Ecommerce Website Rules in Dubai: Licence, VAT, Privacy

Ecommerce Website Design in Dubai: Legal Rules You Need

If you're planning ecommerce website design in Dubai, the look-and-feel is the smallest of your problems. The legal scaffolding behind the cart, the checkout, the data capture, and the refund policy is what regulators actually care about. Get those wrong and your store gets blocked, not just unranked.

Quick answer

Ecommerce website design in Dubai must comply with Federal Decree-Law No. 14 of 2023 on Modern Technology Trade, Consumer Protection Law (Federal Law No. 15 of 2020), the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and TDRA's electronic transactions rules. Practically, that means a valid e-commerce trade licence (DED or a free zone), clear price/VAT display, a published refund policy, a privacy notice with consent for cookies and marketing, and a registered .ae domain if you target UAE consumers. SSL is effectively mandatory.

You need a licence before the site goes live

A pretty Shopify build means nothing without a trade licence covering electronic commerce. Dubai Economy and Tourism issues the standard e-commerce licence; DMCC, IFZA, Meydan and others offer free-zone equivalents. Fees in 2024 sat roughly between AED 5,500 and AED 12,500 depending on the activity code and zone.

The activity code matters. "Portal" lets you run a marketplace. "Electronic commerce" lets you sell your own goods. Pick the wrong one and the licence renewal gets messy.

If you sell regulated goods — cosmetics, food, supplements, electronics, medical devices — you also need product approvals from the relevant authority (Dubai Municipality, MOHAP, or ESMA/MoIAT). The website cannot legally display those products until the approvals are in hand.

Honestly, most founders skip the activity-code question and regret it 11 months later at renewal.

What the law actually requires on the site itself

Federal Decree-Law No. 14 of 2023 on Modern Technology Trade ^[1] sets specific disclosure rules for any ecommerce website design in Dubai targeting UAE buyers. The site must show:

• Full legal name of the seller and licence number
• Physical address in the UAE
• A working contact channel (email plus phone or chat)
• Total price including VAT (5%) before checkout
• Delivery costs and timelines
• Return, refund and cancellation terms
• The language of the contract (Arabic must be available on request)

The Consumer Protection Law (Federal Law No. 15 of 2020) ^[2] and its Executive Regulations require that the refund policy be conspicuous — not buried three clicks deep in a footer. Defective goods get a 30-day return window by default. You can offer longer. You cannot offer shorter and call it final.

Most ecommerce web design Dubai teams get the price-display rule wrong. VAT-inclusive pricing is not optional for B2C. Showing AED 199 then adding VAT at checkout is a Federal Tax Authority issue, not just a UX choice.

Watch out: Cash on delivery still dominates UAE ecommerce. If your checkout offers COD, the consumer's right to inspect and refuse on delivery is statutory. Your courier contract needs to handle the reverse logistics — or you eat the cost.

Data, cookies and the PDPL question

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 ^[3], applies to almost every ecommerce site processing UAE resident data. The site needs a privacy notice in plain language covering: what you collect, why, who you share it with, retention periods, and how users exercise rights (access, correction, deletion, objection).

Cookie banners are not a formality. Non-essential cookies — analytics, marketing pixels, retargeting — require consent before they fire. A passive "by using this site you agree" line does not meet the standard. The banner needs a real reject option.

If you process card payments directly, PCI-DSS compliance is a contractual requirement from your payment gateway (Network International, Telr, Stripe UAE, Checkout.com). Most Dubai stores route to a hosted gateway page to keep card data off their own servers. Smart move.

Marketing emails and SMS sit under TDRA's anti-spam rules and the PDPL consent requirement. Pre-ticked boxes don't count as consent. Neither does "you bought from us once in 2022".

What separates ecommerce web design Dubai from ecommerce web development Dubai

People use the terms interchangeably. They're not the same, and the legal risk sits mostly in one of them.

Ecommerce web design Dubai covers layout, wireframes, brand system, product photography, checkout flow. Ecommerce web development Dubai (or ecommerce website development in Dubai, same thing) covers the code — payment gateway integration, PDPL-compliant consent logic, tax calculation, inventory sync, VAT invoice generation.

The disclosure obligations under Federal Decree-Law No. 14 of 2023 land on the development side more than the design side. Your designer draws a "reject cookies" button. Your developer has to make sure the tracking scripts actually don't fire until consent is captured. Frankly, the second half is where most Dubai stores fail an audit.

When you sign an agency contract, check what's actually included. "Ecommerce website design Dubai" quoted at AED 8,000 is usually a Shopify theme swap. "Ecommerce website development Dubai" quoted at AED 45,000 should include gateway integration, PDPL consent architecture, VAT-compliant invoicing, and Arabic content structure. Two very different scopes. Two very different licences on the hook.

Domain, hosting and the .ae question

You don't legally need a .ae domain to sell into the UAE. You do need one if you want to register with certain regulators, accept some local payment methods cleanly, or rank for local searches. .ae registration runs through accredited registrars under the .aeDA, and you'll need a trade licence to register a commercial .ae name.

Hosting location is a softer question. PDPL allows cross-border data transfer to jurisdictions with adequate protection, or with specific safeguards. Hosting in the UAE (AWS Bahrain region, G42, Etisalat) sidesteps the question. Hosting in the EU is usually fine. Hosting in the US needs a documented transfer mechanism.

SSL/TLS is effectively mandatory. Not because a statute names it, but because TDRA expects secure transmission of personal and payment data, and modern browsers flag non-HTTPS checkout as unsafe. No customer completes a card payment on a "Not secure" page.

Accessibility, language and the small print

Arabic is not optional for the consumer-facing legal layer: Article 26 of the Consumer Protection Law (Federal Law No. 15 of 2020) requires consumer data, advertising and contracts — so your terms of sale, refund policy and product information — to be in Arabic, with other languages permitted alongside it. ^[2] Government-facing ecommerce (anything selling to UAE federal entities) requires Arabic by default.

Accessibility follows the UAE's Federal Law No. 29 of 2006 on the Rights of People of Determination and the National Policy for Empowering People of Determination. For private ecommerce, this is currently best-practice rather than enforced — WCAG 2.1 AA is the benchmark most agencies build to.

Terms and conditions need a governing-law clause and a dispute-resolution clause.

Under UAE Consumer Protection Law ^[2], Article 21 prohibits including any term in a contract, invoice or otherwise that would cause the consumer harm. Any clause that purports to exempt the provider from obligations under the law is automatically void — so a terms-and-conditions page cannot waive statutory refund rights or disclaim liability for defective goods, regardless of how the clause is worded. Article 24 reinforces this: consumers retain the right to claim compensation for personal or material damages arising from use of a commodity or service, and any agreement to the contrary is also void. Article 4 separately guarantees every consumer the right to fair and quick settlement of disputes and to fair compensation for damages caused by a purchase or service. Governing law should be UAE law, and your terms should provide for resolution through UAE courts or an agreed alternative dispute-resolution mechanism. A clause that attempts to route disputes to a foreign jurisdiction and away from UAE consumers' statutory rights sits on shaky ground given Article 3's express application of the law to all e-commerce operations by providers registered in the State, including those in free zones.

Bottom line

Getting ecommerce website design in Dubai right is not just a creative brief — it is a compliance project spanning trade licensing, consumer protection, data privacy, and contract law. The statutory floor is higher than most agencies disclose at the pitch stage, and clauses that look standard elsewhere can be void under UAE law. Build the legal layer in from the start; retrofitting it after launch costs more and risks more.

Need this checked for your situation? Talk to a UAE-licensed lawyer →