UAE data protection law for brokerages: what to do about client passports, WhatsApp and lead lists

Short answer: does this law apply to a Dubai brokerage?

A brokerage collects names, phone numbers, passport and Emirates ID copies, addresses and financial details. That is personal data, and the PDPL (Federal Decree-Law 45 of 2021) is the UAE's general law on it. The UAE government portal lists it among the country's data protection laws. It sets out principles: collect data for a specific, clear purpose, limit it to what is necessary, keep it secure, and control how long it is stored and who can access it.

It reportedly sits outside the financial free zones, DIFC and ADGM, which have their own data laws, so a brokerage licensed there should ask which regime applies. For a mainland Dubai brokerage, I would assume the PDPL is relevant and act accordingly.

The honest status of the law and its regulator

The law has been in force since 2 January 2022, but I could not confirm that its implementing regulations and a clear private-sector regulator have been put in place. Sources conflict, so I would not tell you either way. Check the current position with a lawyer. Two things follow.

• The PDPL itself does not set penalties, so I will not quote a fine for it. Any figure you see attached to it is a law firm's inference from other laws.
• Uncertain enforcement is not a reason to wait. The habits below create real risk now (a leaked passport copy is a problem for the client whatever the regulator does), and clients, banks and developers increasingly ask about data handling.

Which everyday habits create risk

• Passport photos in agents' WhatsApp chats and phone galleries. You cannot find, secure or delete them.
• Buyer lists reused across projects that were collected for one purpose. A list built for one launch is not automatically fair game for the next.
• Agents leaving with their contacts. The data was collected by the company, so the company is responsible for it.
• Documents on personal phones and drives with no passcode, no remote wipe and no log.
• Sending client lists or documents into AI tools without knowing where the data goes.
• Cold contact from lists of unknown origin. A related Dubai rule: Dubai Land Department (DLD, the emirate's property registry) and RERA (its Real Estate Regulatory Agency) Circular 02-2026 (26 February 2026) restricts brokerage offices from obtaining owner or investor data by unlawful means and from contacting owners directly unless they can show a documented prior transaction. It is partly confirmed, so read the circular itself and confirm with DLD.

The company, not the agent, is normally the party that decides why and how the data is used, which makes the owner the one on the hook for controls. An agent's personal phone is not a filing system. See secure document storage for a UAE brokerage for the setup.

Consent and purpose: what to record on every lead

On every lead record: where it came from (source), what the person agreed to and when (consent and its date), what you will use the data for, and how they can opt out. In your CRM (the system where you keep clients and deals), make these fields required. That gives you an answer when someone asks "how did you get my number?" and a clean way to stop contacting them. Event leads need the same fields, as shown in QR code lead capture at Dubai show units and events.

Collecting a passport for anti-money-laundering (AML) due diligence has its own legal basis in the AML rules. That is a different purpose from marketing. Do not use a passport collected for due diligence to send promotions. Keep the two purposes separate in your records. The yearly AML cycle that sits behind these files is set out in an annual AML review and compliance calendar.

Keep records without keeping everything forever

Here is the apparent conflict. The AML rules say keep records. Data protection principles say keep personal data only as long as the purpose needs. Resolve it by deciding each category in advance, taking the period from the sector rule, not from the PDPL:

• AML and transaction records: under the UAE anti-money-laundering rules, brokers must keep customer due diligence and transaction records, including business correspondence and customer communications, for at least five years, counted from the latest of the end of the client relationship, the completed transaction, an inspection, an investigation or a final court judgment. This is a federal AML duty (Cabinet Resolution 134 of 2025, Art. 25, and the Ministry of Economy and Tourism's guidelines for DNFBPs, the designated non-financial businesses and professions that include brokers, section 11), not a DLD or RERA chat rule. The law does not name WhatsApp, so client messages tied to a deal are likely to count as business correspondence, which is an interpretation.
• Everything else (a lead who never became a client, a casual photo of an ID, a viewing request): I found no official retention period. Set a period you can justify, write it down and delete on schedule.

I could not find ID-specific retention rules under the PDPL. After the AML period ends, delete or archive under your data policy, and ask a lawyer to confirm.

What changes when agents leave

Revoke access, move the files into company space, delete personal copies with written confirmation, reassign leads, and put in the agent agreement that client data belongs to the brokerage. The full runbook is in the document storage article linked above.

Using AI and cloud tools with client data

Sending client data to an AI vendor or a cloud service raises questions about where the data is stored (cross-border transfer) and whether the vendor is a processor acting on your instructions. Practical steps: use business plans with clear terms on data use, get a data processing agreement where the vendor will sign one, strip names and ID numbers before pasting anything you do not need to share, and do not use free consumer tools for client documents. For a practical guide see whether it is safe to upload client documents to an AI tool. And see AI limits and consent risks for UAE real estate teams.

How software helps with data protection: one store, consent fields, access logs, deletion rules

Concrete tasks:

• One central store for documents, with upload links so clients do not use chat.
• Consent and source fields on every lead, required before an agent can message.
• Do-not-contact flag that blocks sending to opted-out people.
• Role-based access and an activity log that shows who opened a file.
• Retention dates on records, with a report of files due for deletion or review.
• Finding duplicates and merging them, so one request to delete covers every copy.

What stays human: deciding the purpose, setting the retention periods, answering a client's request, deciding whether an incident is reportable and talking to a lawyer. I build consent and retention fields into brokerage CRMs as custom work. A configured CRM does a good part of it already.

Try it yourself with Claude (an AI assistant). Describe your data habits with no real client data, for example: "Our 15 agents keep client passports in WhatsApp, reuse buyer lists between projects and use their own phones." Ask: "Write a one-page data handling policy for a small UAE real estate brokerage covering where documents live, consent on leads, retention and what happens when an agent leaves, in plain words. Mark every point a lawyer should check." Have a lawyer review it before adopting.

Telemarketing is a separate rule

Do not confuse the PDPL with the UAE telemarketing rules. Cabinet Resolution 56 of 2024 defines telemarketing to include marketing text messages and marketing messages sent through social media apps, not only calls, and applies to every licensed company, free zones included. Marketing calls are limited to 9am to 6pm, and you must not call numbers on the national Do Not Connect Register. The telecoms regulator TDRA's own guidance for marketing text messages requires prior explicit consent, a free unsubscribe option in every message and sending only between 07:00 and 21:00. Because the definition covers marketing messages on social apps, WhatsApp marketing should go only to people who have asked for it or opted in and always offer a way to stop. The Resolution does not name WhatsApp, and I would not assume the 9am to 6pm call window applies to every WhatsApp message, so ask a lawyer how it applies to yours. For the tooling side see cold calling rules and tools and WhatsApp broadcast tools.

What to do this month, and when to ask a lawyer

1. List where client passports and contracts sit today, including phones.
2. Create one company-owned store and move documents there.
3. Add source and consent fields to the CRM and make them required.
4. Write a one-page retention table: AML records five years minimum, other categories your own period.
5. Write the agent exit checklist into agent contracts.
6. Check what AI and cloud tools staff already use with client data.
7. Ask a lawyer: does the PDPL apply to us, what is the current regulatory position, and what do we do if a passport copy leaks.

How I'd approach this

I would not wait for the regulations. The controls above cost little, match what banks and developers expect, and fit the AML duty you already have. Start with where documents live and what a lead record shows about consent. Then fix retention and exits. Treat my summary of the law as a starting point only, and rely on a lawyer for anything specific to your brokerage.