When is consent required for data processing in UAE?

No — consent is one of six lawful bases under the UAE Personal Data Protection Law (PDPL) ^[1]:

1. Consent (must be free, specific, informed, unambiguous)
2. Contract performance (processing necessary to perform a contract with the data subject)
3. Legal obligation (processing required by law)
4. Vital interest (protecting life of the data subject or another person)
5. Public interest (processing required for public-interest or official-authority tasks)
6. Legitimate interest (controller's legitimate interest, balanced against the data subject's rights)

In practice this means:

• A bank can verify your identity to satisfy AML rules without separate consent (legal obligation).
• An employer can pay your salary to your account using contract performance, not consent.
• Marketing emails generally require consent (opt-in).
• Analytics on user behaviour can rely on legitimate interest, but the controller must run a balancing test and document it.

Whichever basis applies, the data subject still has the rights set out in Article 13 ^[2]: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

If consent is the basis, withdrawing it must be as easy as giving it.