What is PDPL, and why does it matter for your digital business card?

Your digital business card holds personal data — yours and, if you use lead capture, everyone who leaves you their details. The UAE has a federal law covering exactly that. You don't need to be a lawyer to use your card in line with it, but it helps to know the basics.

What PDPL actually is

The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) is the UAE's federal law on collecting, using, storing and sharing personal data. It took effect on 2 January 2022 and applies broadly to businesses and individuals processing personal data connected to the UAE — including, in many cases, organisations based outside the country that handle data about people in the UAE. Government data, and free zones that run their own data protection regime such as the DIFC and ADGM, are handled separately.

What counts as personal data on a card

Almost everything on a typical card: your name, phone number, email, job title, company, photo, and — if you use lead capture — the name, number and email of everyone who shares their details with you. None of this is exotic or sensitive data, but it's still personal data, and the same basic rules apply to it as to a customer database.

Three principles worth building into how you use your card

• Collect only what you need. A card with your role, company and a couple of ways to reach you does its job. There's no compliance or practical benefit to asking visitors for extra fields "just in case" — see what to put on a digital business card.
• Be clear about what's public. A card is shared by design, so treat everything on it as visible to whoever has the link — that's the whole point of digital business card privacy: what is public?. Keep a personal mobile number or home address off a card you hand out widely; use a work number and email instead.
• Only use leads for what people expected. If someone leaves their contact details on your card, that's for you to follow up with them — not to add to a mailing list they didn't sign up for.

Rights that apply to the people you collect data from

PDPL gives individuals rights over their own data, including the right to know what's held about them, to correct it, to have it deleted, and to object to certain processing. In practice, for a small business using a digital card, this mostly means: if someone who left you their details asks you to delete them or stop contacting them, do it — don't treat a lead as permanent once it's in your inbox.

A practical checklist for your card

1. Review what's on your public card and remove anything you wouldn't want a stranger to have — see what is public.
2. If you collect leads, check them regularly in your lead inbox rather than exporting and storing them indefinitely elsewhere.
3. Use a private card with an access code for anything meant for a specific audience rather than the public — see make a card private.
4. Delete a contact's details from your leads if they ask you to.
5. Read MyInfo's own privacy policy for how your account data is handled on our side.

Frequently asked questions

Does PDPL mean I need a lawyer to use a digital business card?

No. PDPL is aimed at how businesses collect and use personal data at scale — things like customer databases, marketing lists and data-sharing agreements. Using a card to share your own contact details, and following up on leads people give you directly, is normal, low-risk activity as long as you're not doing anything with that data beyond what the person would reasonably expect.

Does PDPL apply to my business if I'm a freelancer or sole trader?

Generally yes — PDPL applies to data controllers and processors regardless of size, with specific exemptions mainly for government bodies, health and credit data under their own laws, and free zones like the DIFC and ADGM that have their own data protection regimes. For most freelancers and small businesses in mainland UAE, the practical takeaway is the same: collect only what you need, and respect requests to correct or delete someone's data.