UAE Outreach Compliance: Researching Privacy, Consent and Telemarketing Requirements

If you’re selling into the UAE, the practical answer is this: outbound calling, SMS and app messaging are already hard-regulated by telemarketing rules that took effect on 27 August 2024 and are actively being enforced: a 9am–6pm calling window, mandatory prior approval, a national Do Not Call Registry, and fines that had reached AED 19.19 million by June 2026. On top of that sits a consent-first federal privacy law (the PDPL) which commenced on 2 January 2022, with important implementation details pending in July 2026 legal commentary, plus separate regimes in DIFC and ADGM. This guide maps all of it, channel by channel, with every claim sourced and every uncertainty flagged.

Penalties depend on the exact violation and repetition under Cabinet Resolution 57/2024. Its company and individual schedules differ; a headline maximum is not a universal penalty for every unwanted call.

A quick note before we start. This article is for general information only: it isn’t legal advice, and UAE privacy and telemarketing rules have been moving fast. Laws, resolutions and enforcement priorities change; some provisions I describe are genuinely unsettled or awaiting implementing regulations. For your specific situation, especially anything in regulated sectors like finance: please consult qualified UAE legal counsel.

What actually governs outreach in the UAE

Four layers apply at once. (1) Federal telemarketing rules (Cabinet Resolutions No. 56 and 57 of 2024, available on the official legislation portal) already in force since 27 August 2024, covering calls, SMS and social-app messages. (2) The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), a consent-first privacy law whose executive regulations were still awaited in the most recent reporting I could verify. (3) Separate data protection regimes in DIFC and ADGM. (4) Sector rules, notably the Central Bank’s own Telemarketing Regulation C 3/2026, effective 31 March 2026 with a 90-day implementation period.

The telemarketing resolutions (the rules with teeth, already live)

In June 2024, the Ministry of Economy and the Telecommunications and Digital Government Regulatory Authority (TDRA) announced two decisions: one regulating telemarketing activity, one listing violations and administrative penalties. Reporting by Emirates247 and Gulf News confirms they took effect on 27 August 2024, and the Khaleej Times identifies them as Cabinet Resolutions No. 56 and 57 of 2024. Use the official texts: Resolution 56/2024 and Resolution 57/2024.

What they actually require, per the full breakdowns in Gulf News and Emirates247:

• Scope: all licensed companies in the UAE, including free zones, that market products or services through phone calls, marketing text messages, or marketing messages through social media apps. The Ministry of Economy oversees implementation alongside TDRA, the Central Bank, the Securities and Commodities Authority and local licensing authorities.
• Calling window: only 9:00am to 6:00pm.
• Cadence limits: no calling a consumer again if they rejected the offer on the first call; no same-day call-back after a declined or ended call; at most one call-back per day and two per week where the consumer didn’t answer.
• Conduct: no undue pressure, no deception or misleading tactics.
• Prior approval: companies must obtain approval from the competent licensing authority before practising telemarketing, train their staff, and call only from local numbers registered under the company’s commercial licence.
• Personal numbers: individuals are prohibited from making marketing calls from lines registered in their own name.
• Consent posture: reporting describes calls as being made only to consumers who have expressed interest or given consent: the Khaleej Times framed it as firms “call[ing] only those customers who have given their consent to be contacted”.
• Data handling: selling or disclosing a consumer’s personal data without consent, for reprocessing by others for marketing, is prohibited. Companies must keep records of marketing calls, notify consumers when calls are recorded, and file periodic reports.
• Automated systems: allowed, but the consumer must first be asked whether they want to continue the call.

Penalties are substantial and graduated. Emirates247’s summary lists 18 violation types for companies: AED 75,000 for a first offence of telemarketing without prior approval (AED 100,000 second, AED 150,000 third), up to AED 150,000 for contacting numbers on the Do Not Call Registry, and other fines between AED 10,000 and AED 150,000. Gulf News adds AED 75,000 for calls from unregistered numbers and AED 25,000–75,000 for misleading tactics. The escalation ladder runs warning → fine → suspension of activity (7–90 days) → licence cancellation → commercial register removal → disconnection of telecom services, with the most severe penalty available for repeats within six months. Individuals face AED 5,000 and suspension of all their numbers for a first personal-number offence, rising to AED 20,000 with three-month disconnection and AED 50,000 with a one-year telecom ban for repeat offences.

Enforcement is not theoretical. TDRA reported, as of June 2026, 3,301 violations against individuals totalling AED 19.19 million in fines, with 92,748 numbers flagged by the public and 9,433 disconnected. In Dubai, the Dubai Corporation for Consumer Protection and Fair Trade warned 174 companies and fined 159 of them AED 50,000 each. Earlier reporting put late-2024 enforcement at AED 3.8 million across more than 2,000 violations.

The federal PDPL: consent-first, still phasing in

Federal Decree-Law 45/2021 came into force on 2 January 2022. July 2026 legal commentary describes executive regulations as still pending; incomplete implementation does not mean the law has not commenced. The framework covers lawful processing, security, individual rights and transfers, subject to scope exclusions and sector rules.

Consent and listed exceptions govern federal processing; there is no general GDPR-style legitimate-interest basis. Article 4’s public-data exception does not automatically authorise unsolicited marketing, scraping or onward disclosure. Article 17 provides direct-marketing objection rights. Official PDPL, July 2026 legal update.

DIFC and ADGM: separate regimes, separate regulators

DIFC Law 5/2020, as amended, and ADGM Data Protection Regulations 2021 have their own lawful-basis and objection frameworks. ADGM guidance permits a properly assessed legitimate-interest basis in appropriate cases; federal consent rules are not interchangeable with it. Determine the controller, activity, data subjects and scope exclusions, not only the licence address. DIFC, ADGM guidance.

If you’re established in DIFC or ADGM, the federal telemarketing resolutions still reach you as licensed companies, but your data protection obligations run through the free zone’s own law (DIFC Data Protection Law No. 5 of 2020 (in force 1 June 2020, per the DIFC legal database) or the ADGM Data Protection Regulations 2021) not the PDPL.

DIFC and ADGM have established data-protection and direct-marketing frameworks. Check each controller and activity against its applicable regime rather than assuming identical consent rules.

What I can verify about the free zones’ direction of travel, all from 2025–2026:

• DIFC updated its Data Protection Regulations in 2023 to add safeguards for AI-enabled processing, and in 2026 launched Consultation Paper No. 3 of 2026 proposing further amendments to the DP Regulations: comments closed 18 July 2026.
• In January 2026, QFC, DIFC and ADGM announced mutual adequacy recognition, letting personal data flow between those centres without extra transfer safeguards. The same analysis stresses: “this update is specific to the QFC, DIFC, and ADGM, and does not change the federal UAE position for onshore entities.”
• ADGM publishes its regime as the Data Protection Regulations 2021, with detailed guidance from its Office of Data Protection.

TDRA, the sector regulators, and the older privacy laws

TDRA’s role is concrete: it manages the Do Not Call Registry (introduced September 2022 per Gulf News), coordinates enforcement of the telemarketing resolutions with licensed telecom operators, and enforces consumer-protection rules over subscriber information (DLA Piper cites Articles 24.4 and 24.9 of the TDRA Consumer Protection Regulations v2.0 on protecting subscriber data). Underlying federal statutes still in the picture include the Telecommunications Law (Federal Law No. 3 of 2003) and its TDRA policies, the Crimes and Penalties Law (Federal Law No. 31 of 2021) (DLA Piper flags Article 431 (privacy/family-life interference via recording or imaging) and Article 432 (breach of professional secrets, with fines from AED 20,000 and/or imprisonment)) and the Cybercrime Law (Federal Decree-Law No. 34 of 2021), which DLA Piper summarises around unauthorised access and data offences (Articles 2, 3, 12, 13), handled in practice by specialised police cybercrime units.

Cold email needs a sector-specific assessment. CBUAE C 3/2026 expressly covers marketing emails by licensed financial institutions. Other entities must assess applicable privacy, consumer-protection and communication rules.

Mainland vs DIFC vs ADGM at a glance

	Mainland UAE	DIFC	ADGM
Core privacy instrument	Federal Decree-Law No. 45 of 2021 (PDPL); executive regulations awaited as of latest verified reporting	DIFC Data Protection Law No. 5 of 2020 (in force 1 June 2020) plus its Data Protection Regulations, amended repeatedly	ADGM Data Protection Regulations 2021, with published guidance
Oversight	Federal framework undergoing institutional development; AI and Data Authority established June 2026; TDRA and sector regulators within their scope	DIFC Commissioner of Data Protection	ADGM Office of Data Protection
Outreach-specific rules	Cabinet Resolutions No. 56/57 of 2024: 9am–6pm, DNCR, prior approval, cadence caps: live and enforced since 27 August 2024	Same federal telemarketing resolutions reach free-zone licensees; free-zone data law governs the privacy layer	Same federal telemarketing resolutions reach free-zone licensees; free-zone regulations govern the privacy layer
Consent posture	Consent-first under PDPL Article 4; no general legitimate-interests basis; Article 17 stop-processing right for direct marketing	Direct-marketing/objection provisions exist in the DIFC regime: confirm exact current articles with counsel (not verified in this pass)	Comparable direct-marketing provisions in the 2021 Regulations: confirm exact current sections with counsel (not verified in this pass)
2025–2026 movement	Telemarketing enforcement escalated (AED 19.19m by June 2026); PDPL executive regulations still pending in early-2026 commentary	DIFC Laws Amendment Law No. 1 of 2025; Consultation Paper No. 3 of 2026 on DP Regulations (closed 18 July 2026)	Mutual adequacy recognition with DIFC and QFC announced January 2026
Cross-border data	PDPL transfer restrictions pending implementing detail	Mutual adequacy with ADGM/QFC; other transfers need current-mechanism confirmation	Mutual adequacy with DIFC/QFC; other transfers need current-mechanism confirmation

Channel-by-channel: what’s actually allowed

For CBUAE-licensed institutions and covered outsourced activities, C 3/2026 expressly includes emails and other digital channels in Article 1.30. It requires board approval, prior express consent, authorised channels, records, DNCR controls and at least 15 hours of initial telemarketer training. Article 15 restricts marketing calls to 9am–6pm and communication frequency to once daily/twice weekly, with a defined requested-follow-up exception. These are sector-specific controls, not universal cold-email permission. CBUAE rulebook.

Channel	Practical answer	Key verified constraint
Cold calling (phone)	Legal but heavily regulated	9am–6pm only; prior approval; DNCR screening; no re-pitch after rejection; company-registered local numbers (Cabinet Resolutions 56/57 of 2024)
SMS marketing	Covered by the same resolutions	Same window and cadence rules; “marketing text messages” are explicitly in scope
WhatsApp / social-app messages	In scope of the resolutions	”Marketing messages through social media applications” are explicitly covered; platform (Meta) business policies apply on top: check WhatsApp’s current Business Messaging Policy yourself, as it changes independently of UAE law
Cold email	CBUAE marketing regulation expressly covers financial institutions; other scope varies	Governed by privacy law, consumer fairness and sector rules; don’t assume a GDPR-style basis exists: treat consent or the PDPL’s narrow exceptions as your footing
Buying/scraped lists	Legally perilous	Selling/disclosing consumer personal data without consent for marketing reprocessing is prohibited by the resolutions; Authorised DNCR screening is available, but lawful sourcing remains a separate issue on bought lists; PDPL is consent-first
Personal-number calling (individuals)	Prohibited	AED 5,000 first offence plus disconnection of all your numbers, escalating to AED 50,000 and a one-year telecom ban

Does the UAE have a do-not-call list?

Yes. TDRA’s guidance updated 13 July 2026 lists both 2211 and 1012 for sending DNCR to register, with operator-supported reporting procedures. They are both official channels, not evidence of contradictory versions. TDRA guidance.

Authorised business users can upload lists for screening using du’s portal. Screening is technically possible, but does not establish lawful acquisition or marketing permission. Keep screening records and internal suppression separately.

B2B vs B2C: no “business exemption” to hide behind

B2B labelling does not resolve scope. Employee emails and direct numbers can be personal data; assess the defined telemarketing activity, customer category, controller, jurisdiction and sector requirements instead of assuming one universal channel rule.

Building a compliant outreach program: ten steps

1. Map your regimes first. Mainland licence? DIFC? ADGM? Financial services? You may sit under federal telemarketing rules, a free-zone data law, and a sector regulator simultaneously (banks, insurers and reinsurance firms now face the Central Bank’s own Telemarketing Regulation: see freshness section).
2. Get your prior approval in order. The resolutions require approval from your competent licensing authority before you practise telemarketing. Confirm what your emirate/authority requires and keep the approval on file.
3. Fix your list sourcing. No bought or scraped consumer lists. Document where every contact came from and what the person did to become contactable (enquiry, form fill, existing customer, publicly listed professional detail).
4. Screen against the DNCR, and keep a suppression list. Before every campaign, run numbers against the registry (per your operator’s current process) and against your own do-not-contact file of past objectors. When someone says stop, they stop: no same-day or next-day re-pitch.
5. Enforce the 9am–6pm window and cadence caps in your dialer and sending tools: max one call-back per day, two per week on no-answers, and never again after a rejection.
6. Script the disclosures. Identify the company and caller, state the purpose, and give recording notice at the start of the call. Caller ID must be visible and not concealed.
7. Honor objections across channels, fast. The PDPL’s Article 17 stop-processing right for direct marketing (once in force) plus the resolutions’ opt-out rules mean you need one central suppression mechanism spanning calls, SMS and messaging apps.
8. Train and document. The resolutions mandate telemarketing training; the Central Bank’s 2026 regulation sets a 15-hour minimum for financial firms. Keep attendance records, scripts and call logs: records and periodic reports are themselves a legal requirement.
9. Control your vendors. Any agency, ESP or dialer vendor acting for you inherits your obligations (and the resolution applies to licensed companies regardless of who dials). Put consent, DNCR screening, suppression sync and audit rights in writing.
10. Plan cross-border data flows deliberately. Your CRM, ESP and AI tools likely sit outside the UAE. The PDPL’s transfer rules await their implementing detail; DIFC/ADGM now benefit from mutual adequacy among Gulf financial centres. Record where data lives, and have counsel confirm the current transfer mechanism before you rely on any of it.

What changed in 2025–2026 (freshness check)

The UAE established its Artificial Intelligence and Data Authority on 14 June 2026. This institutional development does not itself establish that PDPL implementing regulations have been issued; check subsequent official guidance (UAE Cabinet).

• 31 March 2026: CBUAE Telemarketing Regulation C 3/2026 commenced, with a 90-day implementation period and express email/digital scope. Use the official rulebook.
• June 2026: enforcement hits new highs. TDRA’s cumulative numbers (AED 19.19m, 9,433 disconnections) show sustained, escalating enforcement rather than a launch spike.
• January 2026: Gulf free-zone adequacy. QFC, DIFC and ADGM mutual recognition simplifies transfers between those centres, without changing the onshore PDPL position.
• 2026: DIFC keeps amending. Consultation Paper No. 3 of 2026 proposes further DP Regulations changes (AI safety-by-design in Regulation 10, a new Regulation 11 on certification, clarity on the Autonomous Systems Officer role), following the DIFC Laws Amendment Law No. 1 of 2025 already listed on the law’s page.
• PDPL executive regulations: still the missing piece. Every source I could verify that speaks to current status (DLA Piper’s January 2025 position and early-2026 commentary) describes the executive regulations as unpublished/anticipated. UAE media also reported in 2026 the establishment of a federal authority for artificial intelligence and data, which may reshape the regulator landscape; I saw the headlines but did not verify the details, so treat that as a lead to check rather than a settled fact.
• GCC context. Saudi Arabia and Bahrain run their own data protection regimes with their own regulators and marketing-consent rules. If you sell across the GCC, each country needs its own answer: nothing in the UAE regimes travels automatically.

Common mistakes (and limits worth knowing)

1. Treating a GDPR checklist as a UAE program. The PDPL has no general legitimate-interests basis; consent (or a narrow Article 4 exception) carries the load, and the telemarketing resolutions add rules GDPR doesn’t have (time windows, call caps, prior approval).
2. Assuming “B2B = exempt.” Not verified anywhere; don’t build a strategy on it.
3. Buying or scraping lists. Authorised operator portals can DNCR-screen uploaded lists; that does not establish lawful acquisition or use, likely breaches the resolutions’ data-trading prohibition, and collapses under the PDPL’s consent-first posture.
4. Ignoring the free zones’ separate regimes, or assuming DIFC registration shields you from the federal telemarketing resolutions (the rules expressly include free-zone licensees).
5. Quoting PDPL fine figures you saw on a blog. Penalties were delegated to a Cabinet decision tied to executive regulations; circulating numbers may be premature or stale.
6. Relying on one law firm’s post without dating it. Much of the early PDPL commentary was written before 2025; this area has moved. Check publication dates and cross-read at least two sources, and prefer anything that names the resolution, circular or article number.
7. Getting the DNCR short code wrong. The two main outlets reported different codes two years apart; verify with your operator.

What to do, depending on where you sit

• Mainland, non-regulated sector: Build for the 9am–6pm, DNCR, prior-approval world now, those rules are live and enforced, while tracking PDPL executive regulations. Consent records and suppression lists are your insurance policy either way.
• In DIFC or ADGM: Confirm your direct-marketing provisions and objection mechanics with free-zone counsel (article numbers deliberately omitted here because I couldn’t verify the current consolidated text), use the new adequacy recognition for intra-Gulf transfers, and still comply with the federal telemarketing resolutions as a licensed company.
• Bank, insurer or licensed financial firm: Assume the Central Bank’s Telemarketing Regulation applies on top of everything else: explicit prior consent, board approval, 15-hour training, DNCR access. Map your gap against those specifics first.
• Selling to all of the GCC: Run this exercise per country; UAE answers don’t port to Saudi or Bahrain.
• If you want the tactical email layer: We keep a companion cold-email guide in the same library as this piece: it covers copy, deliverability and list hygiene mechanics rather than statute.

FAQ

Is cold email legal in the UAE? There is no single yes-or-no answer for every entity. Assess federal, DIFC/ADGM, consumer and sector rules. CBUAE C 3/2026 expressly regulates marketing email for covered financial institutions. Public contact information is not automatic permission; document sourcing, basis, notice and objections.

Is cold calling legal in the UAE? Yes, but only within a tight frame: 9am–6pm, prior approval from your licensing authority, calls only from numbers registered to your company licence, no calling people on the DNCR, no re-calling after a rejection (one call-back per day, two per week on no-answers), and no pressure tactics. Fines reach AED 150,000, and enforcement is active: TDRA reported AED 19.19 million in fines by June 2026.

Does the UAE have a do-not-call registry? Yes. TDRA’s July 2026 guidance lists both 2211 and 1012. Follow the operator-supported registration and reporting procedure; authorised businesses can screen through operator portals. Screening is separate from lawful sourcing and permission.

What consent does the PDPL require for marketing? Article 4 prohibits processing personal data without the Data Subject’s consent, subject to closed exceptions (contract steps, protecting the person’s own interests, data they made public, public interest, legal claims, health uses, research, other legal obligations). There is no general legitimate-interests basis. Separately, Article 17 gives individuals the right to stop processing done for direct marketing, including related profiling. Note the PDPL’s obligations only bite fully after its executive regulations and transition period, which were still awaited in the most recent reporting I could verify.

Can I buy contact lists in the UAE? I wouldn’t. The telemarketing resolutions prohibit disclosing or trading consumers’ personal data without consent for marketing reprocessing, you can’t screen a bought list against the DNCR, and the PDPL’s consent-first design leaves you with no provable basis. The enforcement numbers suggest regulators and consumers are both actively complaining.

Is WhatsApp marketing legal in the UAE? Federal definitions include marketing messages through social applications, but specific call-hour, recording and cadence provisions should not be assumed identical for WhatsApp. Assess the applicable provision, lawful data use, platform permission and consumer-protection restrictions separately.

How much can telemarketing fines reach? For companies: AED 75,000 rising to AED 150,000 for unapproved telemarketing, up to AED 150,000 for DNCR violations, and AED 10,000–150,000 for other breaches, with suspension, licence cancellation and telecom disconnection as escalation steps. Individuals: AED 5,000 first offence (with all your numbers suspended) rising to AED 50,000 plus a one-year ban. Financial firms face the Central Bank’s separate regime.

Which rules apply to me: mainland, DIFC or ADGM? Your data protection law follows your establishment: PDPL for mainland, DIFC Data Protection Law No. 5 of 2020 in DIFC, ADGM Data Protection Regulations 2021 in ADGM. But the federal telemarketing resolutions apply to licensed companies nationwide including free zones, and sector regulators (Central Bank, SCA) layer on top. Most real companies sit under two or three of these at once.

Will the PDPL be enforced against my business yet? The PDPL commenced on 2 January 2022. July 2026 legal commentary describes executive regulations as pending; verify later official developments. Pending implementation details do not mean the law has never entered into force.

Conclusion

The UAE doesn’t ban outbound marketing: it regulates it hard and enforces it in public. Call within 9am–6pm for regulated marketing calls, get your approval, screen the DNCR, honor rejections the first time, train your team, keep records, and treat every contact as consent-first. Hold your data program loosely: the PDPL’s final shape depends on regulations that were still pending in the best reporting I could verify, so build to the strictest reading and re-check status twice a year. If you’re in DIFC or ADGM, run your free-zone law and the federal telemarketing rules in parallel, and if you’re in financial services, add the Central Bank’s 2026 regulation to the stack. When the details matter to a real budget, that’s the moment to call counsel.

Sources

• DLA Piper: Data Protection Laws and Regulations, UAE (PDPL Article 4 bases, rights, enforcement timeline)
• DIFC: Data Protection Law (DIFC Law No. 5 of 2020), legal database page with enactment/commencement dates and amendment record
• DIFC: Data Protection Law DIFC Law No. 5 of 2020 (full PDF text)
• ADGM: Data Protection Regulations 2021 (consolidated PDF)
• Gulf News: New UAE telemarketing regulations effective from today: what you need to know (27 August 2024 rules explained)
• Emirates247: UAE to implement regulations and mechanisms for organizing telemarketing (full rules and penalty schedule)
• Khaleej Times: Cabinet Resolutions No 56 and 57 of 2024; Dubai fines 159 companies AED 50,000 each
• Khaleej Times: Businesses adopt focused telemarketing strategies ahead of 27 August rules
• Khaleej Times: TDRA: AED 19.19 million in fines, 9,433 numbers cut for telemarketing violations (June 2026)
• Gulf News: UAE Central Bank issues 9-to-6 rule, Circular No. 2032/2026 Telemarketing Regulation for financial institutions (April 2026)
• Zawya: DIFC announces consultation on amended Data Protection Regulations, Consultation Paper No. 3 of 2026
• JD Supra: QFC, DIFC and ADGM mutual adequacy recognition (January 2026)
• UAE federal consumer rights portal: telemarketing complaints
• Arabian Business: UAE announces telemarketing laws: AED 150,000 fines for cold-call rulebreakers, contact windows and blocking
• Arabian Business: New regulations for telemarketing calls: fines for breaking rules
• Emirates247: Dubai cracks down: 159 companies fined AED 50,000 each under new regulations (February 2025)
• Al Tamimi: An overview of the UAE federal data protection law
• UAE Government portal: Personal Data Protection Law overview page
• TDRA: official portal (consumer tools, DNCR-related services)
• Google News index: telemarketing regulation coverage (used to identify contemporaneous reporting incl. Pinsent Masons and Morgan Lewis analyses)