E-Commerce Compliance in the UAE After the 2023 Reforms

The United Arab Emirates (UAE) has established itself as a global hub for digital commerce, and its e-commerce market is projected to keep growing quickly. That growth, driven by strong digital infrastructure and high consumer adoption, has required a comprehensive legal framework for online trade. For any business selling online in or into the UAE, e-commerce compliance is not merely a best practice. It is a mandatory prerequisite for operating legally and building a lasting business.

The framework rests on two main pillars: the newly enacted Federal Decree-Law No. 14 of 2023 on Trading through Modern Technology (E-Commerce Law) and the overarching Federal Law No. 15 of 2020 on Consumer Protection (CP Law), together with its Executive Regulations (Cabinet Decision No. 66 of 2023). These laws supersede older legislation and reflect a clear government commitment to protecting consumers and building a secure, trustworthy digital economy. This guide covers the key compliance areas, from drafting your Terms of Service to managing returns, so that your e-commerce business is legally sound in the UAE.

Related: Explore our DIFC lawyers services for legal support in the UAE.

Licensing and Scope of E-Commerce Compliance in the UAE

Before drafting contracts or policies, a business needs to know whether the law applies to it and which licences it must hold.

Related: Explore our Data Protection Officer service for legal guidance in the UAE.

The E-Commerce Law of 2023 significantly broadens the scope of regulation compared to its 2006 predecessor. It moves beyond electronic transactions alone to govern modern digital trade as a whole.

Related: Explore our free zone company formation for foreign investors services in the UAE.

Who Must Comply?

The law applies to all commercial activities conducted through "modern technological means", which include:

• Websites and dedicated e-commerce platforms.
• Smartphone applications.
• Social media channels used for commercial purposes.
• Virtual stores and, notably, blockchain-based platforms.

Crucially, the law reaches any person or entity engaging in commercial activity through modern technology means inside the UAE. This means that foreign e-commerce platforms that target or serve consumers within the UAE must also comply with its provisions, a significant extraterritorial application of the law.

Mandatory Registration and Licensing

Every e-commerce business must meet the legal, regulatory, professional and technical criteria set by the competent authorities. This includes obtaining the necessary approvals, permits and licences from the relevant economic department or free zone authority. The law requires merchants to:

• Provide customers with detailed digital invoices for purchases.
• Sell only goods and services that are authorized in the UAE.
• Maintain a technically secure environment and comply with cybersecurity and anti-piracy standards.

Proper licensing and authorized trade are the first line of defence against non-compliance, and they keep the playing field level for all digital merchants. For help with business setup and licensing, see our free zone company formation service.

Terms of Service and Electronic Contracts

The Terms of Service (ToS), or electronic contract, is the single most important legal document for an e-commerce platform. UAE law sets strict requirements for its content and presentation to ensure transparency and protect the consumer.

Legal Validity of Electronic Contracts

Under Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, electronic contracts have the same legal validity as traditional written contracts, provided they meet the legal requirements for offer, acceptance and consideration. This law is the legal backbone for all digital agreements.

Mandatory Disclosures in the Electronic Contract

The E-Commerce Law and the CP Law Executive Regulations require the seller to give the consumer comprehensive, clear information before the contract is concluded. This pre-contractual information must include, but is not limited to:

• Seller identity: the merchant's full legal name, address and contact details.
• Product or service details: a clear description, specifications and images of the goods or services.
• Pricing: the total price, including all taxes, fees and delivery charges, must be clearly stated.
• Payment methods: accepted payment methods and security measures.
• Delivery or execution: clear timelines and procedures for delivery or service execution.
• Warranty and after-sales service: details of any applicable warranty and the process for after-sales support.
• Return and exchange policy: a clear, accessible policy setting out the consumer's rights and the procedure for returns and exchanges (discussed in detail below).

Practical Steps for Drafting a Compliant ToS

A compliant ToS needs a systematic approach that addresses both the letter and the spirit of the UAE's consumer protection laws.

1. Clear and unambiguous language: The ToS must be easy for the average consumer to understand. Avoid complex legal jargon where plain language will do.
2. Prominent placement: The ToS must be easy to reach from every page of the platform, typically through a footer link. Consumers must be required to accept the terms explicitly before completing a purchase (for example, through a mandatory checkbox).
3. Version control: Keep a clear record of all previous versions of the ToS and the dates they were in effect. Any material change must be communicated to existing customers in advance.
4. Jurisdiction and governing law: State clearly that UAE law governs the contract, and specify the competent courts or dispute resolution mechanism. For a full legal review of your commercial contracts, consult our contract drafting and commercial law team.

The Arabic Language Requirement

International operators often overlook the language requirement. Information, advertisements and contracts to be entered into with a consumer must be in Arabic or any other language in addition to Arabic. Providing an English version is standard, but including an Arabic version is essential for compliance and helps avoid disputes based on lack of clarity or understanding.

Prohibition of Unfair Contractual Terms

The CP Law Executive Regulations introduced a significant provision that makes a number of contractual terms null and void if they appear in any document relating to a transaction with a consumer. These "Unfair Contractual Terms" include, but are not limited to, clauses that:

• Grant the seller the unilateral right to interpret or amend certain clauses.
• Allow the seller to terminate a contract unilaterally without reverting to the consumer or granting the consumer the right to compensation.
• Cancel or limit the consumer's right to claim compensation if the seller breaches the contract.
• Waive any right granted to a consumer under the applicable laws.

E-commerce businesses must review their Terms of Service carefully to make sure they contain none of these prohibited clauses, as including them can invalidate the entire contract or lead to regulatory penalties.

For professional legal guidance, see our e-commerce website terms and conditions and corporate governance advisory service pages.

Consumer Rights and Seller Obligations

The UAE's consumer protection legislation is designed to empower consumers and hold suppliers to a high standard of conduct.

Seller Obligations

Beyond the contractual disclosures, sellers have a broad set of obligations under the CP Law:

• Accurate advertising: Advertising must be accurate and must not mislead consumers. Product images, descriptions and claims must be truthful and verifiable.
• Dated invoice: The consumer must receive a dated invoice setting out the minimum required information.
• Warranty: A warranty must be provided in accordance with the law and the manufacturer's specifications.
• Defects and malfunctions: Sellers must deal with any defects or malfunctions in the goods or services. If the same issue appears three times within the first year, a full refund or replacement becomes mandatory.
• After-sales service: Appropriate after-sales services must be provided, depending on the nature of the goods or services.

Consumer Rights

The CP Law grants consumers several key rights, including:

• The right to obtain goods and services that meet the advertised specifications.
• The right to purchase goods and services electronically in a secure manner.
• The right to rate the seller and its goods or services.
• The right to agree to or refuse marketing campaigns.

Rules on Promotions and Discounts

The Executive Regulations introduced a specific rule on promotions and discounts. A seller is not permitted to promote goods or discount prices without first obtaining the proper licence. In addition, if a seller offers a discount on a product within one week of a consumer's purchase, the consumer is entitled to a refund of the price difference. The seller must notify the consumer of this right, and the refund must be processed within 30 days of the purchase date. This provision protects consumers against immediate price drops.

Returns and the Right of Withdrawal

The consumer's right to return or exchange goods is central to e-commerce compliance and is addressed directly by the E-Commerce Law.

The Right to Return and Exchange

The E-Commerce Law grants consumers the right to return or exchange any goods or services that were purchased electronically in accordance with its provisions. This right acts as a "cooling-off" period. However, the exact duration is not explicitly stated in the public summaries of the 2023 law, which suggests it may be set out in the unreleased Executive Regulations or determined by the seller's clear policy, provided that policy meets the law's minimum standard.

Historically, the Dubai Department of Economic Development (DED) has enforced a seven-day return policy for online purchases, allowing shoppers to return goods if they simply change their minds, provided the goods are in their original condition. While the 2023 Federal Law establishes the right to return, e-commerce businesses should adopt a clear, transparent and consumer-friendly return policy that reflects the spirit of the law and any specific regulations that may be issued.

Key Elements of a Compliant Return Policy

A compliant return policy must clearly specify:

• Timeframe: the number of days within which a return can be initiated. Although the federal law is silent on a specific number of days, adopting a minimum of seven days is a prudent measure that aligns with historical DED guidance and best practice.
• Conditions: the required condition of the product (for example, unused and in its original packaging).
• Exclusions: any goods or services exempt from the right of return (for example, perishable goods, customized items, or digital content once downloaded).
• Procedure: the step-by-step process for initiating a return, including who bears the cost of return shipping.
• Refund process: the timeline and method for processing the refund.

The policy must be easy to access and must not contain any "Unfair Contractual Terms" that would limit the consumer's statutory rights.

Data Privacy and Security

Consumer data is a valuable asset, and its protection is a major focus of UAE law.

The Personal Data Protection Law (PDPL)

Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) is the primary legislation governing data processing onshore in the UAE (excluding free zones with their own laws, such as DIFC and ADGM). The E-Commerce Law states explicitly that the data protection legislation in force applies to the use, classification and ownership of consumer information.

The PDPL is a comprehensive, modern framework based on international standards. It grants data subjects a wide range of rights, including the right to access, rectification, erasure and restriction of processing.

Key PDPL Principles for E-Commerce Businesses

E-commerce businesses must build their data handling practices around the core principles of the PDPL:

• Lawfulness, fairness and transparency: Processing must have a legal basis (for example, consent or contractual necessity). The Privacy Policy must set out data collection and processing activities clearly and transparently.
• Purpose specification and limitation: Data must be collected for specific, explicit and legitimate purposes. E-commerce platforms must not use customer data for marketing without explicit, separate consent.
• Data accuracy: Data must be accurate and kept up to date. Customers must be given a way to update their personal information.
• Security and protection: Appropriate technical and organizational measures must be in place to protect personal data from unauthorized access, processing or loss. This includes secure payment gateways and data encryption.
• Accountability: The e-commerce business must be able to demonstrate compliance with the PDPL, including by keeping records of processing activities and appointing a Data Protection Officer (DPO) if required.

For a full data protection audit and compliance strategy, explore our data protection services.

Onshore vs. Free Zone Data Compliance

It is important to distinguish between the federal PDPL and the laws of the financial free zones:

• Onshore UAE: governed by the Federal PDPL (Federal Decree-Law No. 45 of 2021).
• Dubai International Financial Centre (DIFC): governed by the DIFC Data Protection Law No. 5 of 2020.
• Abu Dhabi Global Market (ADGM): governed by the ADGM Data Protection Regulations 2021.

E-commerce businesses established in a free zone must comply with that zone's own data protection regime, which often imposes requirements as strict as, or stricter than, the federal law. Businesses operating across jurisdictions must make sure their data governance framework is robust enough to meet the most demanding of all applicable laws.

Penalties for Non-Compliance and Dispute Resolution

Ignoring the UAE's e-commerce and consumer protection laws carries significant legal and financial risks that can seriously harm a business's reputation and operational continuity.

Penalties and Sanctions

Non-compliance with the CP Law and the E-Commerce Law can result in a range of civil and criminal penalties. While the specific fines are detailed in the Executive Regulations, consequences can include:

• Financial penalties: substantial fines imposed by the Ministry of Economy or the competent economic departments.
• Reputational damage: public disclosure of violations, leading to a loss of consumer trust and brand value.
• Operational restrictions: suspension or revocation of the commercial licence, effectively shutting down the e-commerce operation.
• Contract invalidation: clauses in the ToS found to be "Unfair Contractual Terms" are rendered null and void, exposing the business to consumer claims.

For breaches of the PDPL, the penalties are particularly severe, including administrative fines that can reach millions of Dirhams. This makes a strong data protection strategy essential.

Dispute Resolution Mechanisms

The E-Commerce Law introduces clear routes for consumers to seek redress:

1. Consumer complaints: Consumers can lodge complaints with the Ministry of Economy or the relevant local economic department. These bodies have the authority to investigate and issue binding decisions.
2. Dispute settlement committee: The E-Commerce Law provides for the Ministry of Economy to establish a specialized dispute settlement committee to handle e-commerce disputes.
3. Arbitration: For digital contracts exceeding a value of AED 50,000 (approx. US$13,613.96), the parties may opt for arbitration as an alternative dispute resolution mechanism.

Because these formal mechanisms exist, it is important to have clear, legally sound internal processes for handling customer complaints and disputes before they reach regulators. If a dispute does escalate, our litigation and dispute financing team is ready to represent your interests.

Conclusion: Proactive E-Commerce Compliance in the UAE

The UAE's e-commerce legal framework shows that the government is committed to a secure, fair and transparent digital marketplace. With the 2023 E-Commerce Law and the detailed Executive Regulations to the CP Law now in place, e-commerce businesses can no longer rely on outdated practices.

Proactive compliance is the only sustainable strategy. It involves:

1. Auditing your current Terms of Service and Privacy Policy against the new requirements, especially the Arabic language and Unfair Contractual Terms provisions.
2. Implementing a robust data protection framework in line with the PDPL.
3. Ensuring your advertising and pricing are transparent and comply with the discount rules.
4. Establishing a clear, accessible and compliant return and exchange policy.

For businesses working through these new regulations, expert legal guidance is indispensable. A firm that specializes in UAE commercial and digital law can help keep your operations fully compliant, so you can focus on the strong growth potential of the UAE's e-commerce sector.

Related Services: Explore our e-commerce website terms and conditions services for practical legal support in this area.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Additional Resources

Explore more of our insights on related topics:

• Navigating the Legal Landscape: E-learning and EdTech Requirements in the UAE
• Navigating the Legal Landscape: Logistics and Transportation Compliance in the UAE
• Navigating the Digital Frontier: UAE Online Marketplace Regulations and E-commerce Compliance in 2025
• Navigating the 2025 Regulatory Landscape: Correspondent Banking Compliance in the UAE