UAE Outbound Calling Compliance: TDRA (2026)

Primary regulator texts were not publicly reachable at the time of writing; rules below are cited to their published source and should be confirmed with the regulator.

The UAE moved from soft guidance to a hard tariff in 2024, and the enforcement figures since show the regime is live. For a BPO, a collections floor or a telecom reseller dialling UAE mobiles the questions are narrow: what hours may you call, what number may you present, what must the agent say first, and what happens when a consumer has joined the national opt-out list.

UAE outbound compliance at a glance

Who regulates outbound calling in the UAE

TDRA enforces the telemarketing rules under Cabinet Resolutions Nos. 56 and 57 of 2024. Its Arabic name is الهيئة العامة لتنظيم قطاع الاتصالات والحكومة الرقمية.

Enforcement is not exclusively federal: in February 2025 Dubai's Corporation for Consumer Protection and Fair Trade fined 159 companies under the same Cabinet Resolutions. Telecom licensees also carry a standing duty to minimise spam with a UAE link across their networks.

A prior approval is required before practising telemarketing, but every reachable source names only "the competent authority", so which body registers telemarketers is not confirmed. Ask TDRA and your emirate's economic department rather than assuming.

Consent and opt-out

Article 4 of Cabinet Decision No. 56/2024 requires consent before any electronic marketing is sent, including messages on social media platforms, because those fall inside its broad definition of telemarketing phone calls. TDRA's anti-spam regulation sets the same default: spam is marketing sent without the recipient's consent.

On top of prior consent there is an in-call gate. Firms must ask consumers at the start whether they wish to continue the call before beginning the marketing. Treat that as a scripted branch, not a courtesy.

Two statutory opt-out rights sit behind it. The PDPL lets a data subject object to and stop processing for direct marketing. Article 6 of the Trading by Modern Technological Means Law of 2023 gives consumers the right to choose whether to receive marketing by call, email or social media. Calls the consumer initiated are outside the rules.

How consent must be recorded, and whether it expires, is not published. Keep source, timestamp and channel anyway: a client audit will ask even where the instrument is silent.

Do Not Call

Calling a number listed on the national Do Not Call Registry is strictly prohibited, and the penalty reaches Dh150,000, the top of the company band. Consumers register themselves by texting DNCR to 2211, which TDRA actively promotes.

Not published: which entity operates the register, how a telemarketer gains access to it, and how often lists must be scrubbed. Scrub before every campaign run and keep the evidence of when you did.

Calling hours and days

Marketing calls are permitted only between 09:00 and 18:00, a window two separate reports state identically, and calling outside it carries Dh10,000 rising to Dh50,000 for repeats. The hours are UAE local time: Gulf Standard Time at UTC+04:00, no daylight saving, so 05:00 to 14:00 UTC year round. Whether the Cabinet Decisions name a time zone in terms is not confirmed.

There is a frequency cap of not more than once a day. A later report describes the limit as once daily or three times weekly with a three-day cooling-off after a refusal, which conflicts with the earlier reporting, so do not build a weekly number or a cooling-off period into policy. Both agree that calling a resident again the same day after they reject the offer is a violation carrying Dh10,000 to Dh50,000.

No reachable source mentions a weekend, Friday or public-holiday restriction. That is an absence of evidence rather than a permission.

Caller ID and number presentation

All marketing calls must originate from phones registered in the name of the licensed telemarketing company, under its commercial licence. An unregistered number is penalised at Dh25,000 to Dh75,000.

Personal numbers are the sharpest trap. Individuals may not make marketing calls on phones registered in their own names. A first violation brings Dh5,000 plus suspension of every fixed and mobile number in that individual's name until the fine is paid; a second adds a three-month suspension at Dh20,000; a third within thirty days reaches Dh50,000 plus a twelve-month prohibition on service. By June 2026, TDRA reported 9,433 numbers disconnected.

The rules also mandate customer introduction and company identification at the start of the call. Not published: rules on withheld or anonymous CLI, an express spoofing prohibition, or a dedicated telemarketing number range.

Call recording and notices

It is mandatory to notify the consumer at the beginning of the call if it is being recorded, with penalties reported at Dh10,000 to Dh30,000. A separate report frames the duty as requiring permission rather than notice, and another summary of the same fine table gives Dh10,000 to Dh50,000. Treat both points as unsettled and design to the stricter reading: announce the recording and capture the acknowledgement.

Behind that sits criminal exposure: Penal Code Article 431 penalises eavesdropping on or recording without consent. No mandatory retention period for telemarketing recordings is published.

Messaging rules for SMS and WhatsApp

Messaging is not a lighter-touch channel. Article 4 of Cabinet Decision 56/2024 reaches electronic marketing sent via messages on social media platforms, and TDRA's anti-spam regulation makes consent the default for any marketing electronic communication. Not published: a mandatory opt-out keyword, a sender-ID registration regime, or a message-specific window. Apply the voice rules to messaging.

Data protection and retention

The federal law is Federal Decree-Law No. 45 of 2021, issued 26 September 2021. Its Executive Regulations were still unpublished as at January 2025, and controllers then get six months from issuance to comply, so any requirement quoted elsewhere as a UAE PDPL implementing rule is not yet in force.

The PDPL supplies no marketing-specific lawful basis, only an objection right over processing for direct marketing. Consent for the call comes from Cabinet Decision 56/2024 and the anti-spam regulation. Cross-border transfers are limited, with the Data Office expected to approve adequate territories, and health information relating to services provided in the UAE may not be stored, processed or transferred abroad absent a ministerial decision.

The free zones run separate regimes. In the DIFC, Law No. 5 of 2020 requires controllers to disclose direct-marketing use and to offer an express objection right before data is first disclosed to third parties for it. In the ADGM, the Data Protection Regulations 2021 say consent is not always necessary and legitimate interests can often be relied on, provided an objection right is given at collection and in every communication. Whether Cabinet Decision 56/2024 reaches calls from within either zone is not confirmed, and no PDPL retention period for recordings is published.

Penalties and enforcement

The structure is per violation with escalation for repeats, and suspension powers attach to the numbers themselves. No reachable source describes any per-day accrual.

Reported bands: no approval, Dh75,000 then Dh100,000 then Dh150,000; calling outside the window, Dh10,000 rising to Dh50,000; a DNCR number, up to Dh150,000; an unregistered number, Dh25,000 to Dh75,000; no recording notice, Dh10,000 to Dh30,000; untrained staff, Dh10,000 to Dh50,000; deception, Dh25,000 to Dh75,000. Overall, individuals face Dh5,000 to Dh50,000 and companies Dh10,000 to Dh150,000.

Data protection penalties are a separate track. The PDPL sets no fine amounts of its own: the Cabinet is to issue a decision specifying violations and administrative penalties, and that decision was unpublished as at January 2025. The frequently quoted Dh50,000 to Dh500,000 range comes from Article 13 of the Cyber Crime Law, not from the PDPL.

What changed in 2025 and 2026

Enforcement moved, rule-making did not. Cumulative fines stood at Dh3.8 million by December 2024; by June 2026 TDRA reported Dh19.19 million and 9,433 numbers disconnected, alongside a public push for DNCR registration.

No new or amended UAE telemarketing instrument dated 2025 or 2026 was found in the reachable sources, which is a negative from a limited source set rather than proof of absence. The 2026 status of the PDPL Executive Regulations could not be confirmed.

How DialerBee supports each rule

DialerBee ships a UAE TDRA jurisdiction pack, so its rules apply to every call placed under it rather than living in someone's memory. Compliance Autopilot checks each attempt against the DNC list, the calling-hours window for its jurisdiction, the consent record, the caller ID's ownership, the frequency limit and the phone format before the call is placed. The calling window enforces 09:00 to 18:00 Gulf Standard Time, the suppression check enforces your DNCR scrub, the frequency limit enforces the once-a-day cap and the same-day stop after a refusal, and the ownership check keeps calls on company-registered numbers.

Caller-ID pool control governs which number is presented per campaign, keeping a personal number out of a marketing campaign. Recording carries configurable retention per campaign and per tenant plus legal hold, and per-tenant isolation keeps each client's suppression lists, numbers and recordings separate. Scripts run in 11 languages including Arabic, which matters when the recording notice has to be understood. These are compliance-supporting controls that help you meet your obligations; they do not replace legal review.

UAE outbound compliance checklist

• Confirm with TDRA which authority issues your telemarketing approval, and hold it before the first campaign.
• Dial UAE numbers only between 09:00 and 18:00, with the campaign time zone set to Gulf Standard Time.
• Scrub every list against the Do Not Call Registry before each run, and keep the evidence.
• Present only numbers registered under the calling company's commercial licence.
• Open every call by naming the agent and the company before any sales content.
• Announce at the start of the call that it is being recorded, and capture the acknowledgement.
• Stop calling a contact for the rest of the day as soon as they decline the offer.
• Cap attempts at one call per contact per day.
• Record where, when and how each consent was collected, and ask before starting the pitch whether the person wants the call to continue.
• Map DIFC and ADGM entities to the free-zone data protection regime, not the federal PDPL.
• Re-check the Cabinet Decision texts with TDRA before publishing internal policy.

Sources

1. DLA Piper, Data Protection Laws of the World, UAE General (Electronic marketing), accessed 11 September 2026. dlapiperdataprotection.com
2. DLA Piper, UAE General (Enforcement and Law), accessed 11 September 2026. dlapiperdataprotection.com
3. Khaleej Times, "Up to Dh150,000 fines: UAE announces tighter telemarketing rules", 9 June 2024. khaleejtimes.com
4. Khaleej Times, full list of fines ahead of the 27 August 2024 effective date, 2024. khaleejtimes.com
5. Khaleej Times, "UAE fines cold-callers caught using personal numbers", 3 October 2024. khaleejtimes.com
6. Khaleej Times, "Dh19 million in fines issued, 9,433 numbers cut", 5 August 2026. khaleejtimes.com
7. Wikipedia, Time in the United Arab Emirates, accessed 11 September 2026. en.wikipedia.org

Frequently asked questions

Who regulates outbound calling in the UAE?

TDRA, the Telecommunications and Digital Government Regulatory Authority, enforces the telemarketing rules under Cabinet Resolutions Nos. 56 and 57 of 2024. Personal data is governed separately by Federal Decree-Law No. 45 of 2021, the PDPL. Emirate-level consumer bodies enforce the same Cabinet Resolutions, as Dubai did in February 2025.

What are the permitted calling hours in the UAE?

Marketing calls are permitted only between 09:00 and 18:00 UAE local time, which is Gulf Standard Time at UTC plus four hours with no daylight saving, so the window is 05:00 to 14:00 UTC year round. Calling outside it is reported to carry Dh10,000 rising to Dh50,000 for repeats.

Does the UAE have a national Do Not Call list?

Yes. Calling a number on the national Do Not Call Registry is strictly prohibited, with a penalty reported at up to Dh150,000, and consumers register by texting DNCR to 2211. No public source states how telemarketers access the register or how often lists must be scrubbed, so confirm the route with TDRA.

Can I use an agent's mobile number for marketing calls?

No. Marketing calls must originate from phones registered to the licensed telemarketing company under its commercial licence. Individuals may not make marketing calls on numbers registered in their own names, and a first violation is reported to bring Dh5,000 plus suspension of every number in that person's name until the fine is paid.

Do I have to announce that the call is being recorded?

Yes. You must notify the consumer at the beginning of the call if it is being recorded, with penalties reported at Dh10,000 to Dh30,000. One report describes the duty as requiring permission rather than notice, and another summary of the same fine table gives a higher band, so design to the stricter reading.

What fines does the UAE PDPL carry?

The PDPL specifies no fine amounts of its own. Penalties are deferred to a Cabinet decision that was still unpublished as at January 2025. The commonly quoted Dh50,000 to Dh500,000 range comes from the Cyber Crime Law and should not be attributed to the PDPL.

How does DialerBee help with UAE compliance?

DialerBee ships a UAE TDRA jurisdiction pack, and Compliance Autopilot checks every attempt against the DNC list, the calling window, the consent record, the caller ID's ownership, the frequency limit and the phone format. Caller-ID pool control keeps campaigns on company-registered numbers, recording carries configurable retention and legal hold, and scripts run in 11 languages including Arabic. These are compliance-supporting controls that help you meet your obligations; they do not replace legal review.

Related reading

• UAE outbound dialer overview
• Compliance Autopilot
• Caller-ID pool control
• MENA compliance guide

This article is for general informational purposes and is not legal advice. The UAE government primary texts cited here were not publicly reachable at the time of writing, and every rule above rests on a published secondary source. Confirm current requirements with TDRA, the relevant emirate authority and qualified local counsel.