Cold Email in the UAE: How to Run B2B Lead Generation Into Dubai and Abu Dhabi

Running B2B cold email into the UAE means working with a federal data law whose implementing regulations still have not been issued, separate GDPR-style regimes in DIFC and ADGM, an English-speaking expatriate workforce alongside an Arabic-speaking public sector, and a calendar shaped by the 2022 workweek change and Ramadan. Koldify runs done-for-you cold email campaigns for companies selling into the UAE from abroad. This page covers what we would want to know before sending a single email to Dubai or Abu Dhabi.

Is cold email legal in the UAE?

Short answer: B2B cold email is not banned in the UAE, but there is no single "CAN-SPAM for the Emirates" either. Several overlapping rules apply, and one of the most important ones is only partly switched on. Everything below is a plain-English summary, not legal advice.

The federal PDPL (Federal Decree-Law No. 45 of 2021)

The Personal Data Protection Law was issued in September 2021 and has been in force since January 2, 2022, according to Pinsent Masons. It covers personal data of people in the UAE, including a buyer's name and work email, and it applies to controllers based outside the country as well.

Two points matter for cold email:

• Legal bases. Consent is the default. The law also lists other bases, including processing personal data "that has become publicly available and known by an act of the data subject" and performing a contract, per Baker McKenzie. Unlike the GDPR, there is no general "legitimate interests" basis in the federal list.
• Right to object. Individuals can object to processing for direct marketing, including related profiling, per DLA Piper. Treat every "not interested" or "remove me" as an objection and suppress that person.

The open question is enforcement. The executive regulations, which should define the penalty schedule and fill in details, have not been published. DLA Piper reported that position as of January 2025, and a September 2026 compliance update says they still had not been issued.

Organizations get six months to adapt once they are published, so build your process as if the law is fully enforced now.

TDRA and the anti-spam rules

The Telecommunications and Digital Government Regulatory Authority (TDRA) has an Unsolicited Electronic Communications regulation. According to DLA Piper, it requires licensed telecom operators to take practical steps to minimize spam with a UAE link and to stop it once they know about it. Spam is defined as marketing messages sent without the recipient's consent.

The key detail: that regulation is enforced against licensees, not directly against senders. In practice its reach is aimed at network operators, and the rules that follow focus on calls and messaging. Separately, Cabinet Decision No. 56 of 2024 on telemarketing requires consent before marketing over social media platforms (same source), so do not move your email sequence onto WhatsApp or Instagram DMs without permission.

DLA Piper also flags Federal Decree-Law No. 14 of 2023 on modern trading methods, under which consumers can choose whether to receive marketing by phone, email or social media. That law is aimed at merchants and consumers, but it is one more reason to honor opt-outs fast.

DIFC and ADGM have their own laws

The PDPL excludes free zone companies that have their own data protection legislation, and the two established examples are DIFC and ADGM, per Modulos' PDPL reference.

• DIFC Data Protection Law (DIFC Law No. 5 of 2020) has been in force since July 1, 2020. It is closely aligned with the GDPR, allows processing for a legitimate interest that is not overridden by the individual's rights, and gives an "unqualified right" to object to direct marketing, per Hunton. Fines under its schedule go up to $100,000 per contravention.
• ADGM Data Protection Regulations 2021 draw heavily on GDPR standards (Pinsent Masons), and administrative fines can reach $28 million (Taylor Wessing).

In practice, if you email a bank in DIFC or an asset manager in ADGM, run a GDPR-style legitimate interest check: relevant role, relevant offer, clear sender identity and an easy opt-out.

A practical compliance checklist

• Email business addresses of people whose role matches your offer. Skip personal Gmail and Hotmail addresses.
• Identify yourself and your company clearly in every email.
• Give a simple way to opt out, and suppress opt-outs across every domain and inbox you send from.
• Keep a record of where each contact came from.
• Do not mix in SMS, WhatsApp or social DMs without consent.
• Ask a UAE lawyer to review your setup if you sell into regulated sectors (health and financial data have separate rules under the PDPL's exclusions).

What's different about selling into the UAE

Language: English first, Arabic where it counts

Arabic is the official language, and the government portal notes that the expatriate community outnumbers UAE nationals, with Indians as the largest foreign community (u.ae fact sheet). The same page lists Bengali, Farsi, Malayalam, Turkish and Urdu among widely spoken languages.

Practical advice: write in clear, formal English for private sector buyers. For government-related entities or Emirati family groups, an Arabic version written by a native speaker shows respect; machine translation does the opposite. Get names, titles and honorifics right, and keep humor and slang out.

Tone and titles

Practical advice: default to a formal tone, lead with credibility (who you work with, what you do) before the ask, and keep the ask small, such as a short call. Include titles like Managing Director, General Manager and regional roles (for example "Head of MENA" or "GCC Sales Director") in your targeting. Regional titles often signal a buyer whose remit covers more than the UAE, so mention Saudi Arabia or the wider Gulf if your offer fits.

Workweek and sending windows

On January 1, 2022, federal government entities moved to a Monday to Friday week, working 7:30 a.m. to 3:30 p.m. Monday to Thursday and 7:30 a.m. to noon on Friday (Gulf Business). No directive was issued for the private sector at the time.

The government portal says most private companies close only on Sunday, some close Saturday and Sunday, and Sharjah government entities work Monday to Thursday (u.ae). The UAE runs on GMT+4 with no daylight saving.

Practical advice: send Monday to Thursday, roughly 8:30 a.m. to 11:30 a.m. Gulf time. Avoid Friday afternoons, when prayers and the short government day make replies unlikely.

Ramadan and Eid

The Ministry of Human Resources and Emiratisation reduced private sector working hours by two hours a day during Ramadan 2026 and allowed flexible or remote schedules (MoHRE). The UAE's Astronomy Centre projects Ramadan 2027 to begin on February 8, 2027, with Eid Al Fitr around March 9 or 10 (The National). Official dates depend on moon sighting.

Practical advice: keep campaigns running in Ramadan at lower volume, send in the morning, avoid aggressive follow-ups and do not schedule calls near iftar. Pause during the Eid break and restart a few days after.

Data coverage

Apollo says it has "240M+ contacts and 30M+ accounts" globally, but it does not publish a UAE breakdown that we could find. Practical advice: pull a sample of 200 contacts for your exact titles, verify them and check bounce rates before you commit. Test each segment separately, since coverage of a family-owned group can look very different from coverage of a multinational's Dubai office, and re-verify older records before every send.

LinkedIn, phone and WhatsApp

Practical advice: use LinkedIn as your second channel for UAE buyers. Phone and WhatsApp feel natural once a conversation has started, but cold marketing over those channels runs into TDRA telemarketing rules and Cabinet Decision No. 56 of 2024. Use them after a reply, not instead of one.

Want a second opinion? If you are planning a UAE campaign and want someone to sanity-check the list, offer and sending plan, book a 30-minute call with David at Koldify.

How we run cold email into the UAE

Koldify's process is the same core system for every market, adjusted for the details above. It is described in full on our cold email services page.

1. Infrastructure. Koldify owns and operates its sending infrastructure, with no middlemen. Campaigns go out from separate sending domains, never your main domain. Our guide to cold email infrastructure explains why.
2. Warmup. Inboxes warm for about three weeks before any campaign sends, and campaigns typically launch around week four.
3. List, offer and copy. We build these with you and you approve them before launch. For the UAE that means title targeting by emirate and free zone, flagging DIFC and ADGM contacts, and English copy with an Arabic option where it fits.
4. Compliance footer. Every email names the sender and includes a plain opt-out line, and opt-outs are suppressed across all inboxes.
5. Sending windows. Monday to Thursday mornings Gulf time, with lower volume in Ramadan and a pause over Eid.
6. Replies. Replies are routed to you, and you handle the conversation, booking and closing.

Engagements are month-to-month with no long-term contract. We do not promise a number of meetings or deals for the UAE or anywhere else, but you can schedule a call with David to see how the process would fit your offer.

Sample cold email for the UAE

Run your own draft through our spam word checker before sending.

Subject: [Company] expansion across the GCC

Dear [First name],

I noticed [Company] recently [opened an office in Riyadh / added a GCC sales team]. Teams at that stage often find that [specific problem, e.g. pipeline in Saudi lags behind the UAE].

We help [type of company] in the region [result in one line, no numbers you cannot prove], working with [relevant client type or reference].

Would a 20-minute call next Tuesday or Wednesday morning, Gulf time, be useful? If not, I am happy to send a short overview instead.

Kind regards,
[Your name]
[Title], [Your company]
[Website] | [Phone]

You are receiving this because of your role at [Company]. If you prefer not to hear from us, reply "remove" and we will not contact you again.
[Company legal name], [Registered address]

The footer is not mandated word for word by a federal email statute, but it puts the PDPL right to object and the DIFC "unqualified right" to object into practice.

Proof

These numbers come from koldify.io and cover Koldify's work overall. They are not specific to the UAE.

• 10M+ cold emails sent, 50K+ leads generated, $10M+ in pipeline and $2M+ in revenue generated for clients.
• Vidsec: 160+ ready-to-buy leads in 2 months and $12,000+ closed.
• Black Stone Funding Group: 120+ leads in 60 days.
• Skrapper: 140+ interested leads.
• Koldify's own outbound: about 500 leads from about 250,000 sends in 3 weeks.

Nerdy Joe is a certified Apollo.io Managed Services Partner and a PlusVibe Certified Silver Partner.

DIY instead?

If you would rather run UAE outbound yourself, this is a standard stack. Some tool links here are affiliate links (disclosure).

Add domains, Google Workspace or Microsoft 365 inboxes and an email verifier. Before you start, check that your Apollo sample for UAE titles verifies cleanly, and set sending windows to Gulf time in your sequencer. If you are comparing outside help instead, our list of B2B lead generation companies in the UAE covers local options, and the cold email India page covers the market many UAE sellers target next.

Ready to start?

If you sell into the UAE and want outbound handled end to end, from infrastructure to approved copy to replies in your inbox, book a 30-minute intro call with David at Koldify. David Tile is a partner at Koldify, and the call is a good place to test whether the UAE is the right first market for your offer.

Other markets we cover

• Cold email in United States
• Cold email in Canada
• Cold email in United Kingdom
• Cold email in Europe (EU)
• Cold email in Australia
• Cold email in Latin America
• Cold email in India
• Cold email in Singapore

How to set up a cold email campaign: the tools you'll need

Some tool links here are affiliate links (disclosure). Prices are as of October 2026.

1. Get your data (who you'll email). Build your list in Apollo by title, industry, company size and location, then export contacts with verified emails. Nerdy Joe is a certified Apollo Managed Services Partner.
2. Buy 2 to 3 sending domains. Never send cold email from your main domain. Use lookalikes (for example, getyourbrand.com). The simplest route is buying them inside your sending tool: Instantly sells done-for-you domains (about $15 a year), Smartlead sells them through SmartSenders, and PlusVibe offers a done-for-you setup. Before you buy, check whether domains bought in a tool can be moved out later; some Instantly users report they can't.
3. Create 2 to 3 inboxes per domain. Google Workspace or Microsoft 365 inboxes, not one big inbox. Instantly sells done-for-you Google inboxes (about $5 a month, or $10 pre-warmed), Smartlead sells pre-warmed Google and Outlook inboxes (about $9 a month), and PlusVibe can set them up for you. Done-for-you setups configure SPF, DKIM and DMARC for you.
4. Warm up for about 3 weeks. Warmup is built into Instantly, Smartlead and PlusVibe. Keep it running after launch.
5. Write and check your sequence. Three to five short emails. Run each one through our free Spam Word Checker.
6. Launch slowly. Start at about 20 to 30 emails per inbox per day in Instantly, Smartlead or PlusVibe, and watch bounces and replies. Use our Cold Email Cost Calculator to size domains, inboxes and spend.

Rather not run it yourself? Koldify, the done-for-you cold email agency where David Tile is a partner, builds and runs all of this on infrastructure it owns. Book a 30-minute call with David.

Sources

• Pinsent Masons, "Business in the UAE: navigating the data protection regime": https://www.pinsentmasons.com/out-law/guides/business-in-the-uae-navigating-data-protection-regime
• Baker McKenzie, UAE legal bases for processing personal data: https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/legal-bases-for-processing-of-personal-data
• DLA Piper, Data Protection Laws of the World, UAE (last modified January 27, 2025): https://www.dlapiperdataprotection.com/countries/uae-general/law.html
• Business CISO, "UAE PDPL Executive Regulations: Status in 2026" (updated September 2026): https://business-ciso.com/blog/uae-pdpl-executive-regulations-status
• Modulos, UAE PDPL scope, enforcement and the executive regulation: https://docs.modulos.ai/frameworks/uae-pdpl/scope-enforcement-and-the-executive-regulation
• Hunton, "New Dubai IFC Data Protection Law": https://hunton.com/media/legal/67985_new-dubai-ifc-data-protection-law.pdf
• Taylor Wessing, "New Abu Dhabi Global Market data protection law": https://www.taylorwessing.com/en/insights-and-events/insights/2021/04/new-abu-dhabi-global-market-data-protection-law---key-changes-you-need-to-consider
• UAE Government portal, fact sheet: https://u.ae/en/about-the-uae/fact-sheet
• Gulf Business, UAE four-and-a-half-day working week: https://gulfbusiness.com/en/2021/uae/uae-switches-weekend-announces-four-and-half-day-working-week
• MoHRE, Ramadan 2026 working hours: https://mohre.gov.ae/en/media-center/news/12/2/2026/reduction-of-working-hours-for-private-sector-employees-by-two-hours-daily-during-the-holy-month-of
• The National, expected Ramadan 2027 dates: https://www.thenationalnews.com/news/uae/2026/10/06/ramadan-2027-uae-dates-eid-al-fitr-holiday/
• Apollo.io homepage (database size): https://www.apollo.io/