Data Protection Laws Across the GCC, Side by Side: Oman, Saudi Arabia, the UAE, Bahrain, Qatar and Kuwait
Five of the six GCC states now have a general personal data protection law: Oman, Saudi Arabia, the UAE, Bahrain and Qatar. Kuwait regulates personal data mainly through a regulation issued by its telecommunications regulator. The laws agree on the basics — consent at the centre, rights for individuals, breach notification, controls on sending data abroad.
They differ in the places that change how you build systems. Oman and Saudi Arabia reach companies outside their borders. The UAE’s federal law is in force, but its executive regulations had still not been issued at the time of writing. Saudi Arabia and Bahrain allow processing on legitimate interests; Oman does not. And each country runs its own breach clock and transfer rules.
If you operate in more than one GCC country, or sell into one from another, you are already subject to more than one of these laws.
The comparison at a glance
| Oman | Saudi Arabia | UAE (federal) | Bahrain | Qatar | Kuwait | |
|---|---|---|---|---|---|---|
| Instrument | Royal Decree 6/2022, amended by Royal Decree 68/2026 | PDPL, Royal Decree M/19 of 2021, amended 2023 | Federal Decree-Law 45/2021 | Law 30/2018 | Law 13/2016 | CITRA Decision 26/2024 (a regulation, not a law) |
| Applies since | February 2023; amendments from 7 Sep 2026 | 14 Sep 2023; grace period to 14 Sep 2024 | 2 Jan 2022; executive regulations not issued | 1 Aug 2019 | Issued Nov 2016 | Decision issued 2024 |
| Regulator | Ministry of Transport, Communications and IT | SDAIA | UAE Data Office; see note below | Personal Data Protection Authority, functions exercised by the Ministry of Justice | National Cyber Security Agency | CITRA |
| Reaches companies abroad? | Yes — data of people in Oman, processed inside or outside | Yes — data of people residing in the Kingdom | Yes — data of people in the UAE | Mainly processing in Bahrain | Not a defining feature | Licensed providers only |
| Processing without consent | Four listed cases; no legitimate interest | Listed cases, including legitimate interest (not for sensitive data) | Listed cases; no legitimate interest | Listed cases, including legitimate interest | “Lawful purpose” and listed cases | Consent-based |
| Breach notification to regulator | 72 hours, where rights are threatened | 72 hours, where harm is likely | “Immediately”, timing left to regulations | 72 hours | 72 hours under regulator guidance, where damage is likely | Short deadline; check current text |
| Heaviest penalty | OMR 100,000–500,000 for unlawful transfer abroad | Up to SAR 5 million, doubled for repeat; prison for disclosing sensitive data | Set by Cabinet decision, not yet issued | Up to one year in prison and BHD 1,000–20,000 | Up to QAR 5 million | Under CITRA’s own law: up to 5 years in prison and/or KWD 20,000 |
The UAE note: a new federal AI and data authority was announced in June 2026 and is reported to absorb the UAE Data Office. The free zones of the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) run their own separate regimes. Both are covered in the UAE’s three data protection regimes.
Read the table as a map, not a compliance checklist. Each cell compresses an article, a regulation and sometimes regulator guidance into a few words.
What every law has in common
The overlap is large enough to build on.
Consent is the default. Every regime starts from the data subject’s consent and then lists the situations where processing may go ahead without it. Some lists are longer than others, but none of these laws treats consent as optional paperwork.
People have rights you must be able to service. Access, correction, deletion and objection appear everywhere in some form. Whether you can answer a request depends on whether your systems know where each person’s data lives. That makes it an engineering question rather than a legal one.
Breaches must be reported, fast. Where a clock is fixed, it is 72 hours or shorter. That is too short to discover an incident, investigate it and draft a notice unless logging and an escalation path already exist.
Sending data abroad is controlled. No GCC law prohibits transfers outright, and none lets them happen without conditions. The conditions differ, and that is where most of the design work sits.
Sensitive data carries extra weight. Health, biometric and genetic data and criminal records attract permits, authorisations or stricter conditions in most of these laws.
Where they differ in ways that change your systems
Reach: whose law follows your data
Oman’s amended Article 2 applies the Law to personal data of natural persons in Oman, whether the processing happens inside or outside the country. Saudi Arabia’s PDPL covers processing of personal data of individuals residing in the Kingdom by entities outside it. The UAE’s federal law covers controllers and processors outside the UAE that process the data of people inside it.
The consequence for a Muscat company selling into Riyadh or Dubai is direct. Its own systems in Oman fall under the Saudi or UAE law for those customers’ records. SDAIA opened registration to controllers outside the Kingdom in October 2026, which removes the practical excuse that there was no way to register. What the Saudi PDPL requires from a company outside the Kingdom covers that in detail.
Lawful basis: legitimate interest exists in some laws and not others
Saudi Arabia’s 2023 amendments allow processing without consent where the controller has a legitimate interest, provided it does not prejudice the data subject’s rights and the data is not sensitive. Bahrain also recognises legitimate interests.
Oman does not. After the September 2026 amendments, processing without explicit consent is allowed in four listed cases only: a legal obligation, publicly available data, a vital interest when the person cannot be reached, and a contract that says the processing complies with the Law. The UAE federal law likewise has no general legitimate-interest basis.
A system designed around a single “legitimate interest” checkbox will be wrong for Oman and the UAE. Design consent as the default and record, per purpose, which exception you rely on in each country.
Transfers: five different mechanisms
- Oman: explicit consent of the data subject before transfer, unless an international agreement applies or the data is anonymised. You must also ensure the receiving party offers protection no lower than Oman’s, and keep a written assessment the Ministry can ask for. An unlawful transfer carries the Law’s heaviest fine.
- Saudi Arabia: transfers to jurisdictions with an adequate level of protection, or under appropriate safeguards, with limited exceptions. A draft amendment under consultation until 5 November 2026 would make storing personal data inside the Kingdom the default. It is not yet in force.
- UAE (federal): transfers to jurisdictions with adequate protection, plus derogations such as express consent and contract performance. Much of the detail waits on the unissued regulations.
- Bahrain: transfers to countries on the Authority’s approved list, or with case-by-case permission or a listed exception.
- Qatar: the law is framed against unnecessarily restricting cross-border flows. Transfers are permitted for a lawful purpose or with consent, subject to the law’s conditions.
If your systems replicate data between countries — a shared CRM, a group ERP, a central data warehouse — each arrow on that diagram needs a basis under the law of the country it leaves. Where your company’s data is allowed to live covers Oman’s side in depth.
Sensitive data: permits versus conditions
Oman requires a Ministry permit to process sensitive categories. Since September 2026 there is an exemption for employee data used within internal operations and for security cameras. Qatar requires authorisation and additional conditions for its special categories. Bahrain requires prior authorisation for biometric and genetic processing, among others. Saudi Arabia does not run a general permit system, but excludes sensitive data from its legitimate-interest route and attaches its only prison penalty to unlawful disclosure of sensitive data.
Registration and paperwork
Saudi Arabia requires certain controllers to register on SDAIA’s National Data Governance Platform. Bahrain requires notification to the Authority and prior authorisation for some processing. Oman requires a permit for sensitive data, a record of processing activities, a published data protection policy, and a designated data protection officer. Paperwork differs. The underlying artefact does not: a maintained inventory of what you hold, why, where and for how long.
Enforcement maturity
Saudi Arabia’s grace period ended in September 2024, and its regime was being actively enforced by early 2026. Oman’s ended on 5 February 2026, so its regulator is now in the enforcement phase. The UAE’s federal law cannot be fully enforced until its regulations and penalty decision exist. In the DIFC and ADGM, the regulators have had working regimes for years. Kuwait’s regulation reaches licensed providers rather than the whole economy.
That does not make the UAE federal law optional. It makes the timing of enforcement uncertain, which is a worse planning position than a known deadline.
Designing one system for several countries
Three approaches work in practice.
Highest common denominator. Build every flow to the strictest applicable rule — explicit consent, purpose-based erasure, 72-hour breach readiness, documented transfer assessments. Simple to reason about, sometimes more friction than a single market needs.
Shared core, country configuration. One system, with consent wording, retention periods, lawful-basis records and hosting location set per country. This is the pattern most mid-sized groups end up with. It mirrors the tax approach in expanding across the GCC with one system or several.
Separate instances. Separate deployments per country where a law or a sector regulator demands local storage. The most expensive option, and the one to adopt only when a specific constraint forces it.
Whichever you choose, five artefacts carry over between countries with little change:
- A data inventory tagged by country of the data subject.
- A processor register showing where each vendor stores data.
- Consent records that store wording, version and timestamp.
- A breach runbook with each country’s notification clock.
- A transfer map with the legal basis for every cross-border flow.
Which of these laws apply to you?
Work through four questions:
- Where are you established? That country’s law applies to you.
- Where do your customers and staff live? In Oman, Saudi Arabia and the UAE, that alone can bring in their law.
- Where is the data processed? Hosting and processing locations engage transfer rules, and in Bahrain they help define the law’s reach.
- Are you in a free zone or a regulated sector? DIFC, ADGM and the Qatar Financial Centre have separate regimes. Banking, health and telecoms often add sector rules on top.
If GDPR might also be in play — because you serve customers in Europe — read does GDPR apply to a company in Oman or the Gulf.
Frequently asked questions
Which GCC country has the strictest data protection law? It depends on the obligation. Oman prices unlawful transfers abroad most heavily and allows no legitimate-interest processing. Saudi Arabia has the highest general fine ceiling and the only prison penalty for sensitive-data disclosure. For a multi-country business, the strictest rule differs by topic, so design per obligation rather than per country.
Do I need consent for every processing activity in the GCC? Consent is the default everywhere, but every law lists exceptions. Oman’s list is narrow: a legal obligation, public data, a vital interest, or a contract that states the processing complies with the Law. Saudi Arabia and Bahrain also allow legitimate interests in defined conditions.
Is the UAE data protection law enforceable yet? The federal law has been in force since 2 January 2022, but its executive regulations and the Cabinet decision on penalties had not been issued at the time of writing. The DIFC and ADGM regimes are fully operational within those free zones.
Does Kuwait have a data protection law? Not a general one. Kuwait relies mainly on CITRA’s Data Privacy Protection Regulation, which applies to licensed telecommunications and ICT providers, alongside protections in its e-commerce and cybercrime laws.
Can I keep all my GCC customer data in one country? Often yes, but each transfer into that country needs a basis under the law of the country the data leaves. Oman requires explicit consent or another listed basis plus an assessment. Saudi Arabia’s draft rules would make local storage the default if adopted. Plan the architecture before you sign a hosting contract.
How quickly must a breach be reported in the GCC? Where a deadline is fixed, it is generally 72 hours or shorter from awareness, with conditions about risk or harm. The UAE federal law says “immediately” and leaves the timing to its unissued regulations. Keep one runbook with each country’s clock on it.
This article states the position under the laws, regulations and published drafts in force or open for consultation on 21 October 2026, the date of publication. It is not legal advice. Several of these regimes changed during 2026 and more changes are pending; confirm your position in each country with a qualified adviser.
Sources: Royal Decree 68/2026 amending Oman’s PDPL · DLA Piper — Saudi Arabia data protection · Clyde & Co — SDAIA draft amendments, October 2026 · Clyde & Co — UAE data protection law · DLA Piper — Bahrain · DLA Piper — Qatar · DLA Piper — Kuwait · Addleshaw Goddard — Saudi PDPL amendments, 2023
Running systems across more than one GCC country? ZAWAT builds business systems and handles integration and support with country-specific consent, retention and hosting designed in. Book a call.