Attackers use the common routes: an unpatched web server, a reused password, a vendor with access. In retail, those routes end near card data, loyalty accounts and third-party code that runs in your customer’s browser.
Contact
Delivery
Payment
Your order
An exposed web application, a stolen password, a phish to a store or support team.
42%of retail trade breaches began with exploitation of vulnerabilities (Verizon DBIR 2026, retail trade, NAICS 44-45)
What a script, an API or an export can read: card numbers typed at checkout, and the profiles, points and saved details behind a login.
68%of retail trade breaches involved a third party (Verizon DBIR 2026, retail trade, NAICS 44-45)
PCI DSS v3.2.1 was retired. Assessments are against v4.x.
The future-dated requirements of PCI DSS v4.0 took effect. They now count in every assessment.
The PDPL requires the controller to notify the UAE Data Office when it becomes aware of a breach. The Executive Regulations set the detail.
PCI DSS v4.0.1 is a limited revision of v4.0. It adds and deletes no requirements. The PCI Council advises checking with your acquirer or the payment brands which obligations apply to you.
The PDPL requires breach notice to the UAE Data Office (Article 9). Decree-Law 14 of 2023 asks online traders for a technically safe environment (Article 5(3)) and bars trading consumer data without consent (Article 10(2)(d)).
Source: PCI Security Standards Council; UAE Legislation portal, Federal Decree-Law 45 of 2021 and Federal Decree-Law 14 of 2023. This is analysis, not legal advice.
The same security decision gets a different answer once card data, loyalty accounts and shoppers’ browsers are in the picture.
Itemised for a retailer
Support agents who can reset loyalty accounts, staff who export customer lists, and the people who edit the checkout page.
Elsewhere: Domain administrators.
By whether their code runs on your payment page, and who can change it without your approval.
Elsewhere: By spend, or by the data they hold.
Return checkout to a known-good page, remove the rogue script, and work out which card and customer data it could see.
Elsewhere: Restore the systems from backup.
When customer personal data may be involved. The PDPL ties notice to the moment you become aware.
Elsewhere: When the facts are clear.
One case path for account takeover, because stolen points and saved cards are both fraud and a breach.
Elsewhere: Two teams, two queues.
TotalA different plan
Find every script on checkout pages, who owns it and who approved it, against requirements 6.4.3 and 11.6.1.
Sort tag, widget and payment vendors by what they can alter on your site without your approval.
Review how accounts are reset, how points move and how fraud and security share one case path.
Map where card data flows, which assessment applies through your acquirer and what evidence is missing.
UAE rules, by who you are
The research found no retail-specific cyber regulator in the UAE. A retailer’s duties come from data law, card-scheme contracts and the terms its partners set. Do not call card standards UAE law.
Binding lawFederal Decree-Law No. 45 of 2021 (PDPL), Articles 20 and 21, subject to scope and exclusions.
Use suitable technical and organisational security. Protect systems that hold customer data. Restore access after a failure. Test whether safeguards work. High-risk processing, such as profiling at scale, can require an impact assessment.
Confirm: The PDPL does not itself set a universal yearly penetration test.
Binding lawADGM Data Protection Regulations 2021, or the DIFC Data Protection Law for DIFC entities.
Free zones run their own data regimes. Use the one that matches the entity that processes the data. Do not assume the mainland PDPL is the only regime.
Contract termCard-scheme and acquirer requirements, including PCI DSS, set by contract.
PCI DSS is a contractual standard, not UAE statutory law. Confirm what your acquirer requires of your payment environment, point-of-sale systems and web checkout.
Confirm: Treat acquirer duties separately from statutory duties.
Contract termCustomer and partner contracts. PDPL where it applies.
Partners can require evidence, incident notice, access limits and audits. Identify your data processors and keep the contract terms in a register.
This is analysis, not legal advice. Data-protection law is not one regime in the UAE: the federal PDPL, ADGM and DIFC each have their own. A security duty does not by itself create a yearly penetration test. Confirm which regime and standard apply to each entity and data set with your counsel.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a retailer through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
Payment Card Industry Data Security Standard
Any retailer that stores, processes or transmits card data: stores, online, apps and call centers. Using a payment provider can reduce scope, not remove it.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilEU General Data Protection Regulation
You sell to shoppers in the EU, or run loyalty schemes aimed at them.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679AICPA System and Organization Controls 2
Asked of commerce platforms, processors and marketing vendors.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point for logistics and technology suppliers.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Sources and method. This page is analysis, not legal advice.
