Recording Business Calls in the UAE: PDPL, Consent, and What the Law Actually Says

What does UAE law actually say about recording business calls?

Search for this and you'll find a lot of confident-sounding claims about “PDPL call recording rules.” The honest answer is narrower than most of them suggest. There is exactly one provision in UAE law that explicitly addresses recording a phone call with a notice requirement, and it isn't in the data-protection law. It's in the telemarketing regulation. Article 4(7) of Cabinet Resolution No. 56 of 2024 states:

“Record Marketing Phone Calls, with the necessity of informing the Consumer of this recording when the call begins.”

— Cabinet Resolution No. 56 of 2024, Article 4(7) (official text, moet.gov.ae)

This is confirmed, on close reading of both resolutions in full, as the only provision in either Cabinet Resolution 56 or Cabinet Resolution 57 of 2024 that addresses call recording at all. It is the primary-source backing for a simple rule: if you record a marketing call, you tell the person at the start of the call.

What is the fine for recording a call without telling the caller?

Cabinet Resolution No. 57 of 2024 treats “failing to record” and “recording without notifying the consumer” as two separate violations under the same article, each with its own penalty tier:

The second row is the one that matters most for AI voice agents specifically: recording without telling the caller carries a fine of AED 10,000 for a first offence, AED 20,000 for a second, and AED 30,000 for a third. For the complete 18-row penalty schedule, see our TDRA fines and penalty table.

Does the PDPL say anything specifically about call recording?

No, and this is the gap worth understanding rather than papering over. Federal Decree-Law No. 45 of 2021, the UAE's Personal Data Protection Law (PDPL), has no article that specifically addresses recording of phone calls or voice data. Voice is captured as an identifying element within PDPL's general definition of “personal data,” so the law's general consent and processing rules apply to a voice recording the same way they'd apply to any other personal data. But there is no PDPL-specific “call recording” article to point to. The only explicit call-recording-with-notice obligation anywhere in UAE law is the Telemarketing Resolution provision above.

The PDPL itself came into force on 2 January 2022. It is regulated by the UAE Data Office, established under Federal Decree-Law No. 44 of 2021. So when a business asks “does PDPL require me to disclose call recording,” the accurate answer is: not by name, but its general personal-data consent rules still apply to the recording, and the Telemarketing Resolution's explicit notice duty applies separately for marketing calls.

What are PDPL's general consent rules, then?

The starting principle, per the UAE's own government portal, is a general prohibition with defined exceptions. In the government's own words, the PDPL:

“…prohibits the processing of personal data without the consent of its owner, except for some cases in which the processing is necessary to protect a public interest.”

— u.ae, UAE Data Protection Laws

Article 6 sets the standard for what counts as valid consent: it “could be obtained electronically or in writing but must be obtained in a clear, simple, unambiguous, and accessible manner,” and withdrawing consent must be made just as easy as giving it. A consent flow that makes opting in one click and opting out a phone call and a form isn't compliant with that standard.

Article 4 then sets out the categories of processing where consent is not required in the first place. As reflected in the underlying legal sources, these include: contractual necessity; data already made public by the individual; processing necessary to protect the data subject's own interests; legal claims; public health; archival, scientific, or statistical purposes; other public-interest necessity; legal-compliance obligations; and other circumstances to be defined in the Executive Regulations.

Are the PDPL Executive Regulations issued yet?

As of 27 July 2026, no. This is genuinely contested terrain, worth citing from more than one source rather than asserting flatly. Chambers and Partners' 2026 practice guide states: “The Implementing Regulations, intended to clarify key aspects of the law, have yet to be issued.” Kayrouz & Associates notes the regulations were originally due by July 2022 and that, “as of February 2026, they remain unpublished.”

Practically, this means several of the operational details businesses most want clarity on, such as data-transfer mechanics, breach-notification specifics, and sector-level guidance, are still governed by the PDPL's general principles rather than an implementing regulation that spells them out. Treat any source that cites a specific decision number as “the PDPL Executive Regulations” with caution and verify it directly, since the more consistently sourced legal commentary available at the time of writing describes the regulations as still unissued.

What does MAJ do about recording and consent in practice?

Given a Telemarketing Resolution that requires notice at call start, and a PDPL that applies its general consent rules to voice as personal data without a dedicated recording article, the practical posture we operate is simple: disclose, every time, regardless of which specific statute would technically require it for that call. Every MAJ Leads voice agent, on every call and in every language it operates in, opens with a plain, unambiguous line before any substantive conversation begins:

“Just so you know, this call will be recorded for quality and training purposes.”

— MAJ Leads standard call-opening disclosure

That single line satisfies the Article 4(7) notice duty on outbound marketing calls, and it applies PDPL's own “clear, simple, unambiguous, and accessible” consent standard to a recording that would otherwise sit in a genuine legal gap. Beyond the opening disclosure, our systems capture the consent event itself as a logged part of the call record, and retention follows a fixed discipline rather than an indefinite one: recordings and associated data are kept only as long as the client's own retention policy and applicable law require, not by default forever.

This is also why MAJ's AI receptionists and AI appointment-booking agents are built with the disclosure line as a fixed opening step rather than a configurable option a client could switch off. Our services page has the full detail on how recording, consent, and DNCR screening (see our complete DNCR guide for that separate obligation) are wired into the same pre-call and in-call architecture rather than treated as three separate compliance projects bolted on afterward.

So, is recording a business call legal in the UAE?

Yes, with notice. For marketing calls, Article 4(7) makes that an explicit, non-negotiable duty backed by a specific fine. For calls that fall outside the Telemarketing Resolution's narrow definition of marketing, the general PDPL consent principles still apply to the recording as personal data, even without a bespoke article to cite chapter and verse. The safest and most defensible position, and the one MAJ builds every agent around, is disclosure at the start of every call, full stop, rather than trying to work out case by case which specific statute would technically require it for that particular conversation.