If a client has asked whether your website is GDPR-ready and you do not know what your scripts send, this is for you. It is not for anyone looking for legal advice or a certificate: this is a list of questions to bring to your lawyer.
Which questions are yours, and which are counsel's?
Write two lists before anyone opens a policy document.
The first list is facts. What does each script on the site send about a visitor? What is stored, in which country, and for how long? Does the site set cookies? You can answer all of that from the script's settings and its documentation. Nobody needs a law degree.
The second list is judgment. Does your site need a consent banner? What should the privacy notice say? Does GDPR reach your European visitors at all? Does a DIFC or ADGM address change the answer? Those belong to your lawyer.
A tool never answers the second list. If a vendor tells you the site is "compliant", ask them to put it in writing, with the name of the lawyer who signed it.
Our test is one question: can you hand your lawyer one page that lists every script on the site and what each one sends? If you cannot, that page is the first job. A banner chosen without it is a guess.
Does GDPR reach a website in the UAE at all?
Your lawyer decides. What you can read for yourself is the text.
GDPR's Article 3(2) covers a business that is not established in the EU. It applies when that business processes personal data of people who are in the EU and the processing relates to "the offering of goods or services" to them, or to "the monitoring of their behaviour as far as their behaviour takes place within the Union."
Two things follow, and both are facts about your site.
- Do you offer something to people in Europe? A broker selling off-plan units to buyers in London or Berlin, or a clinic taking medical-tourism enquiries from Europe, is in a different position from a car showroom in Sharjah.
- Does a script on the site follow what those visitors do? An analytics script that records pages and campaigns is the usual example. Whether it counts as "monitoring" is the lawyer's reading.
You supply the first two answers. The lawyer supplies the conclusion.
Which law is the question about, by address?
Three separate questions sit under one phrase.
The same Ilia Arestov article, which says its facts were checked on 27 and 28 September 2026, adds that the federal law's executive regulations had not been published and that the Cabinet decision on penalties had not been issued. It is a secondary source. Confirm both on the UAE Government portal or with the UAE Data Office before you rely on them, and ask your lawyer what that means for a website.
Add your market. A Riyadh client's IT team will ask about the Saudi law, which is a fourth question. The Mindcat Analytics page sets out the Saudi dates and the transfer rule it cites.
What is the one page you hand your lawyer?
One row per script. Open the site's page source or the tag manager, and list every row.
A typical broker or clinic site has more rows than anyone remembers: analytics, a chat widget, a map, an ad pixel, a form plugin. Each is a row. The lawyer reads the page and tells you which rows need consent and what the notice must say.
What do banner sellers say, and what do they leave to you?
Banner sellers give plain technical advice, and they stop where the law starts.
Element8, a firm that sells website compliance reviews, writes that you should "block non-essential scripts by default until consent is granted" and "gate analytics and advertising tags behind the appropriate consent state." The same article calls itself technical guidance, not legal advice, and says you "should confirm your final compliance position with qualified legal counsel." That is the split above, from a seller with a product to sell.
Banners also change your numbers. A site owner on the WordPress.org support forum wrote that "after setting it up I have seen a 70% drop in users in Google Analytics". That is one owner's report, not a rate. It shows what happens to your visit counts when analytics sits behind a banner and visitors close it, which is a cost to weigh with your counsel.
What does Mindcat Analytics send, and what is left out?
At Mindcat, we run website analytics for teams in the UAE and Saudi Arabia, and the page we publish for it is the list above, filled in for one script.
What it collects: the page, the referrer and campaign tags, the browser, operating system, device type, screen size and language, and the country, region and city. Not the name, not the email and not the IP address. The IP address is used to find the country and city, then dropped. The script sets no cookies by default, and a visitor's session is a code that changes every month. Your copy runs on servers in the UAE or in Jeddah, and backups stay in the same country.
What it does not do: decide whether you need a banner. Our page says that is your counsel's call, and that your banner may still be needed for other tags on your site. Our own site, mindcat.ai, runs Google Analytics and Ahrefs behind a consent banner. It also does not build ad audiences or feed Google Ads bidding, so it covers part of what Google Analytics does, not all of it.
What does it cost?
You pay per website a month. A website is one site or domain; the Arabic and English versions of one site count once. Logins are free and unlimited.
Websites 1 to 5 cost AED 99 each, falling to AED 39 for websites 6 to 20, AED 19 for 21 to 100 and AED 12 from the 101st. The shared plan, hosted by us in the UAE or Saudi Arabia, has a monthly minimum of AED 499, so one website pays AED 499, not AED 99, and up to five pay AED 499. Ten websites pay AED 690 a month. Each website includes up to 200,000 events a month, pooled.
The quick start is a fixed AED 2,500 for up to 5 websites on the shared plan. It is a package we set up for you, with the script, our install guide, a tracked-click template and our UTM naming sheet. A paid geo database, if your copy needs one, and any outside service you ask us to buy are billed at cost. Prices exclude 5 percent UAE VAT and 15 percent Saudi VAT.
Tell us how many websites you run and where your visitors are. We reply with the setup plan and the monthly price per website, in AED or SAR. If a lawyer's advice is what you need first, we say so.
