Any UAE-licensed company making promotional calls must screen every number against the TDRA Do Not Call Registry, call only from a number registered to its trade licence, record the call and say so, and stay inside 9am to 6pm. Most of that is a phone system configuration problem, not a policy document.
What changed, and why it is a telephony problem
The UAE has had a Do Not Call Registry for years. What changed is enforcement and scope. Cabinet Resolution No. 56 of 2024 set out the telemarketing regime, and a companion resolution attached administrative violations and penalties to it. The rules apply to every company licensed in the UAE, free zones included.
The numbers show this is being enforced rather than announced. TDRA reported AED 19.19 million in fines and 9,433 numbers disconnected for telemarketing violations in the period through June 2026, against 3,301 violations recorded for individuals and 92,748 numbers flagged by the public, according to reporting in Khaleej Times.
Read the obligations closely and most of them are not policy commitments. They are settings. Which number your calls originate from, whether a list is screened before it is dialled, whether the call is recorded, whether the campaign can run at 8pm — all of that lives in the PBX, the trunk configuration and the dialler. A compliance policy that lives only in a staff handbook will not survive a complaint, because the evidence TDRA looks at comes out of the phone system.
The five obligations
Prior consent. You need the consumer's prior approval before making a promotional call, and you need to be able to show it. In practice this means the consent state belongs in the CRM record and needs to be visible to the agent at the moment the call connects, not buried in a marketing database nobody opens.
DNCR screening. Numbers on the Do Not Call Registry must not receive promotional calls. Consumers register by texting DNCR to 2211, and the registry is administered through the UAE's licensed operators — e& publishes the business-facing process. The registry is not static, so screening is a recurring check against your calling lists, not a one-off import.
A registered company number. Calls must originate from a local number issued by a UAE-licensed operator and registered under the company's commercial licence. This is the obligation most often broken by accident: a salesperson calls a prospect back from their own mobile because it is quicker. Reported penalties for an individual doing that start at AED 5,000 plus suspension of every number registered in their name, rising to AED 50,000 and a twelve-month service ban for repeat offences.
Recording, with notice. Telemarketing calls must be recorded, and the consumer must be told at the start of the call that recording is taking place. Both halves matter. A recording made without the notice does not help you.
Permitted hours. Promotional calls are limited to 09:00–18:00 UAE time, with no follow-up calls after a consumer has declined and no pressure tactics.
Where each obligation actually gets enforced
Two of these — consent and the recording notice — depend partly on people. The other four are decided entirely by configuration, and configuration is testable in a way that training is not.
The black points mechanism is the part to understand
Fines are the visible penalty. The operational one is quieter and lands faster.
Violations accrue black points against the originating number. Once a number crosses the threshold, it goes onto the Do Not Originate Register, and the carrier bars its outbound calls. The number still receives calls. It simply stops being able to place them.
This is worth dwelling on if your business runs a single pilot number across a sales floor. A handful of violations attributed to one number can take that number's outbound capability away, which means a team that cannot dial out and a main line that has suddenly stopped behaving like a main line. The mitigation is architectural: separate the numbers used for outbound campaigns from the numbers your business depends on, and make sure the campaign numbers are the ones carrying campaign risk.
What this means for the UAE and the wider GCC
Two things are specific to this market and neither is obvious from a global vendor's documentation.
You cannot buy your way around the carrier. Voice services in the UAE are delivered by the two licensed operators, e& and du, or in collaboration with them. You cannot provision a UAE number from an overseas cloud provider and use it as your registered company number, because it will not be a local number issued by a licensed operator. Any architecture that assumes self-service number provisioning — common in North American and European deployments — needs rethinking before it reaches a UAE rollout. This is the same constraint that shapes VoIP in the UAE generally.
Your CLI policy is a compliance control, not a cosmetic one. On most phone systems, outbound caller ID is treated as a presentation preference. Here it determines whether a call is compliant. That makes outbound CLI rules something to design deliberately — per user, per queue, per campaign — and to audit, rather than something set once during installation and forgotten.
Across the GCC the direction is similar even where the detail differs: licensed-carrier origination, registered business identity on outbound calls, and consent regimes with real penalties. Architecture that satisfies the UAE rules tends to port reasonably well; architecture that assumes cloud-provisioned numbers does not.
Building the controls into the system
The practical question is which of these your current platform can enforce without a person remembering to do it.
A capable Wildix UC&C deployment, or a full contact-centre platform of the kind covered in our look at contact centre platforms, gives you the pieces: per-queue and per-user outbound CLI rules, call recording with retention policy, time-of-day routing that will not place a campaign call outside permitted hours, and CRM integration so the agent sees consent state on screen pop rather than trusting memory.
The DNCR screening step is the one that usually needs building rather than configuring. It belongs in front of the dialler: a check that runs against the current registry before a number is offered to an agent, and that suppresses the record rather than flagging it after the fact. Where outbound campaigns are driven from a CRM, that check is best placed in the integration layer between the CRM and the telephony platform, so that no path to the dialler bypasses it.
The same logic applies to automated and AI-driven outbound calling, which does not get a lighter regime for being automated — if anything the opposite, since volume and speed make an unscreened list expensive quickly. The constraints described in our article on AI-powered telephony in the UAE apply here directly: the compliance controls have to sit in front of the automation, not beside it.
A short checklist
Work through these against your own deployment. Each is answerable today.
- Can you name the exact number every outbound promotional call originates from, and is it registered under the trade licence?
- Can a salesperson place a promotional call from a personal mobile without anything stopping them?
- Is DNCR screening a step in your dialling path, or a spreadsheet somebody refreshes?
- Are promotional calls recorded, and does the recording notice actually play?
- Can a campaign dial at 19:30 if somebody schedules it badly?
- If TDRA asked you to evidence consent for one specific call last month, how long would it take?
Questions 2, 3 and 5 are the ones that most often come back with an uncomfortable answer. They are also the three that are fixed purely in configuration.
Getting it right without stopping the sales floor
None of this requires abandoning outbound calling. It requires the controls to live in the system rather than in people's habits, so the compliant path is the default path and the non-compliant one is not available.
NETON configures UAE outbound calling environments to these requirements — CLI policy, recording and retention, time-of-day rules, and DNCR screening in the dialling path — on Wildix and Sangoma platforms and in integration with Odoo and other CRMs.
Where each obligation is actually enforced
| Obligation | Enforced by | What goes wrong without it |
|---|---|---|
| Prior consent | CRM record, surfaced to the agent on screen pop | Agent cannot prove consent when a complaint is filed |
| DNCR screening | Dialler or CRM integration, checked before dial | Calls to registered numbers - the violation TDRA acts on first |
| Registered caller ID | SIP trunk and PBX outbound CLI policy | Calls traced to an unregistered or personal number |
| Call recording | PBX or contact-centre recording, retention policy | No evidence to defend a disputed complaint |
| Recording notice | IVR announcement or agent script at call start | Recording exists but was not disclosed |
| Calling hours | Campaign scheduler and outbound time-of-day rules | Out-of-hours calls, logged and traceable |
Frequently asked questions
Does DNCR apply to my business if we are in a free zone?
Yes. Cabinet Resolution No. 56 of 2024 applies to companies licensed in the UAE including those in free zones. A free-zone licence does not exempt a company from the telemarketing rules.
Can we call a customer who is on the DNCR if they gave us consent?
No. Registration on the Do Not Call Registry overrides prior consent for promotional calls. Consent and DNCR screening are two separate checks and you need to pass both.
What counts as a registered company number for outbound calls?
A local number issued by a UAE-licensed telecom operator - e& or du - and registered under the company's commercial licence. Calling from a staff member's personal mobile is the violation that carries an immediate fine and number suspension.
Do we have to record every promotional call?
Recording is required for telemarketing calls, and the consumer must be told at the start of the call that it is being recorded. Retention and access controls are your responsibility under UAE data protection rules.
What are the penalties for a company that breaches the rules?
Reported penalties for companies range from AED 10,000 to AED 150,000, with possible licence suspension or cancellation and disconnection of telecom services for up to a year. Individuals calling from personal numbers face an initial AED 5,000 fine and suspension of every number registered in their name.
How does the black points system work?
Violations accumulate black points against the originating number. A number that reaches the threshold is placed on the Do Not Originate Register, after which its outbound calls are barred at carrier level - the number keeps working for inbound but stops being able to dial out.
Sources
- Cabinet Resolution No. 56 of 2024 concerning the Telemarketing Regulations — UAE Legislation — 2024-08
- Administrative Violations and Penalties for acts violating the Telemarketing Regulations — UAE Legislation — 2024-08
- Cabinet Resolution No. (56) of 2024 on the Telemarketing Regulations (PDF) — UAE Ministry of Economy and Tourism — 2024
- Telecommunications and Digital Government Regulatory Authority — TDRA — 2026
- TDRA FAQs — TDRA — 2026
- Dh19 million in fines issued, 9,433 numbers cut in UAE for telemarketing violations — Khaleej Times — 2026-08
- Do Not Call Registry (DNCR) — e& UAE — 2026
- How to block telemarketing calls in the UAE — Gulf News — 2022-11
- Telemarketing Regulations in the UAE — LYLAW — 2025
- Your Guide to Reporting Telemarketing Calls under UAE Regulations and Penalties — ATB Legal — 2025
Configuring outbound calling for UAE compliance
Phone: +971 4 439 5754 | WhatsApp: +971 52 644 6541
Get a Free Consultation