whether the pages exist, where they sit, and what runs on the site before consent is what the audit detects.
Why this concerns you even with a small site
A contact form collecting name and phone: personal data. A WhatsApp button: sends the visitor’s number to you. Google Analytics or a Snapchat or TikTok pixel: collects data about the visitor’s device and behaviour. A store: address and card. There is almost no commercial website that does not collect personal data.
The three laws that concern you in the Gulf:
| Country | Law | What it requires at its core |
|---|---|---|
| Saudi Arabia | The Personal Data Protection Law and its implementing regulation | Informing the data subject, a lawful basis for processing, rights of access, correction and deletion, restrictions on transfers outside the Kingdom |
| UAE | The federal personal data protection law (with separate regimes in the financial free zones) | Similar principles: transparency, specified purpose, data subject rights |
| Qatar | The personal data privacy protection law | Similar principles, with emphasis on consent and notice |
What the site must publish
1. A privacy policy, in the customer’s language, containing at least: the entity’s name, base and registration; the data collected and from which source (forms, WhatsApp, analytics, pixels, payment); the purpose of each; who it is shared with (hosting, shipping, payment, advertising); retention period; the data subject’s rights and how to request them; and how to reach the person responsible. With a last-updated date.
2. A cookie notice, if the site uses analytics or an advertising pixel: what they are, why, and a choice for the visitor before the non-essential ones run. What the audit detects specifically: analytics and marketing cookies written to the visitor’s browser before any consent.
3. Terms of use: what the site provides, limits of liability, governing law.
4. For stores: return and exchange, shipping and delivery, and payment policies, plus the commercial identity details the Saudi e-commerce law requires. Identity details are in the trust signals article.
5. For clinics and sensitive sectors: health or financial data needs stricter treatment, and here a template is not enough.
Where they go
- Links in the footer of every page, in the page’s language: the Arabic policy on Arabic pages.
- A link to the policy beside the submit button on every form, with a short line: by submitting you agree to the privacy policy.
- The page one click from any page, not buried in a sub-menu.
- One updated version, not conflicting copies across the two languages.
Measurement tools and privacy
Google Analytics, Clarity and pixels are useful tools, and the correct way to use them: name them in the policy, enable their settings that reduce personal data, and run them through a consent tool if your adviser decides a notice is required in your case. How to configure GA4 is in the GA4 article.
Mistakes I see on Gulf sites
- No privacy policy at all, the commonest in small businesses.
- A policy in English only on an Arabic site.
- A copied policy citing the European regulation and data the site does not collect.
- Pixels and analytics running from the first moment, with a consent banner that is decoration and stops nothing.
- The page exists and is buried three clicks deep.
- A form asking for data it does not need: date of birth to request a quote.
Where this sits in the audit
The audit detects, across the crawled pages, whether the privacy policy and terms exist, their placement and depth from the homepage, the commercial identity details, and the analytics and marketing cookies written before any consent, within the trust and compliance dimensions of the technical foundation. It states plainly that matching the texts to the law is your legal adviser’s work, not mine.