ecommerce website design in dubai

Ecommerce Website Design in Dubai: Legal Rules You Need

If you're planning ecommerce website design in Dubai, the look-and-feel is the smallest of your problems. The legal scaffolding behind the cart, the checkout, the data capture, and the refund policy is what regulators actually care about. Get those wrong and your store gets blocked, not just unranked.

Quick answer

Ecommerce website design in Dubai must comply with Federal Decree-Law No. 14 of 2023 on Modern Technology Trade, Consumer Protection Law (Federal Law No. 15 of 2020), the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and TDRA's electronic transactions rules. Practically, that means a valid e-commerce trade licence (DED or a free zone), clear price/VAT display, a published refund policy, a privacy notice with consent for cookies and marketing, and a registered .ae domain if you target UAE consumers. SSL is effectively mandatory.

You need a licence before the site goes live

A pretty Shopify build means nothing without a trade licence covering electronic commerce. Dubai Economy and Tourism issues the standard e-commerce licence; DMCC, IFZA, Meydan and others offer free-zone equivalents. Fees in 2024 sat roughly between AED 5,500 and AED 12,500 depending on the activity code and zone.

The activity code matters. "Portal" lets you run a marketplace. "Electronic commerce" lets you sell your own goods. Pick the wrong one and the licence renewal gets messy.

If you sell regulated goods — cosmetics, food, supplements, electronics, medical devices — you also need product approvals from the relevant authority (Dubai Municipality, MOHAP, or ESMA/MoIAT). The website cannot legally display those products until the approvals are in hand.

Honestly, most founders skip the activity-code question and regret it 11 months later at renewal.

What the law actually requires on the site itself

Federal Decree-Law No. 14 of 2023 on Modern Technology Trade ^[1] sets specific disclosure rules for any ecommerce website design in Dubai targeting UAE buyers. The site must show:

• Full legal name of the seller and licence number
• Physical address in the UAE
• A working contact channel (email plus phone or chat)
• Total price including VAT (5%) before checkout
• Delivery costs and timelines
• Return, refund and cancellation terms
• The language of the contract (Arabic must be available on request)

The Consumer Protection Law (Federal Law No. 15 of 2020) ^[2] and its Executive Regulations require that the refund policy be conspicuous — not buried three clicks deep in a footer. Defective goods get a 30-day return window by default. You can offer longer. You cannot offer shorter and call it final.

Most Dubai ecommerce sites I've reviewed get the price-display rule wrong. VAT-inclusive pricing is not optional for B2C. Showing AED 199 then adding VAT at checkout is a Federal Tax Authority issue, not just a UX choice.

Watch out: Cash on delivery still dominates UAE ecommerce. If your checkout offers COD, the consumer's right to inspect and refuse on delivery is statutory. Your courier contract needs to handle the reverse logistics — or you eat the cost.

Data, cookies and the PDPL question

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 ^[3], applies to almost every ecommerce site processing UAE resident data. The site needs a privacy notice in plain language covering: what you collect, why, who you share it with, retention periods, and how users exercise rights (access, correction, deletion, objection).

Cookie banners are not a formality. Non-essential cookies — analytics, marketing pixels, retargeting — require consent before they fire. A passive "by using this site you agree" line does not meet the standard. The banner needs a real reject option.

If you process card payments directly, PCI-DSS compliance is a contractual requirement from your payment gateway (Network International, Telr, Stripe UAE, Checkout.com). Most Dubai stores route to a hosted gateway page to keep card data off their own servers. Smart move.

Marketing emails and SMS sit under TDRA's anti-spam rules and the PDPL consent requirement. Pre-ticked boxes don't count as consent. Neither does "you bought from us once in 2022".

Domain, hosting and the .ae question

You don't legally need a .ae domain to sell into the UAE. You do need one if you want to register with certain regulators, accept some local payment methods cleanly, or rank for local searches. .ae registration runs through accredited registrars under the .aeDA, and you'll need a trade licence to register a commercial .ae name.

Hosting location is a softer question. PDPL allows cross-border data transfer to jurisdictions with adequate protection, or with specific safeguards. Hosting in the UAE (AWS Bahrain region, G42, Etisalat) sidesteps the question. Hosting in the EU is usually fine. Hosting in the US needs a documented transfer mechanism.

SSL/TLS is effectively mandatory. Not because a statute names it, but because TDRA expects secure transmission of personal and payment data, and modern browsers flag non-HTTPS checkout as unsafe. No customer completes a card payment on a "Not secure" page.

Accessibility, language and the small print

Arabic content is not strictly required for every page, but the contract — terms of sale, refund policy, privacy notice — must be available in Arabic if a consumer requests it. Government-facing ecommerce (anything selling to UAE federal entities) requires Arabic by default.

Accessibility follows the UAE's Federal Law No. 29 of 2006 on the Rights of People of Determination and the National Policy for Empowering People of Determination. For private ecommerce, this is currently best-practice rather than enforced — WCAG 2.1 AA is the benchmark most agencies build to.

Terms and conditions need a governing-law clause and a dispute-resolution clause. Default to UAE law and Dubai Courts (or DIFC Courts if you have a DIFC nexus). A "California law and AAA arbitration" clause copied from a US template is unenforceable here and will get laughed out of a Consumer Protection complaint.

One last thing. The Dubai Department of Economy and Tourism actively monitors ecommerce websites for licence display, price transparency and refund-policy compliance. Mystery shoppers are real. Fines start at AED 5,000 and escalate fast for repeat issues.

For the broader regulatory picture on selling to UAE consumers, see our consumer protection guides.

Sources

^[1] Federal Decree-Law No. 14 of 2023 on Modern Technology Trade — UAE Ministry of Justice, https://moj.gov.ae

^[2] Federal Law No. 15 of 2020 on Consumer Protection and Cabinet Decision No. 66 of 2023 (Executive Regulations) — Ministry of Economy, https://moec.gov.ae

^[3] Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — UAE Data Office, https://u.ae

^[4] Dubai Department of Economy and Tourism — E-commerce licensing, https://ded.