Website development in Dubai, and what actually shapes the build
Four federal rules, one language decision and a payments question decide most of a UAE website project before anyone opens a design tool.
Last reviewed 2026-10-03.
Three different buyers, one search phrase
Website development in Dubai is one phrase covering three jobs that share almost nothing technically. Knowing which one you are doing saves most of the arguments later.
- A new free zone or mainland company
- Needs a site that proves the company exists and can take an enquiry. The hard parts are not engineering. They are the licence details that have to appear, the domain, the business email and a lead path someone actually monitors.
- An established company replatforming
- Already has traffic, rankings and often a decade of URLs. Here the engineering risk is migration, not design. Redirects, canonicals and whatever integrations the sales team quietly depends on.
- A regional brand going bilingual
- Needs the same content to work in English and Arabic without either one feeling like an afterthought. This is the version people most often underestimate, and it has its own post below.
The third case is where most budget overruns live, because bilingual work is usually priced as translation and delivered as engineering.
The rules that shape the build before design starts
A site selling into the UAE sits inside a small set of federal laws. None of them are long, all of them are published, and they decide things a designer would otherwise decide by taste.
Trading by modern technological means
Federal Decree-Law No. 14 of 2023 on trading by modern technology based means replaced the 2006 electronic commerce law. It governs selling goods, services and data through websites, apps and social platforms, and it sets out what a provider has to disclose, the duty to issue an invoice without paper, consumer rights and how disputes are settled. Read it before you write the terms page, not after.
Consumer protection
Federal Law No. 15 of 2020 on consumer protection, as later amended, is the reason returns, warranties and price claims belong in the build rather than in a document nobody links to. A refund policy that exists only in a PDF is a design failure with a legal edge.
Personal data
Federal Decree-Law No. 45 of 2021 on the protection of personal data has been in force since 2 January 2022. The detail worth knowing, and the detail most agency pages get wrong, is that its executive regulations have still not been published. The law applies; the implementing detail does not exist yet. The practical answer is to build to the principles in the law itself, which the federal portal summarises on its data protection page, and to avoid designs that only work if a future regulation turns out to be permissive.
Prices and VAT
Article 27 of Cabinet Decision No. 52 of 2017, the executive regulation of the VAT law, requires advertised and published prices to be inclusive of tax, with narrow exceptions such as exports and supplies to registered businesses where the exclusion is stated clearly. That is a template decision, not a finance decision. A theme that renders a bare number next to every product is already wrong, and the Federal Tax Authority legislation page is the place to confirm the current text.
Where this lands in the build: licence identifiers and provider identity in the footer and on the terms page, a returns policy that is reachable from a product page in one click, tax inclusive price rendering at the template level, and a consent and retention model designed to the law rather than to whatever the tag manager makes easy.
Arabic is an architecture decision
The common failure is treating Arabic as a content task that can be added once the English site is signed off. It cannot, because direction affects layout, not just words. A component built with left and right hardcoded in its stylesheet has to be rewritten rather than translated.
The decisions that have to happen before any page is built are the URL strategy, whether direction is a document level or a component level concern, the font stack for each script, and who writes and approves the Arabic. Those four, in that order. The engineering detail behind each one is set out in the bilingual build guide.
One decision worth making early even if Arabic is phase two: keep direction out of your component styles from day one by using logical CSS properties. It costs nothing on an English only site and it is the difference between a week and a quarter when Arabic arrives.
Payments, and the part that is not the gateway
Gateway choice gets most of the attention and deserves the least. Acquiring in the UAE routes through a small number of providers, your licence type and bank decide which of them will onboard you, and the integration work is comparable across them. Terms move often enough that any number quoted in an article is unreliable, so compare on the provider's own page at the time you sign.
The parts that actually cost engineering time are settlement currency and what happens when a payment half succeeds. If the site prices in dirhams and settles in dirhams, life is simple. If it prices in dirhams and sells to customers paying in other currencies, something has to own the conversion, and that something should not be a spreadsheet. Add strong customer authentication to the list: a card flow that assumes the shopper never leaves the page will break the first time a bank challenges the transaction.
- Decide the settlement currency before the checkout is designed.
- Treat the authentication redirect as a normal path, not an error path.
- Build the refund path in the first release. It is not a phase two item under a consumer protection regime.
- Reconcile against money received rather than against orders created.
Where the site should actually live
There are now cloud regions inside the country. AWS runs a Middle East region in the UAE, and Azure runs regions in Dubai and Abu Dhabi, both listed on their own infrastructure pages (AWS, Azure). That matters for two different reasons that get conflated.
The first is latency, and for a content site it is mostly solved by a content delivery network rather than by the origin's location. A cached page served from an edge location in the Gulf is fast regardless of where the origin sits. An uncached page that makes six database calls to a server on another continent is slow no matter how good the theme is. If a Dubai site feels slow, measure time to first byte from inside the region before blaming images.
The second is data residency, which is a legal and procurement question rather than a performance one. Some buyers, particularly in government adjacent work, will require data to stay in country. If that requirement might appear, choose the region at the start, because moving a live database between regions is a migration project.
On domains: .ae is administered by the .aeDA, part of the Telecommunications and Digital Government Regulatory Authority, and registrations go through accredited registrars rather than the registry. Second level zones such as co.ae carry extra eligibility conditions tied to the kind of entity you are, which the registry policy pages set out. Settle this before the brand is printed on anything.
Who builds it
Four models get used in Dubai, and the honest differences between them are about who carries continuity rather than who writes better code.
| Model | Works well for | Fails when |
|---|---|---|
| Local agency, fixed scope | A defined site with a launch date and little ongoing change | Scope moves, or the site becomes a product and the retainer does not cover product work |
| Freelancer | A small site where one person can hold the whole thing | That person becomes unavailable and nothing is documented |
| In-house hire | Continuous change, internal systems, long horizon | One person has to cover design, front end, back end and infrastructure |
| Distributed team alongside your own | Ongoing delivery where you want to keep the decisions | Nobody on your side owns priorities, so the team waits |
No model removes the need for someone internal to own the roadmap. The models differ in how expensive it is when that person does not exist.
FuturByte sits in the fourth row. We put engineers alongside your team rather than taking the project away, through staff augmentation or a dedicated team, and the how it works page describes the sequence. For a one page brochure site that is the wrong shape and a local agency is the better answer.
The scope questions that prevent a rebuild
Most Dubai website projects that get rebuilt within two years were scoped without an answer to one of these.
- Who edits this site next month, and in which language or languages?
- Does Arabic ship, and if not now, is the markup ready for it?
- Which internal systems does it have to talk to, and does an interface for them already exist?
- What has to appear on every page for licence and tax reasons?
- Who owns the domain, the registrar login and the hosting account?
- If this is a replatform, where is the list of existing URLs?
- Who is on the hook when a payment succeeds and the order does not?
The last one is the single best predictor of whether a launch goes quietly. Sites that have an owner for that case tend to have owners for the rest.
Frequently asked questions
Do I need a UAE licence before launching a website?
To sell to UAE consumers, yes. Trading through a website, app or social account is a licensed activity, and the licence determines what the site may offer. The licence also produces the identifiers the site has to display, so it is a dependency of the build rather than a parallel task.
Does a Dubai website have to be in Arabic?
Arabic is required in more situations than most English language project briefs assume, and whether a specific element must appear in Arabic depends on the activity and the authority supervising it. The safer engineering position is to build so Arabic can be added without touching layout code, then confirm the specific obligations with the relevant authority rather than with an agency article.
Should prices on a UAE site include VAT?
Advertised and published prices must be inclusive of tax under Article 27 of the executive regulation of the VAT law, with narrow exceptions such as exports and supplies to registered businesses where the exclusion is clearly stated. Treat it as a template level rule so no page can render a bare pre-tax figure.
Does my site have to be hosted in the UAE?
Not as a general rule. Hosting location is mainly a procurement and data residency question, and some buyers will require in country data. Performance for a content site is usually decided by caching and edge delivery rather than by where the origin server sits.
Is the UAE data protection law enforced if the executive regulations are not out?
The law itself has been in force since January 2022, so the obligations in it apply. What is missing is the implementing detail. Build to the principles in the law, keep a record of why each piece of personal data is collected, and avoid designs that depend on a permissive reading of a regulation that does not exist yet.
Can a non resident company register a .ae domain?
A first level .ae name is open to registrants generally, while second level zones such as co.ae carry eligibility conditions tied to the type of entity. Registration happens through an accredited registrar rather than directly with the registry.