UAE PDPL app consent, screen by screen: permissions, rights and Arabic text

I separate these on paper first, because teams often treat the iOS alert as the legal consent. The alert opens a phone capability; the PDPL asks whether you may process personal data for a purpose.

Your lawyer decides each basis. My job is to give every row a home on a screen.

The PDPL took effect on 2 January 2022. The UAE government portal's data protection page sums it up: processing personal data without the owner's consent is prohibited, with exceptions, and people can ask for corrections and for processing to be restricted or stopped. Article by article, this is what reaches the screen:

• Article 4: consent is the default, unless an exception applies, such as performing a contract with the person.
• Article 6: consent must hold up. You must be able to prove it, it must be clear, and withdrawing it must be easy, at any time.
• Article 13(2): tell people first. Before processing, say what the purposes are, who receives the data inside and outside the UAE, and how it is protected abroad.
• Articles 14 to 18: the rights screens. A portable copy, correction and erasure, restriction, objection to direct marketing, and objection to automated decisions, with human review on request.
• Article 19: ways to reach you about those rights.

Article 2 excludes government data, health and banking data covered by their own laws, and free zones with their own data protection law. Health needs care: the same portal page says Federal Law No. 2 of 2019 on ICT in health fields applies in the free zones too.

The law: the PDPL itself, since 2 January 2022. Newer, for children: on 26 December 2025 the Emirates News Agency reported a federal decree-law on child digital safety, covering apps, games, social media and e-commerce aimed at UAE users. It bars platforms from collecting or processing the personal data of children under 13 except under specific conditions, and lists default privacy settings, age verification and rules on targeted ads among their duties.

The regulator has changed. The PDPL names the UAE Data Office. On 14 June 2026, WAM reported the new Artificial Intelligence and Data Authority, reporting to the Cabinet and taking over the functions of the UAE Data Office, the AI Office and TDRA's digital government sector.

Still missing: the executive regulations and penalties. Article 28 asked for regulations within six months, Article 26 leaves penalties to a Cabinet decision, and Article 29 gives firms six months to comply once regulations are issued. I found neither on any official source I could open, and the portal page above mentions none. Some vendor blogs say they were issued, but none I read cited an Official Gazette issue.

My reading: design to the law now; regulations are unlikely to loosen consent, notice or withdrawal.

My UAE PASS sign-in and account linking guide compares the regimes on breaches and fines; here is what each changes on screen.

The DIFC Data Protection Law, consolidated in July 2025, is the strictest on records. Article 12(9) asks controllers to show the Commissioner of Data Protection how consents and withdrawals are recorded, and Article 12(8) treats consent as withdrawn if someone asked to re-affirm doesn't. For DIFC clients I add a yearly "still happy with these choices?" sheet to the backlog.

The DIFC Data Protection Regulations, in force since 1 September 2023, add Regulation 10: an app using an autonomous or semi-autonomous system on personal data must give clear notice on first use.

The ADGM Office of Data Protection publishes a guide to lawful bases (May 2025). A tick box agreeing to processing "as described in the privacy policy" is not specific. Consent must name the controller, the purposes and the right to withdraw, and explicit consent for health data must be confirmed in words.

This is the screen I draw first, in both languages together, because every later notice borrows its words.

Two details catch teams out: switches mirror in Arabic, so "off" sits on the right, and the footer's version number is how you prove, years later, which words someone agreed to.

Apple's App Review Guidelines, updated 8 June 2026. Guideline 5.1.1(ii) wants consent even for data you consider anonymous, plus an easy way to withdraw it. 5.1.2(i) requires clear disclosure and explicit permission before sharing with third parties, including third-party AI, and bans requiring notifications, location or tracking to use the app.

Apple's User Privacy and Data Use page says you need App Tracking Transparency (ATT) permission to track people or read the advertising identifier. Two lines shape my UAE flows: always respect the ATT answer even if another prompt's answer conflicts, and don't show the ATT prompt to people who opted out of all relevant legal consent choices.

So the order is fixed: your consent screen first, then the ATT alert only if the ads switch went on. Apple's Human Interface Guidelines on privacy allow a consent screen before or after the alert to comply with local privacy laws, and forbid incentives, look-alike screens, pictures of the alert and anything pointing at its Allow button.

Plan for one answer. Apple's documentation for the tracking request describes a re-prompt after a year only in the European Union. Android's guide to runtime permissions says that after someone taps Deny more than once, the dialog stops appearing. My app store rejection checklist covers pre-alert screens and purpose strings; here is the order I use.

Android's notification permission guide suggests letting people get familiar with the app first, so I ask after the first order.

Google's Data safety guidance says every app on Play completes the form, even one that collects nothing: what is collected and shared, why, whether it's optional, and whether people can ask for deletion, SDKs included. Apple's App privacy details cover partners' code too, and make you responsible for keeping answers accurate.

Google's User Data policy reaches the screen itself. Where data use might surprise people, the disclosure sits in the app during normal use, immediately before the consent request. Consent needs an affirmative action; tapping away or an auto-dismissing message doesn't count.

I keep one data map in the design file: each data type, its purpose, the SDK that touches it, its consent switch and the store label line it produces. When a developer adds an SDK, the map changes first.

Consent text is where translation errors cost the most. My rules:

1. One text, one version. Arabic and English are written and approved together and share a version number; if one changes, both versions move.
2. Log the language. The record stores the version, the language shown, each choice and the time.
3. Write Arabic, don't translate legal English. Short sentences, plain verbs such as نستخدم (we use) and نشارك (we share), and one word for consent throughout: موافقة. A native reader on your side signs off.
4. Localise system strings too. Purpose strings belong in your Arabic localisation files, as Apple's brief, complete sentences.
5. Mirror with care. Switches and chevrons flip; version numbers, phone numbers and emails stay left to right. My RTL design rules for Arabic apps cover the details.

The PDPL was issued in Arabic, and the English on the legislation portal is a translation. Ask your lawyer to approve the Arabic consent text, not only the English.

Withdrawal must be easy, so the privacy centre sits one tap from the profile. Mine has five rows: my choices (the onboarding switches, with dates), download my data, correct my details, object to marketing or automated decisions, and delete my account. Apple's guideline 5.1.1(v) and Google's policy both require in-app account deletion, and Google also wants a web link.

DIFC's Article 40 sets a floor I like everywhere: two ways to make a request, one free on the website with no account. And where the app decides automatically, such as an instant credit limit, the result screen says how to ask a person to review it (PDPL Article 18).

This is how I plan consent into Dubai app builds, from the first call to the store forms.

1. Ask where you are licensed in the intro call, and whether health or banking rules apply.
2. Draw the data map with every data type, purpose, SDK and legal basis, agreed with your lawyer.
3. Design the consent screen in Arabic and English, one switch per purpose, all off.
4. Place each system alert where its feature needs it, ATT after your own screen.
5. Design the privacy centre with withdrawal, rights requests and deletion.
6. Fill in the store labels from the data map and check them against the build.
7. Log consent and test that withdrawal really stops the SDKs.

Start with the data map, not the banner: once every data type has a purpose and a home on a screen, the consent screen almost writes itself. Still choosing a stack? See Flutter or React Native for Arabic apps.

I settle consent in the first sprint, alongside sign-in and payments, as part of my mobile app design from first flow to store release. I work remotely, two hours ahead of Dubai; read more about me. A project starts with a free 30 minute intro call, then a written scope and one fixed quote. Planning an app for the Emirates? See my app design and build work for Dubai teams.

Does the UAE PDPL require consent for every app?

No. Consent is the default basis, but Article 4 lists exceptions, such as processing needed to perform a contract with the person. Sign-in and order data usually rest on that, while marketing, analytics SDKs and advertising usually need consent. Your lawyer sets the basis for each use; the design job is to explain service data plainly and ask only for optional uses.

Is the iOS permission pop-up enough for PDPL consent?

No. The system alert grants access to a capability such as the camera or location. It doesn't name your company, list your purposes or say where data goes, which Article 13(2) expects before processing. Use your own consent screen for the legal choices, and keep the system alert for the moment the feature is used.

Have the PDPL executive regulations been issued?

Not as far as I could confirm on 13 October 2026. Article 28 asked for them within six months, and Article 26 leaves penalties to a Cabinet decision, but I found neither on an official UAE source I could open. Some vendor articles claim otherwise without citing the Official Gazette. Design to the law as it stands.

Does the PDPL apply to an app licensed in DIFC or ADGM?

Generally not. Article 2 excludes free zones with their own data protection law, so DIFC firms follow DIFC Law No. 5 of 2020 and ADGM firms the ADGM Data Protection Regulations 2021. Health data can still fall under federal health law, which the government portal says applies in the free zones too.

Can a UAE app refuse service if users decline tracking?

Not on iOS. Apple's guideline 5.1.2(i) forbids gating features on tracking or rewarding people for allowing it, and apps may not require notifications, location or tracking to work. Under the PDPL, consent must be clear and withdrawable at any time, so tying the whole service to optional consent is risky there too.

Do consent screens need to be in Arabic in the UAE?

For consumer apps, plan on it. Arabic is the official language, the PDPL itself was issued in Arabic, and many UAE users read Arabic first. Write both versions together under one version number, log which language each person saw, and have a native Arabic reader approve the text before release.

The UAE legislation portal blocked my connection, so PDPL article numbers come from its official English translation as I read it on 4 October 2026, checked against the government portal's summary. I found no official source for the executive regulations or penalties.

• UAE Government portal, data protection laws, updated 4 December 2025, read 13 October 2026: u.ae
• UAE Legislation, Federal Decree-Law No. 45 of 2021, official English translation, read 4 October 2026: uaelegislation.gov.ae
• Emirates News Agency, Artificial Intelligence and Data Authority, 14 June 2026, read 13 October 2026: wam.ae
• Emirates News Agency, decree-law on child digital safety, 26 December 2025, read 13 October 2026: wam.ae
• DIFC, Data Protection Law No. 5 of 2020, consolidated July 2025, read 13 October 2026: difc.com
• DIFC, Commissioner of Data Protection, read 13 October 2026: difc.com
• DIFC, Data Protection Regulations, in force 1 September 2023, read 13 October 2026: assets.difc.com
• ADGM, Office of Data Protection, read 13 October 2026: adgm.com
• ADGM Office of Data Protection, lawful bases for processing, May 2025, read 13 October 2026: assets.adgm.com
• Apple, App Review Guidelines, updated 8 June 2026, read 13 October 2026: developer.apple.com
• Apple, User Privacy and Data Use, read 13 October 2026: developer.apple.com
• Apple, Human Interface Guidelines, privacy, read 13 October 2026: developer.apple.com
• Apple, requestTrackingAuthorization, read 13 October 2026: developer.apple.com
• Apple, App privacy details, read 13 October 2026: developer.apple.com
• Google Play Console Help, Data safety section, read 13 October 2026: support.google.com
• Google Play Console Help, User Data policy, read 13 October 2026: support.google.com
• Android Developers, request runtime permissions, read 13 October 2026: developer.android.com
• Android Developers, notification runtime permission, read 13 October 2026: developer.android.com