Deleting a Lead's Data in the UAE: A PDPL Procedure for Access, Erasure and Objection Requests

Does the PDPL apply to the leads you hold?

Rule. Federal Decree-Law 45 of 2021 applies to a controller or processor located in the UAE that processes personal data, and to one outside the UAE that processes the data of people inside it (Article 2). A lead's name, phone number and email address are personal data (Article 1). The text excludes some groups: government bodies, health data and banking and credit data that have their own laws, and companies in free zones that are subject to their own data protection legislation (Article 2(2)).

The free-zone carve-out matters in Dubai and Abu Dhabi. The UAE government portal lists the DIFC data protection law under related laws, and ADGM says its own Data Protection Regulations 2021 apply to entities registered there. Practice. If your company sits in DIFC or ADGM, read those regimes first. If you are a mainland business, this page applies. The Data Office may also exempt establishments that do not process a large amount of personal data from some duties (Article 3), under standards the executive regulations set. Do not assume you are exempt.

What can a lead ask you to do?

Rule. Article 19 tells you to provide clear ways for people to contact you and exercise these rights. Rule. Article 6 lets a person withdraw consent at any time, and withdrawal does not undo processing already done on the earlier consent. The text we read states no number of days in which you must answer a request. Practice. Answer within a fixed period you choose and write down, such as 30 days, and do not let a request sit.

What is a sensible procedure for a request?

1. Name one place to ask. A monitored email address on your privacy page is enough. That meets Article 19 and stops requests landing in a rep's WhatsApp.
2. Log it the day it arrives. Record the date, the channel, the name and the request type. The log is your proof you acted.
3. Check who is asking. The text does not describe identity checks. Practice: confirm through the phone number or email you already hold, so you never hand a stranger someone's data.
4. Search every place the person can be. Your CRM or lead board, WhatsApp chats, email lists and campaigns, call recordings, spreadsheets, form-tool submissions, and any processor holding a copy. Article 7(4) expects you to keep a record of what you hold and the mechanism for erasing it.
5. Decide which request it is. Access, correction, erasure and marketing objection each have a different test. A message saying stop messaging me is an Article 17 objection even if it never mentions the law.
6. Erase or anonymise, unless a ground to keep applies. Article 5(7) bars keeping data after its purpose is done, unless it is anonymised. If you keep something for a legal claim or because another law requires it, write down which ground and what you kept.
7. Keep a minimal do-not-contact record. After erasure you still must not contact the person. A phone number or email on a suppression list is the least data that does that. The text we read does not say how to square erasure with this, so ask counsel and record your reasoning.
8. Reply in writing. Say what you did, what you kept and why, and that they can complain to the UAE Data Office (Article 24).

How long can you keep a lead?

Rule. Personal data may not be kept after its purpose is fulfilled unless the person is anonymised (Article 5(7)). The Article names no number of months or years. Two other texts set minimums for specific records. The TDRA unsolicited communications policy says consent records are kept for as long as you send marketing to that person (Article 6.7). Cabinet Resolution 56 of 2024 tells companies that make marketing calls to keep a record of those calls and not destroy it until the period set by the competent authority has passed (Article 4(6)), and we did not find that period in the text.

Practice. Pick a rule per kind of lead and write it down. For example: an enquiry that never became a customer is anonymised after a period you can defend, a customer record follows your accounting rules, and a do-not-contact entry stays as long as you could otherwise contact the person. Article 7(4) asks you to record processing durations, so the rule belongs in that record. Keep cold enquiries for less time than customers: an ended purpose is the easiest ground to show.

What does MAJ Leads do today?

MAJ Leads holds your leads on your behalf. Practice. We read that as the processor role in the PDPL and you as the controller who decides the purposes, so a request from one of your leads is yours to answer. What we found in the Console code on 4 November 2026: admins can download every lead of the workspace as one CSV from Settings, which helps with access and portability requests; the workspace keeps an opt-out list that you can add phone numbers to; and a workspace can remove quarantined leads.

What we did not find is a one-click button that erases one person from every part of a workspace. Treat an erasure request as something to raise with us so we can look at your case, and do not assume a button. This page gives no turnaround time for that. To collect leads with consent wording attached, see the guide to lead form consent wording, and for what a lead agreed to by phone see call recording consent.

See how it works and pricing.