AutoSmart GuidebooksWhat this guidebook covers
The UAE telemarketing rules (August 2024) are already enforced: marketing calls only from 9am to 6pm, from registered numbers, respecting the Do Not Call Register, with fines up to AED 150,000. The PDPL is law, but its fines await executive regulations, after which businesses get just 6 months to comply.
This guidebook covers the 5 data standards to act on now, with 14 checkpoints: telemarketing rules, consent and lawful basis, customer rights, security and breach reporting, and the free-zone data laws (DIFC and ADGM).
The 5 data protection standards
Open a standard to see the law behind it, what is checked, what it can cost and the evidence. Ideal fix times are counted from audit submission.
DP-01Telemarketing rules followed72 hours
- The law
- Federal Decree-Law No. 45 of 2021 (PDPL) · Cabinet Resolution No. 56 of 2024 (Telemarketing) · Cabinet Resolution 56/2024 telemarketing: approved numbers, 9am-6pm, Do Not Call Register, recorded calls
- What we check
- Sales and service marketing calls are made only between 9am and 6pm, from registered local numbers, never to numbers on the Do Not Call Register, and calls are recorded.
- What it can cost
- Up to AED 150,000, plus suspension of marketing activity.
- Evidence
- Call logs
DP-02Consent and lawful basis30 days
- The law
- Federal Decree-Law No. 45 of 2021 (PDPL) · Cabinet Resolution No. 56 of 2024 (Telemarketing) · PDPL consent and lawful processing
- What we check
- Customer data is collected with clear consent or another lawful basis, and customers are told what's collected, why, and who it's shared with (agent, lenders, insurers).
- What it can cost
- Fines will be set by Cabinet decision. Poor consent also drives telemarketing fines today.
- Evidence
- Forms + processing record
DP-03Customer rights30 days
- The law
- Federal Decree-Law No. 45 of 2021 (PDPL) · Cabinet Resolution No. 56 of 2024 (Telemarketing) · PDPL rights of access, correction, deletion and objection
- What we check
- Customers can ask for their data, have it corrected or deleted, and object to marketing, and the dealer responds promptly.
- What it can cost
- Unanswered requests become complaints to the Data Office.
- Evidence
- Request log
DP-04Security and breach reporting24 hours
- The law
- Federal Decree-Law No. 45 of 2021 (PDPL) · Cabinet Resolution No. 56 of 2024 (Telemarketing) · PDPL data security and breach notification
- What we check
- Customer data (Emirates IDs, licences, bank details) is protected by access control and secure storage, and breaches are reported to the Data Office and affected customers.
- What it can cost
- A breach will bring Data Office action and customer claims.
- Evidence
- Photos + settings
DP-05Free-zone data laws30 days
- The law
- Federal Decree-Law No. 45 of 2021 (PDPL) · Cabinet Resolution No. 56 of 2024 (Telemarketing) · DIFC Data Protection Law 2020 · ADGM Data Protection Regulations 2021 (fines already in force)
- What we check
- Any entity in DIFC or ADGM (e.g., a regional office or finance arm) follows the free zone's own data law, including registration and fees.
- What it can cost
- DIFC and ADGM fines apply now, without waiting for the federal regulations.
- Evidence
- Entity map
How to run a UAE data protection and telemarketing audit, step by step
- Confirm what applies. Map the sales calls, CRM, deal files and group entities, including any in the DIFC or ADGM, where data laws are already in force.
- Walk the site, standard by standard. Score each of the 14 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Check call logs against the permitted hours and the Do Not Call Register, and sample consent records in the CRM.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: call logs, registered caller numbers, consent records and how ID copies are stored.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from 24 hours to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Dealer principals and GMs
- Sales and CRM managers
- Auditors
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
