Last review date: 18 December 2024
No. Under the PDPL, a data subject’s consent must first be obtained before a controller can engage in any processing, including direct marketing activities via calling, e-mailing, or texting consumers. This position is echoed in the UAE's Consumer Protection Law. Under the PDPL, there is no alternative legal basis that can be relied upon to serve marketing, even where an existing relationship exists with the customer. As well as the right to withdraw their consent at any time, the PDPL provides data subjects with an express right to object to and suspend any processing of their personal data carried out for direct marketing purposes. However, the Consumer Protection Law establishes the default position that companies are not permitted to use consumer personal data for promotion and marketing purposes without prior obtaining the consumer's consent. Telemarketing Regulations issued in 2024 (Cabinet Decision No. 56 of 2024) created new obligations for all companies involved in telemarketing, including obligations aimed at safeguarding consumer privacy.
☒ email marketing
☒ prior opt-in consent
☒ telephone marketing
☒ prior opt-in consent
☒ SMS/text message marketing
☒ prior opt-in consent
☒ postal marketing
☒ prior opt-in consent
☒ online behavioral advertising targeting//social media targeting/ad personalization marketing
☒ prior opt-in consent