Short answer: To make your website compliant with data protection laws in Saudi Arabia, Egypt and the UAE, collect only the data you actually need, get clear consent before loading tracking and advertising tools, publish a privacy policy that explains what you collect and why, let customers access, correct or delete their data, secure that data technically, and know where it is stored.
This is no longer optional. Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since September 2024, and Egypt issued the Executive Regulations of Law No. 151 of 2020 in November 2025, giving organisations one year to bring their processing into line. This guide explains what that means for your business website or online store in practice.
Which laws apply to your website?
| Country | Law | Regulator |
|---|---|---|
| Saudi Arabia | Personal Data Protection Law and its implementing regulations | Saudi Data & AI Authority (SDAIA) |
| Egypt | Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Ministerial Decree No. 816 of 2025) | Personal Data Protection Center |
| UAE | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data | UAE Data Office |
Keep in mind that these laws look at where the data subject is, not only where your company is registered. If your website takes enquiries from customers in Saudi Arabia or Egypt, that country's law will usually apply to you even if your company is based elsewhere.
The personal data your website collects without you noticing
Many companies assume they don't collect data because they don't sell online. In reality, their website collects every day:
- Form data: names, phone numbers and emails from contact and quote forms.
- Cookies: from Google Analytics, the Meta and TikTok pixels, and heatmap tools.
- IP addresses and device data: in server logs and security tools.
- WhatsApp and chatbot conversations: and whatever is passed on to your CRM.
- Account, order and payment data: in stores and platforms.
8 practical requirements for a compliant website
1. A real cookie consent banner
A strip that says "we use cookies" is not enough. Valid consent blocks analytics and advertising tools until the visitor agrees, makes rejecting as easy as accepting, and keeps a record of the choice. You can connect it to Google Consent Mode so you don't lose all ad measurement when visitors decline.
2. A privacy policy written for your website
A privacy policy copied from another site won't protect you. It should list the data you actually collect, why, the legal basis, who you share it with (shipping, payment and advertising providers), how long you keep it, and how customers can contact you about it. Publish it in both Arabic and English if your site is bilingual.
3. Forms that collect the minimum
For every field, ask: do I need this to deliver the service? Remove what you don't need, add a short note next to the submit button explaining how the data will be used with a link to the privacy policy, and keep marketing consent separate. Never pre-tick a marketing opt-in box.
4. A process for data subject requests
Customers have the right to access, correct or delete their data and to withdraw consent. Set up a dedicated email or form, plus an internal procedure so your team knows where a customer's data sits across the website, CRM and WhatsApp and can respond properly.
5. Security that matches the sensitivity of the data
A valid SSL certificate and correct https setup are only the starting point. Add regular updates, limited admin permissions, two-factor authentication for admins, encrypted backups, and protection against form spam and injection. See our guide to secure API integrations for connecting your site to other systems safely.
6. Knowing where data is stored and who processes it
Your hosting, email, analytics and CRM providers may be outside the country, and all three laws restrict cross-border transfers. In Egypt, for example, the Executive Regulations require a licence or permit from the Data Protection Center before transferring personal data abroad in many cases. List every provider that touches customer data and where its servers are.
7. A breach response plan
These laws require you to notify the regulator promptly when a breach affects personal data. Decide now who is responsible, how a breach is detected and documented, and how the regulator and affected customers will be informed.
8. Extra care for sensitive data and children's data
Clinic, school and health app websites handle sensitive data that needs explicit consent and stronger protection. Learning platforms must also take care with data about minors and obtain parental consent.
Quick compliance checklist
- No analytics or pixels load before the visitor consents.
- A "Reject" button that is as visible as "Accept".
- An up-to-date privacy policy that names your real tools, linked in the footer and next to every form.
- No unnecessary form fields.
- Separate, unticked marketing consent.
- A clear way for customers to request deletion.
- https on every page, regular updates and 2FA on the admin panel.
- A list of service providers and data storage locations.
Common mistakes we see on business websites
- Meta and TikTok pixels firing as soon as the page opens, before any consent.
- A generic privacy policy that never mentions WhatsApp, the CRM or shipping companies.
- Form submissions emailed in plain text to an employee's personal inbox.
- Customer lists exported to Excel files passed around the team with no controls.
- Outdated WordPress plugins left in place as an open door for data leaks.
How DevLabico can help
We audit your website or store to see what data and tracking tools it really uses, then implement a cookie consent banner connected to your measurement tools, rebuild forms around minimum data, secure your admin panel and hosting, and set up a data request process linked to your CRM. For the final legal wording of your privacy policy, we recommend a review by a qualified legal adviser. Contact us to review your website.
FAQ
Does data protection law apply to a small company website?
Usually, yes. The laws don't exempt small companies because of their size; any website that collects a name and phone number through a contact form is processing personal data.
Do I need a cookie banner if I only use Google Analytics?
Yes. Analytics tools set cookies and collect visitor identifiers, so you need consent before loading them.
Can I just copy a ready-made privacy policy?
No. The policy must describe what your website actually collects and who it is shared with, otherwise it doesn't provide the transparency the law requires.
What if my website is hosted outside Saudi Arabia or Egypt?
That doesn't stop you operating, but it means you are transferring data abroad, so you need to check the conditions the applicable law sets for transfers and mention them in your privacy policy.
Note: this guide is technical guidance and is not a substitute for legal advice on your company's specific situation.
