The new legislation extends both the protections available to consumers, as well as the obligations applicable to e-commerce retailers.

By Brian A. Meenagh and Avinash Balendran

With its recent implementation of a new consumer protection law, the United Arab Emirates has taken a significant step forward in protecting the rights of consumers. The new legislation — Federal Law No. (15) of 2020 (the New CPL) — entered into force on 16 November 2020, repealing Federal Law No. (24) of 2006. In particular, the New CPL extends both the protections available to consumers, as well as the obligations applicable to e-commerce retailers.

One stand-out provision in the New CPL is Article 4(5), which places an obligation on Entities (as defined below) to protect “consumers’ privacy and data security”. Article 4(5) also implies that Entities should not use consumer data for “the purposes of promotion or marketing”.

Read on its own, this provision could be interpreted as imposing a ban on the use of consumer personal data for promotion and marketing purposes in the UAE — particularly given the significant penalties provided for in the New CPL for non-compliance, including imprisonment, fines, and closure of the relevant business. Although the complete banning of consumer personal data use for marketing purposes is likely not the New CPL’s intent, the legislation does include a number of general provisions that merit attention and analysis.

This post answers five key questions about what the New CPL means for providers and consumers.

1. What entities and activities are subject to the New CPL?

The New CPL applies to the following providers and persons (collectively, the Entities), per Article 3:

  • Service providers who offer a service or manufacture, distribute, trade in, sell, supply, export, import, or play a part in producing, trading, or storing a commodity to a consumer
  • A legal person advertising a commodity or service
  • Commercial agents
  • E-commerce providers registered in the UAE

The New CPL applies to all services and commodities in the UAE (including the free zones). Under the New CPL, “commodity” means “any natural substance or industrial, agricultural, animal, manufactured, intellectual or technological product, including the primary elements of the substances and the components that go into that product”.

2. When is compliance required?

The New CPL provides a one-year grace period for Entities to ensure compliance. Based on the publication date of 16 November 2020, the grace period will expire on 15 November 2021.

3. What are the New CPL’s key provisions for retailers and e-commerce providers?

Data privacy

As noted in the introduction, Article 4(5) of the New CPL introduces a consumer right dealing with data protection and data security. Article 4(5) can be read as imposing a ban on the use of personal data for promotion and marketing purposes.

Article 36 of the New CPL states that the executive regulations shall be issued within six months from the publication of the New CPL, or by 15 May 2021. These regulations will likely clarify the application of Article 4(5) of the New CPL.


According to Article 25 of the New CPL, e-commerce providers that are registered in the UAE are required to provide consumers and competent authorities with their names, legal status, address, details of licensing authority, and other sufficient information in Arabic (along with details of the specifications, terms of contracting, payment, and warranties) in respect of their services/commodities.

Arabic requirements

Article 26 of the New CPL states that “the data, advertising and contracts related to the consumer must be in Arabic”; however, Entities are permitted to use other languages alongside Arabic. Notwithstanding the requirements in Article 25, one implication of the foregoing requirement is that Entities must make available their website terms of service, privacy policy, and cookies policy (if separate from the privacy policy) in Arabic.

Additional consumer rights

Notably, the New CPL also provides consumers the right to:

  • Be educated about and have increased awareness of their rights and obligations (Article 4(3))
  • Receive “fair and quick settlement” of consumer disputes (Article 4(7))
  • Receive “fair compensation” for the damage caused to consumers or their property as a result of purchasing or using the commodity or receiving the services (Article 4(8))
  • Have contracts that they enter into with providers cover the repair, maintenance, or after-sales services, or the return, replacement, or reimbursement of the commodity (Article 15)

4. What penalties does the New CPL impose for non-compliance?

Articles 28 to 32 of the New CPL specify the penalties for violations. The financial penalties fall into two categories:

  • Violations of certain provisions in the New CPL (e.g., false advertising, which may result in imprisonment for up to two years and a fine of at least AED10,000 and up to AED2 million, or one of the foregoing penalties)
  • Violations of certain provisions in the New CPL (e.g., contracts not translated into Arabic, which may result in imprisonment for up to six months and a fine of at least AED3,000 and up to AED200,000, or one of the foregoing penalties)

The penalties referenced above may be doubled following a repeated violation.

Furthermore, Article 31 of the New CPL specifies that a court may administer the following penalties after a conviction:

  • Confiscation or destruction of the commodity (and the materials and tools used to produce the commodity)
  • Closure of the shop or place where the crime occurred for no longer than three months
  • Publication of the conviction in two daily local newspapers

5. What will happen next?

The executive regulations are due by 15 May 2021. Latham will continue to monitor and provide updates on related developments, including once the executive regulations, additional guidance, and/or Ministerial decisions are available.