{
 "meta": {
  "title": "GCC data protection laws compared — primary-source dataset",
  "prepared": "2026-10-22 (Asia/Dubai)",
  "prepared_for": "qanu.ai",
  "verified_values": {
   "true": "checked against an official or primary text (article cited)",
   "UNVERIFIED": "could not be confirmed against an official source",
   "secondary source": "no official text available; secondary source used"
  },
  "field_order": [
   "official_name_number_dates",
   "regulator",
   "scope_territorial",
   "lawful_bases",
   "consent_default",
   "sensitive_data",
   "data_subject_rights",
   "dpo_requirement",
   "registration_notification",
   "breach_notification",
   "cross_border_transfer",
   "data_localisation",
   "max_penalties",
   "grace_periods",
   "recent_amendments_2023_2026"
  ],
  "counts": {
   "KSA": {
    "verified": 15
   },
   "UAE_federal": {
    "verified": 15
   },
   "DIFC": {
    "verified": 14,
    "UNVERIFIED": 1
   },
   "ADGM": {
    "verified": 15
   },
   "Bahrain": {
    "verified": 14,
    "UNVERIFIED": 1
   },
   "Qatar": {
    "verified": 13,
    "UNVERIFIED": 2
   },
   "QFC": {
    "verified": 7,
    "UNVERIFIED": 8
   },
   "Oman": {
    "verified": 15
   },
   "Kuwait": {
    "verified": 11,
    "UNVERIFIED": 4
   }
  },
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Source: Qanu",
  "page_en": "https://www.qanu.ai/en/guides/gcc-data-protection-laws",
  "page_ar": "https://www.qanu.ai/ar/%D8%A3%D8%AF%D9%84%D8%A9/%D9%85%D9%82%D8%A7%D8%B1%D9%86%D8%A9-%D9%82%D9%88%D8%A7%D9%86%D9%8A%D9%86-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%AE%D9%84%D9%8A%D8%AC",
  "reviewed": "2026-10-22"
 },
 "jurisdictions": {
  "KSA": {
   "jurisdiction_en": "Kingdom of Saudi Arabia",
   "jurisdiction_ar": "المملكة العربية السعودية",
   "official_name_number_dates": {
    "value_en": "Personal Data Protection Law (PDPL), Royal Decree No. M/19 dated 9/2/1443H (16 Sep 2021), approving Council of Ministers Resolution No. 98 dated 7/2/1443H; published 17/2/1443H (24 Sep 2021). Amended by Royal Decree No. M/148 dated 5/9/1444H (27 Mar 2023). In force 14 Sep 2023 (720 days after publication, original Art 43). BOE status: in force.",
    "value_ar": "نظام حماية البيانات الشخصية، الصادر بالمرسوم الملكي رقم (م/19) وتاريخ 9/2/1443هـ، وقرار مجلس الوزراء رقم (98) وتاريخ 7/2/1443هـ؛ نُشر في 17/2/1443هـ. عُدّل بالمرسوم الملكي رقم (م/148) وتاريخ 5/9/1444هـ. نافذ منذ 14 سبتمبر 2023 (بعد 720 يوماً من النشر). الحالة في هيئة الخبراء: ساري.",
    "source_url": "https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/b7cfae89-828e-4994-b167-adaa00e37188/1",
    "article": "Royal Decree M/19; Art 43 (original); RD M/148",
    "verified": true,
    "ambiguity_or_note": "14 Sep 2023 is calculated from the BOE publication date (24 Sep 2021 + 720 days). SDAIA's public guidance gives the same date."
   },
   "regulator": {
    "value_en": "Competent Authority under Art 30: currently the Saudi Data & AI Authority (SDAIA). CoM Resolution 98 designated SDAIA 'for two years', after which transfer of supervision to the National Data Management Office (NDMO) was to be considered. Coordination MoUs with SAMA (Saudi Central Bank) and CST are required (Resolution 98, items). Portal: https://dgp.sdaia.gov.sa",
    "value_ar": "الجهة المختصة (م30): الهيئة السعودية للبيانات والذكاء الاصطناعي (سدايا)؛ حدد قرار مجلس الوزراء (98) اختصاصها لمدة سنتين ينظر خلالها في نقله إلى مكتب إدارة البيانات الوطنية، مع مذكرتي تفاهم مع البنك المركزي السعودي وهيئة الاتصالات والفضاء والتقنية.",
    "source_url": "https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/b7cfae89-828e-4994-b167-adaa00e37188/1",
    "article": "Art 30; CoM Resolution 98 (first, fourth/fifth items)",
    "verified": true,
    "ambiguity_or_note": "The 2-year designation window has passed. SDAIA still runs the platform and publishes the rules, and the 2026 IR consultation is hosted under NDMO. Treat the regulator as SDAIA/NDMO."
   },
   "scope_territorial": {
    "value_en": "Any processing of personal data relating to individuals that takes place in the Kingdom by any means, including processing of personal data of individuals residing in the Kingdom by any party outside the Kingdom (extraterritorial). Covers data of deceased persons where it identifies them or a family member. Excludes purely personal/family use.",
    "value_ar": "يسري على كل معالجة لبيانات شخصية تتعلق بالأفراد تتم في المملكة بأي وسيلة، بما فيها معالجة بيانات الأفراد المقيمين في المملكة من أي جهة خارجها؛ ويشمل بيانات المتوفى. ويُستثنى الاستخدام الشخصي أو العائلي.",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf",
    "article": "Art 2(1)-(2)",
    "verified": true
   },
   "lawful_bases": {
    "value_en": "Consent (Art 5) plus exceptions in Art 6: (1) actual interest of data subject where contact is impossible/difficult; (2) required by another law or prior agreement; (3) controller is a public entity and processing is required for security or judicial purposes; (4) legitimate interest of the controller (not for sensitive data, subject to IR conditions).",
    "value_ar": "الموافقة (م5)، مع استثناءات م6: مصلحة متحققة لصاحب البيانات يتعذر الاتصال به؛ نص نظامي أو اتفاق سابق؛ جهة عامة لأغراض أمنية أو قضائية؛ المصلحة المشروعة لجهة التحكم (دون البيانات الحساسة).",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf",
    "article": "Arts 5-6; IR Art 16 (legitimate interest)",
    "verified": true
   },
   "consent_default": {
    "value_en": "Yes. Consent is the default rule. Explicit consent is required for sensitive data, credit data, and decisions based solely on automated processing.",
    "value_ar": "نعم، الموافقة هي الأصل؛ وتلزم الموافقة الصريحة للبيانات الحساسة والائتمانية والقرارات المؤتمتة بالكامل.",
    "source_url": "https://sdaia.gov.sa/ar/SDAIA/about/Documents/ImplementingRegulationPersonalDataProtectionLawAr.pdf",
    "article": "Law Art 5; IR Art 11(2)",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Sensitive data: racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric or genetic data for identification; health data; data indicating that one or both parents are unknown. Explicit consent is needed, and legitimate interest is not available. Disclosing sensitive data with intent to harm is a crime (Art 35).",
    "value_ar": "البيانات الحساسة: الأصل العرقي أو القبلي، المعتقد الديني أو الفكري أو السياسي، البيانات الأمنية والجنائية، السمات الحيوية أو الوراثية للتعريف، البيانات الصحية، وما يدل على مجهولية الأبوين أو أحدهما.",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf",
    "article": "Art 1(11) (as amended by M/148); IR Art 11",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Right to be informed; access; obtain copy in readable/clear format; correction/completion/update; destruction. Requests must be answered within 30 days, which can be extended by up to 30 more. Complaints go to the Competent Authority (Art 34). Compensation is available through the courts (Art 40).",
    "value_ar": "الحق في العلم، والوصول، والحصول على نسخة بصيغة واضحة، والتصحيح، والإتلاف؛ الرد خلال 30 يوماً قابلة للتمديد 30 يوماً؛ الشكوى للجهة المختصة؛ التعويض أمام المحكمة.",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf",
    "article": "Law Art 4; IR Arts 3-9; Law Arts 34, 40",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Mandatory where: (1) a public entity provides services involving large-scale processing; (2) core activities require regular and systematic monitoring of data subjects; (3) core activities consist of processing sensitive data. The DPO may be an employee or an external contractor.",
    "value_ar": "إلزامي إذا كانت جهة عامة تقدم خدمات تتضمن معالجة على نطاق واسع، أو كانت الأنشطة الأساسية تتطلب مراقبة منتظمة ومنهجية، أو تقوم على معالجة بيانات حساسة؛ ويجوز أن يكون موظفاً أو متعاقداً خارجياً.",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/RulesforAppointingPersonalDataProtectionOfficer.pdf",
    "article": "IR Art 32; DPO Rules Art 5",
    "verified": true
   },
   "registration_notification": {
    "value_en": "Registration on the National Data Governance Platform is mandatory where: (1) the controller is a public entity; (2) its main activity is personal data processing; (3) it processes sensitive data; (4) an individual processes data beyond personal/family use. Law Art 32 (the original registration article) was repealed by M/148. The register now rests on Art 30(4)(c) and IR Art 34.",
    "value_ar": "التسجيل في المنصة الوطنية لحوكمة البيانات إلزامي إذا كانت جهة التحكم جهة عامة، أو كان نشاطها الرئيس قائماً على معالجة البيانات الشخصية، أو تعالج بيانات حساسة، أو فرداً يعالج لأغراض تتجاوز الاستخدام الشخصي أو العائلي.",
    "source_url": "https://sdaia.gov.sa/Documents/TheRulesGoverningTheNationalRegisterOfControllersWithinTheKingdomPublicEN.pdf",
    "article": "Law Art 30(4)(c); IR Art 34; National Register Rules Art 2",
    "verified": true,
    "ambiguity_or_note": "A pending 2026 IR draft would also trigger registration for any controller transferring data abroad (secondary source, consultation only)."
   },
   "breach_notification": {
    "value_en": "Notify the Competent Authority within 72 hours of becoming aware, if the incident may cause harm to the personal data or the data subject or conflict with their rights. Any missing information may follow as soon as possible, with reasons. Data subjects must be notified without undue delay if the breach may harm their data or conflict with their rights.",
    "value_ar": "إشعار الجهة المختصة خلال 72 ساعة من العلم بالحادثة إذا كان من شأنها إلحاق ضرر بالبيانات أو بصاحبها أو تتعارض مع حقوقه؛ وإبلاغ صاحب البيانات دون تأخير غير مسوغ.",
    "source_url": "https://sdaia.gov.sa/ar/SDAIA/about/Documents/ImplementingRegulationPersonalDataProtectionLawAr.pdf",
    "article": "Law Art 20; IR Art 24",
    "verified": true,
    "ambiguity_or_note": "The 72h clock applies only when there is harm risk. The pending 2026 draft reportedly removes that harm threshold (secondary source)."
   },
   "cross_border_transfer": {
    "value_en": "Transfer or disclosure outside the Kingdom is allowed for the purposes listed in Art 29 (Kingdom's obligations, Kingdom's interests, contract performance, other purposes in the regulations) if: no prejudice to national security or vital interests; adequate protection (adequacy list, reviewed at least every 4 years); limited to minimum data. Without adequacy, transfers may rely on SCCs, Binding Common Rules, an accreditation certificate, or limited derogations. Risk assessment is needed for exemption-based transfers and for continuous or large-scale transfers of sensitive data.",
    "value_ar": "يجوز النقل خارج المملكة للأغراض الواردة في م29 بشرط عدم المساس بالأمن الوطني، وتوفر مستوى حماية مناسب (قائمة كفاية تراجع كل 4 سنوات)، والاقتصار على الحد الأدنى؛ وعند عدم الكفاية: البنود التعاقدية المعيارية، أو القواعد المشتركة الملزمة، أو شهادة الاعتماد، مع تقييم المخاطر.",
    "source_url": "https://sdaia.gov.sa/Documents/RegulationonPersonalDataEN.pdf",
    "article": "Law Art 29; Transfer Regulation (v2.0, Aug 2024) Arts 2-7",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No general data-localisation requirement in the in-force Law, IR or Transfer Regulation. Sector rules (government/NDMO/NCA, SAMA, CST cloud) may impose residency, but those are outside this dataset. A pending 2026 IR draft proposes a new Art 23(2) requiring storage within the Kingdom (consultation only).",
    "value_ar": "لا يوجد اشتراط عام لتوطين البيانات في النظام ولائحته ولائحة النقل الساريين؛ قد تفرض أنظمة قطاعية متطلبات إقامة؛ ومسودة 2026 تقترح مادة 23(2) لحفظ البيانات داخل المملكة (قيد الاستطلاع).",
    "source_url": "https://sdaia.gov.sa/Documents/RegulationonPersonalDataEN.pdf",
    "article": "Law Art 29; draft IR Art 23(2) (pending)",
    "verified": true,
    "ambiguity_or_note": "The 'no general localisation' finding is verified against the in-force texts. The draft details are secondary source (Bird & Bird summary of the Istitlaa draft)."
   },
   "max_penalties": {
    "value_en": "Criminal: disclosing or publishing sensitive data in breach of the law with intent to harm or for personal benefit carries up to 2 years' imprisonment and/or a fine up to SAR 3,000,000. Other violations: warning or fine up to SAR 5,000,000. Both can be doubled for repeat offences. Courts may also order confiscation and publication of the judgment, and compensation is available.",
    "value_ar": "جنائي: الإفصاح عن البيانات الحساسة أو نشرها بقصد الإضرار أو تحقيق منفعة: سجن حتى سنتين و/أو غرامة حتى 3 ملايين ريال. إداري: إنذار أو غرامة حتى 5 ملايين ريال. تضاعف عند التكرار.",
    "source_url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf",
    "article": "Arts 35, 36, 38, 40",
    "verified": true
   },
   "grace_periods": {
    "value_en": "Controllers had up to one year from entry into force (to 14 Sep 2024) to comply, and the Competent Authority may grant extra time to some entities. Application of Art 33(1)-(2) was deferred for up to 5 years, but that deferral was repealed by M/148.",
    "value_ar": "مهلة سنة من النفاذ (حتى 14 سبتمبر 2024) لتعديل الأوضاع مع جواز منح مدد إضافية.",
    "source_url": "https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/b7cfae89-828e-4994-b167-adaa00e37188/1",
    "article": "CoM Resolution 98; RD M/19 item (second) repealed by M/148",
    "verified": true
   },
   "recent_amendments_2023_2026": {
    "value_en": "2023: RD M/148 amended the law (definitions, consent wording, repeal of registration Art 32, etc.); IR and first Transfer Regulation issued (Sep 2023). Aug 2024: Transfer Regulation v2.0. 2024–2025: National Register Rules, DPO Rules, SCCs and BCR guidelines. 27 Apr–27 May 2025: first draft IR amendments consulted. 6 Oct–5 Nov 2026: second draft 'تعديلات اللائحة التنفيذية لنظام حماية البيانات الشخصية' open on Istitlaa. Reported content (secondary): in-Kingdom storage, no harm threshold for 72h notice, registration triggered by transfers abroad, requests deemed rejected after 30+30 days.",
    "value_ar": "2023: المرسوم م/148؛ اللائحة التنفيذية ولائحة النقل. 2024: لائحة النقل الإصدار 2.0. 2025: مسودة تعديلات أولى. 6 أكتوبر – 5 نوفمبر 2026: مسودة تعديلات ثانية على منصة استطلاع.",
    "source_url": "https://istitlaa.scbc.gov.sa/ar/Transportation/NDMO/IRofPDPLAmendments2/Pages/default.aspx",
    "article": "RD M/148; Istitlaa consultations",
    "verified": true,
    "ambiguity_or_note": "The amendment dates and consultation pages are verified. The content of the 2026 draft is secondary source only."
   }
  },
  "UAE_federal": {
   "jurisdiction_en": "United Arab Emirates (federal / onshore)",
   "jurisdiction_ar": "الإمارات العربية المتحدة (اتحادي)",
   "official_name_number_dates": {
    "value_en": "Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Issued 20 Sep 2021; Official Gazette No. 712 (supplement), 26 Sep 2021; effective 2 Jan 2022.",
    "value_ar": "مرسوم بقانون اتحادي رقم (45) لسنة 2021 بشأن حماية البيانات الشخصية؛ صدر في 20 سبتمبر 2021؛ الجريدة الرسمية العدد 712 (ملحق) في 26 سبتمبر 2021؛ يعمل به من 2 يناير 2022.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Art 31",
    "verified": true
   },
   "regulator": {
    "value_en": "UAE Data Office, established by Federal Decree-Law No. 44 of 2021.",
    "value_ar": "مكتب الإمارات للبيانات، المنشأ بالمرسوم بقانون اتحادي رقم (44) لسنة 2021.",
    "source_url": "https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws",
    "article": "Art 1 (definition of 'Office')",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to: (1) data subjects who reside in or have a place of business in the State; (2) controllers or processors in the State, whether processing inside or outside the State; (3) controllers or processors outside the State that process data of data subjects inside the State (extraterritorial). Excludes: government data and entities, security and judicial authorities, data processed for personal purposes, health and banking/credit data that have their own legislation, and free zones with their own data protection laws (DIFC, ADGM).",
    "value_ar": "يسري على أصحاب البيانات المقيمين أو ذوي مقر عمل في الدولة، وعلى المتحكم والمعالج داخل الدولة سواء جرت المعالجة داخلها أو خارجها، وعلى المتحكم والمعالج خارج الدولة عند معالجة بيانات أصحاب بيانات داخلها؛ ويُستثنى البيانات الحكومية والجهات الأمنية والقضائية والبيانات الصحية والمصرفية ذات التشريعات الخاصة والمناطق الحرة ذات القوانين الخاصة.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Art 2",
    "verified": true
   },
   "lawful_bases": {
    "value_en": "Processing without consent is prohibited, except in 11 cases: public interest; personal data made public by the data subject; legal claims and judicial proceedings; occupational or preventive medicine; public health; archiving or scientific research; protecting the data subject's interests; employment and social security obligations; contract performance; legal obligations; other cases set by the Executive Regulations. There is no general legitimate-interest basis.",
    "value_ar": "يُحظر المعالجة دون موافقة صاحب البيانات إلا في 11 حالة (المصلحة العامة، البيانات المعلنة، الدعاوى، الطب الوقائي، الصحة العامة، الأرشفة والبحث، حماية مصلحة صاحب البيانات، التزامات العمل، تنفيذ العقد، الالتزام القانوني، حالات تحددها اللائحة). لا يوجد أساس عام للمصلحة المشروعة.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 4, 6",
    "verified": true
   },
   "consent_default": {
    "value_en": "Yes. Consent is the rule and processing without it is prohibited unless an Art 4 exception applies. Consent must be specific, clear and unambiguous, and withdrawable (Art 6).",
    "value_ar": "نعم، الموافقة هي الأصل (م4)، وشروطها في م6.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 4, 6",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Sensitive personal data: data revealing family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, health data, and genetic or sexual condition. Sensitive data triggers DPO/DPIA duties (Arts 10, 21). There is no separate consent tier in the decree-law text.",
    "value_ar": "البيانات الحساسة: ما يكشف العائلة أو الأصل العرقي أو الآراء السياسية أو الفلسفية أو المعتقدات الدينية أو السجل الجنائي أو البيانات الحيوية أو الصحية أو الجينية أو الجنسية.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Art 1 (definitions); Arts 10, 21",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Information/access, portability, rectification and erasure, restriction, objection (including to direct marketing), and objection to automated decisions. Complaints go to the Data Office.",
    "value_ar": "الحق في الحصول على المعلومات، ونقل البيانات، والتصحيح والمسح، وتقييد المعالجة، والاعتراض، والاعتراض على القرارات المؤتمتة؛ والشكوى للمكتب.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 13-18, 24",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Mandatory where processing carries a high risk because of new technologies or data volume, involves systematic and comprehensive assessment of sensitive data (including profiling), or involves large volumes of sensitive data. The DPO may be located inside or outside the State, and the Office must be notified of the DPO's contact details.",
    "value_ar": "إلزامي عند المعالجة عالية المخاطر بسبب التقنيات الحديثة أو حجم البيانات، أو التقييم المنهجي للبيانات الحساسة بما فيه التنميط، أو معالجة كميات كبيرة من البيانات الحساسة؛ ويجوز أن يكون داخل الدولة أو خارجها.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 10-12",
    "verified": true
   },
   "registration_notification": {
    "value_en": "There is no general controller registration or notification regime in the Decree-Law. The Executive Regulations, which have not been located, could add one.",
    "value_ar": "لا يوجد نظام تسجيل عام للمتحكمين في المرسوم بقانون؛ وقد تضيفه اللائحة التنفيذية (غير صادرة وفق البوابة الرسمية).",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "—",
    "verified": true,
    "ambiguity_or_note": "This is an absence finding: no registration article exists in the decree-law text."
   },
   "breach_notification": {
    "value_en": "The controller must notify the Data Office of a breach that would prejudice privacy, confidentiality or security, 'within the period and in the manner determined by the Executive Regulations', and must also notify the data subject. Processors must notify the controller as soon as they become aware.",
    "value_ar": "على المتحكم إبلاغ المكتب بالاختراق خلال المدة وبالكيفية التي تحددها اللائحة التنفيذية، وإبلاغ صاحب البيانات.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Art 9",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: there is no statutory deadline. Some secondary sources say '72 hours', but that does not appear in the decree-law, and no Executive Regulations were found on the official portal as of 22 Oct 2026."
   },
   "cross_border_transfer": {
    "value_en": "Transfers are allowed to countries with adequate data protection legislation, or under bilateral/multilateral agreements, in cases approved by the Office (Art 22). Without adequacy, transfers may rely on: a binding contract or agreement with equivalent protection; express consent of the data subject; legal claims; contract performance; international judicial cooperation; or public interest (Art 23).",
    "value_ar": "النقل إلى دول ذات تشريعات حماية مناسبة أو بموجب اتفاقيات ثنائية أو متعددة (م22)؛ وفي غيرها: عقد ملزم، أو موافقة صريحة، أو الدعاوى، أو تنفيذ العقد، أو التعاون القضائي الدولي، أو المصلحة العامة (م23).",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 22-23",
    "verified": true,
    "ambiguity_or_note": "No adequacy list issued by the Office was found."
   },
   "data_localisation": {
    "value_en": "No localisation requirement in the Decree-Law. Sector laws (for example health data under Federal Law 2/2019) may require local storage, but those are outside this dataset.",
    "value_ar": "لا يوجد اشتراط توطين في المرسوم بقانون؛ قد تفرضه قوانين قطاعية (مثل القانون الاتحادي 2/2019 للصحة).",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 22-23",
    "verified": true,
    "ambiguity_or_note": "The Federal Law 2/2019 reference comes from u.ae and is not analysed in detail here."
   },
   "max_penalties": {
    "value_en": "No penalty amounts exist yet. Art 26 provides that administrative penalties will be set by a Cabinet decision, and no such decision is listed on the official legislation portal (related-legislations page checked 22 Oct 2026). The decree-law contains no criminal penalties. Criminal exposure may arise under the Cybercrime Decree-Law 34/2021, which is out of scope.",
    "value_ar": "لا توجد مبالغ جزاءات بعد: تحدد الجزاءات الإدارية بقرار من مجلس الوزراء (م26) ولم يُدرج قرار كهذا في البوابة الرسمية حتى 22 أكتوبر 2026. لا عقوبات جنائية في المرسوم بقانون.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972/related-legislations",
    "article": "Art 26",
    "verified": true,
    "ambiguity_or_note": "Secondary sources that cite 'AED 20m' or similar figures for the UAE PDPL are not supported by any official text found."
   },
   "grace_periods": {
    "value_en": "The Executive Regulations were due within 6 months of publication (Art 28). Controllers and processors have 6 months from the issuance of the Executive Regulations to comply, extendable by Cabinet (Art 29). Because no Executive Regulations have been located, that compliance window has arguably not started.",
    "value_ar": "تصدر اللائحة التنفيذية خلال 6 أشهر (م28)؛ ويلتزم المخاطبون بتوفيق أوضاعهم خلال 6 أشهر من صدور اللائحة قابلة للتمديد (م29).",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972",
    "article": "Arts 28-29",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: Art 29 ties the grace period to the Executive Regulations, which are not on the official portal."
   },
   "recent_amendments_2023_2026": {
    "value_en": "No amendment to Decree-Law 45/2021 and no Executive Regulations are listed on the official portal (the page shows last update 20 Sep 2021). Related instruments listed there: the KYC Digital Platform decree-law and the Child Digital Safety decree-law.",
    "value_ar": "لا تعديلات ولا لائحة تنفيذية مدرجة في البوابة الرسمية حتى 22 أكتوبر 2026.",
    "source_url": "https://uaelegislation.gov.ae/en/legislations/1972/related-legislations",
    "article": "—",
    "verified": true,
    "ambiguity_or_note": "Absence verified on the official portal only. The Executive Regulations could exist without being listed. Status: 'not found on official portal as of 22 Oct 2026'."
   }
  },
  "DIFC": {
   "jurisdiction_en": "Dubai International Financial Centre (UAE financial free zone)",
   "jurisdiction_ar": "مركز دبي المالي العالمي",
   "official_name_number_dates": {
    "value_en": "Data Protection Law, DIFC Law No. 5 of 2020. Enacted 21 May 2020; in force 1 Jul 2020 (Art 4). Amended by DIFC Laws Amendment Law No. 2 of 2022 and DIFC Laws Amendment Law No. 1 of 2025 (consolidated July 2025). Supplemented by the Data Protection Regulations (consolidated version No. 2, in force 1 Sep 2023).",
    "value_ar": "قانون حماية البيانات، قانون مركز دبي المالي العالمي رقم (5) لسنة 2020؛ سُنّ في 21 مايو 2020؛ نافذ من 1 يوليو 2020؛ معدل بالقانون رقم (2) لسنة 2022 والقانون رقم (1) لسنة 2025.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 3-4",
    "verified": true,
    "ambiguity_or_note": "DISCREPANCY: the DIFC legal-database page lists commencement as 01.06.2020, while Art 4 of the consolidated text says 1 July 2020. The Arabic title is our translation; no official Arabic text was found."
   },
   "regulator": {
    "value_en": "Commissioner of Data Protection (DIFC).",
    "value_ar": "مفوض حماية البيانات في مركز دبي المالي العالمي.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 8, 43-46",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to processing: (a) by a controller or processor incorporated in the DIFC, regardless of where processing takes place; (b) in the DIFC by a controller or processor (or sub-processor), regardless of place of incorporation, as part of stable arrangements, including transfers out of the DIFC. There is no 'offering goods/services' or monitoring limb in the consolidated July 2025 text.",
    "value_ar": "يسري على المعالجة من متحكم أو معالج مؤسس في المركز أينما جرت، وعلى المعالجة داخل المركز ضمن ترتيبات مستقرة بغض النظر عن مكان التأسيس.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 6(3)",
    "verified": true,
    "ambiguity_or_note": "The Feb 2025 consultation draft (Annex A) showed an extraterritorial limb. It does NOT appear in the enacted consolidated July 2025 text."
   },
   "lawful_bases": {
    "value_en": "GDPR-style: consent; contract; compliance with Applicable Law; vital interests; DIFC Body tasks/powers; legitimate interests (subject to Art 13).",
    "value_ar": "على غرار اللائحة الأوروبية: الموافقة، العقد، الالتزام القانوني، المصالح الحيوية، مهام هيئات المركز، المصالح المشروعة.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 10, 12, 13",
    "verified": true
   },
   "consent_default": {
    "value_en": "No. Consent is one of six equal bases.",
    "value_ar": "لا؛ الموافقة أحد ستة أسس متساوية.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 10",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Special Categories of Personal Data may be processed only if an Art 11 condition applies (explicit consent, employment, vital interests, and others).",
    "value_ar": "لا تُعالج الفئات الخاصة إلا بتوفر أحد شروط م11 (موافقة صريحة، التوظيف، ...).",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 11",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Withdraw consent; access, rectification, erasure; objection; restriction; portability; rights on automated decisions and profiling; non-discrimination. A private right of action for compensation was added in 2025 (Art 64A).",
    "value_ar": "سحب الموافقة، الوصول والتصحيح والمسح، الاعتراض، التقييد، النقل، القرارات المؤتمتة، عدم التمييز؛ وحق دعوى خاصة للتعويض (م64أ، 2025).",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 32-40, 64A",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Mandatory for DIFC Bodies (other than courts acting judicially) and for controllers or processors performing High Risk Processing Activities on a systematic or regular basis. The Commissioner may require others to appoint one. The DPO must reside in the UAE unless they are a group employee performing a similar international function.",
    "value_ar": "إلزامي لهيئات المركز وللمعالجة عالية المخاطر بصورة منتظمة؛ ويجب أن يقيم مسؤول الحماية في الإمارات ما لم يكن موظفاً في المجموعة يؤدي مهمة دولية.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 16 (incl. 16(7))",
    "verified": true
   },
   "registration_notification": {
    "value_en": "Controllers and processors must register with the Commissioner by filing a notification of processing operations, keep it updated, and pay the prescribed fee. Notifications go on a public register.",
    "value_ar": "يجب التسجيل لدى المفوض بإيداع إخطار بعمليات المعالجة وتحديثه ودفع الرسم؛ ويُقيد في سجل علني.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 14(7)-(8)",
    "verified": true
   },
   "breach_notification": {
    "value_en": "Notify the Commissioner 'as soon as practicable in the circumstances' of a breach that compromises data subjects' confidentiality, security or privacy. Notify data subjects as soon as practicable where the breach is likely to result in high risk.",
    "value_ar": "إخطار المفوض في أقرب وقت ممكن عملياً؛ وإخطار صاحب البيانات عند المخاطر العالية.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 41-42",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: there is no fixed hour limit. DIFC, UAE federal and Qatar are the three regimes in this dataset with no numeric deadline to the regulator."
   },
   "cross_border_transfer": {
    "value_en": "Transfers are allowed to jurisdictions the Commissioner has found adequate (Art 26). Otherwise transfers need appropriate safeguards (SCCs, BCRs, and similar) or specific derogations (Art 27). Data sharing with public authorities is regulated by Art 28 (amended 2025).",
    "value_ar": "النقل إلى دول قرر المفوض كفايتها (م26)، وإلا فبضمانات مناسبة أو استثناءات محددة (م27)؛ ومشاركة البيانات مع السلطات العامة (م28).",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 26-28",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement.",
    "value_ar": "لا يوجد اشتراط توطين.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Arts 26-27",
    "verified": true
   },
   "max_penalties": {
    "value_en": "Administrative fines up to the Schedule 2 amounts for each listed contravention, ranging from USD 25,000 to USD 100,000 (USD 100,000 for Arts 33-38 rights breaches; USD 50,000 for breach-notification failures). Separately, Art 62(3) allows a fine 'not limited to' the Schedule 2 amounts for general contraventions, which means there is no stated cap. Courts can award compensation (Arts 63-64A). No criminal penalties.",
    "value_ar": "غرامات إدارية حتى مبالغ الجدول 2 (25,000–100,000 دولار لكل مخالفة)، وغرامة عامة غير مقيدة بمبالغ الجدول (م62(3))؛ تعويض قضائي؛ لا عقوبات جنائية.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 62(2)-(3); Schedule 2; Art 64A",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS cap: the Art 62(3) general fine has no fixed maximum."
   },
   "grace_periods": {
    "value_en": "The law was in force from 1 Jul 2020. Market sources report that enforcement was deferred to 1 Oct 2020, but this was not confirmed in an official text found.",
    "value_ar": "نافذ من 1 يوليو 2020؛ مهلة إنفاذ حتى 1 أكتوبر 2020 غير مؤكدة من مصدر رسمي.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Art 4",
    "verified": "UNVERIFIED"
   },
   "recent_amendments_2023_2026": {
    "value_en": "DP Regulations consolidated v2 in force 1 Sep 2023. DIFC Laws Amendment Law No. 1 of 2025 (enacted Jul 2025) added a private right of action (Art 64A), revised data sharing with public authorities (Art 28), and made other changes.",
    "value_ar": "لائحة حماية البيانات المعدلة نافذة 1 سبتمبر 2023؛ قانون التعديل رقم (1) لسنة 2025: حق الدعوى الخاصة (م64أ) وتعديل م28.",
    "source_url": "https://edge.sitecorecloud.io/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws--regulations/data-protection-law.pdf",
    "article": "Consolidated text cover; Arts 28, 64A",
    "verified": true
   }
  },
  "ADGM": {
   "jurisdiction_en": "Abu Dhabi Global Market (UAE financial free zone)",
   "jurisdiction_ar": "سوق أبوظبي العالمي",
   "official_name_number_dates": {
    "value_en": "Data Protection Regulations 2021. Enacted 11 Feb 2021; came into force when the DPR 2015 was repealed (6 months after publication for new establishments, 12 months for existing ones). Consolidated version August 2025.",
    "value_ar": "أنظمة حماية البيانات لعام 2021؛ سُنت في 11 فبراير 2021؛ نافذة بإلغاء أنظمة 2015 (بعد 6 أشهر للمنشآت الجديدة و12 شهراً للقائمة).",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 63-64",
    "verified": true,
    "ambiguity_or_note": "The Arabic name 'أنظمة حماية البيانات لعام 2021' comes from the existing Qanu page citing an ADGM release. It was not re-verified on an official Arabic text."
   },
   "regulator": {
    "value_en": "Office of Data Protection, headed by the Commissioner of Data Protection (ADGM).",
    "value_ar": "مكتب حماية البيانات برئاسة مفوض حماية البيانات في سوق أبوظبي العالمي.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 47-49",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to processing in the context of the activities of an establishment of a controller or processor in ADGM, regardless of whether processing takes place in ADGM. There is no offering/monitoring limb.",
    "value_ar": "يسري على المعالجة في سياق أنشطة منشأة لمتحكم أو معالج في السوق، بغض النظر عن مكان المعالجة.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 3",
    "verified": true,
    "ambiguity_or_note": "Al Reem Island was transitionally exempt until 31 Dec 2024 (amendment 1 Nov 2023; Cabinet Resolution 41/2023)."
   },
   "lawful_bases": {
    "value_en": "GDPR-style six bases: consent, contract, legal obligation, vital interests, public task, legitimate interests.",
    "value_ar": "ستة أسس على غرار اللائحة الأوروبية.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 5",
    "verified": true
   },
   "consent_default": {
    "value_en": "No. Consent is one of six bases.",
    "value_ar": "لا.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 5-6",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Processing of special categories is prohibited unless a s7(2) exception applies. The 2025 amendment added 'other conditions in Rules' (s7(2)(k)(xii)), and the Substantial Public Interest Rules 2025 followed.",
    "value_ar": "معالجة الفئات الخاصة محظورة ما لم ينطبق استثناء في القسم 7(2)؛ وأضاف تعديل 2025 شروطاً بقواعد.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 7",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Information, access, rectification, erasure, restriction, portability, objection, rights on automated decisions; complaint to the Commissioner; court claims.",
    "value_ar": "المعلومات، الوصول، التصحيح، المسح، التقييد، النقل، الاعتراض، القرارات المؤتمتة؛ الشكوى؛ الدعوى.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 10-20, 57-59",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Mandatory for public authorities, for large-scale regular and systematic monitoring, and for large-scale processing of special categories.",
    "value_ar": "إلزامي للسلطات العامة والمراقبة المنهجية واسعة النطاق ومعالجة الفئات الخاصة على نطاق واسع.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 35",
    "verified": true
   },
   "registration_notification": {
    "value_en": "Controllers must pay the Data Protection Fee and notify the Commissioner of their name and address before, or as soon as practicable after, processing begins, and renew annually. A fixed penalty applies for non-payment (s56).",
    "value_ar": "دفع رسم حماية البيانات وإخطار المفوض بالاسم والعنوان قبل بدء المعالجة أو فور الإمكان، وتجديده سنوياً.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 24, 56",
    "verified": true
   },
   "breach_notification": {
    "value_en": "Notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. Delays must be explained. Data subjects must be told without undue delay where the risk is high.",
    "value_ar": "إخطار المفوض دون تأخير غير مسوغ وخلال 72 ساعة حيثما أمكن، وإبلاغ صاحب البيانات عند المخاطر العالية.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 32-33",
    "verified": true,
    "ambiguity_or_note": "'Where feasible' softens the 72h deadline."
   },
   "cross_border_transfer": {
    "value_en": "Transfers are allowed on the basis of adequacy decisions, appropriate safeguards (including SCCs), BCRs, or derogations. Data sharing with public authorities is covered separately.",
    "value_ar": "النقل بقرار كفاية، أو ضمانات مناسبة، أو قواعد مؤسسية ملزمة، أو استثناءات.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 40-45",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement.",
    "value_ar": "لا يوجد اشتراط توطين.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "ss 40-45",
    "verified": true
   },
   "max_penalties": {
    "value_en": "Administrative fines up to USD 28 million, plus a fixed penalty for fee non-payment. No criminal penalties in the DPR.",
    "value_ar": "غرامات إدارية حتى 28 مليون دولار؛ لا عقوبات جنائية.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 55 (amended 28 Feb 2024); s 56",
    "verified": true
   },
   "grace_periods": {
    "value_en": "Transition from DPR 2015: 6 months after publication for establishments set up on or after publication, and 12 months for existing establishments.",
    "value_ar": "مهلة 6 أشهر للمنشآت الجديدة و12 شهراً للقائمة.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "s 63(1)",
    "verified": true
   },
   "recent_amendments_2023_2026": {
    "value_en": "Amendments of 1 Nov 2023 (Al Reem Island transition), 28 Feb 2024 (fines), Amendment No. 1 of 2025, and the Substantial Public Interest Rules 2025 (announced 11 Sep 2025). Consolidated version August 2025.",
    "value_ar": "تعديلات نوفمبر 2023، فبراير 2024، التعديل رقم 1 لسنة 2025، وقواعد المصلحة العامة الجوهرية 2025.",
    "source_url": "https://en.adgm.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_23167_VER992025.pdf",
    "article": "Consolidated version history",
    "verified": true
   }
  },
  "Bahrain": {
   "jurisdiction_en": "Kingdom of Bahrain",
   "jurisdiction_ar": "مملكة البحرين",
   "official_name_number_dates": {
    "value_en": "Law No. (30) of 2018 with respect to the Personal Data Protection Law. Promulgated 12 Jul 2018 (28/10/1439H). Effective 1 Aug 2019 (one year from the first day of the month following publication in the Official Gazette).",
    "value_ar": "قانون رقم (30) لسنة 2018 بإصدار قانون حماية البيانات الشخصية؛ صدر في 28 شوال 1439هـ الموافق 12 يوليو 2018؛ يعمل به من 1 أغسطس 2019.",
    "source_url": "https://legalaffairs.gov.bh/Legislation/HTM/K3018",
    "article": "Promulgation law, Art 4 (effectiveness)",
    "verified": true
   },
   "regulator": {
    "value_en": "Personal Data Protection Authority. Its duties are assigned to the Ministry of Justice, Islamic Affairs and Waqf by Decree No. 78 of 2019.",
    "value_ar": "هيئة حماية البيانات الشخصية؛ أُسندت اختصاصاتها إلى وزارة العدل والشؤون الإسلامية والأوقاف بالمرسوم رقم (78) لسنة 2019.",
    "source_url": "https://www.pdp.gov.bh/en/about-PDPA.html",
    "article": "Law Arts 26-30; Decree 78/2019",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to: individuals normally resident in, or with a place of business in, Bahrain; legal persons with a place of business in Bahrain; and persons not resident or established in Bahrain who process data using means located in Bahrain (other than for transit). The last group must appoint an accredited representative. Excludes purely personal processing and certain national security processing.",
    "value_ar": "يسري على المقيمين أو ذوي مقر عمل في المملكة، والأشخاص الاعتبارية ذات مقر عمل فيها، وغير المقيمين الذين يعالجون بوسائل موجودة في المملكة (مع تعيين ممثل معتمد).",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Art 2",
    "verified": true
   },
   "lawful_bases": {
    "value_en": "Consent; or processing necessary for: contract performance or pre-contract steps; a legal obligation (other than contractual) or court order; protecting the data subject's vital interests; or the legitimate interests of the controller or a third-party recipient, unless overridden by the data subject's rights.",
    "value_ar": "الموافقة، أو الضرورة لتنفيذ عقد، أو التزام قانوني أو حكم قضائي، أو حماية المصالح الحيوية، أو المصالح المشروعة لمدير البيانات.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Art 4",
    "verified": true
   },
   "consent_default": {
    "value_en": "Consent is listed first, but legitimate interests and other bases are alternatives, so consent is not the exclusive default (GDPR-like). Sensitive data requires consent or an Art 5 exception.",
    "value_ar": "الموافقة أولى الحالات لكن ليست شرطاً حصرياً؛ تتوفر المصلحة المشروعة وغيرها.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 4-5",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Sensitive data: race, ethnic origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, health or sexual life. Processing requires consent or an Art 5 exception. Prior written authorisation from the Authority is required for automated processing of sensitive data, biometric and genetic data, linking of files, and visual recording for surveillance.",
    "value_ar": "البيانات الحساسة: العرق، الأصل الإثني، الآراء السياسية أو الفلسفية، المعتقدات الدينية، الانتماء النقابي، السجل الجنائي، الصحة أو الحياة الجنسية؛ وتحتاج المعالجة الآلية لها وللبيانات الحيوية والجينية والتسجيل المرئي إذناً مسبقاً.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 1, 5, 15",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Right to be informed; access (response within 15 working days); objection to processing causing damage; objection to direct marketing; objection to automated decisions; rectification, blocking and erasure (response within 10 working days); complaint to the Authority; compensation.",
    "value_ar": "الحق في الإعلام، والوصول (15 يوم عمل)، والاعتراض، ورفض التسويق المباشر، والقرارات المؤتمتة، والتصحيح والحجب والمسح (10 أيام عمل)؛ والشكوى والتعويض.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 17-24, 57",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Appointing a Data Protection Guardian is optional unless the Board obliges certain categories. A controller that appoints one must notify the Authority within 3 working days. Appointing a Guardian exempts the controller from the Art 14 prior notification. Rules are in Order No. 46 of 2022.",
    "value_ar": "تعيين مراقب حماية البيانات اختياري ما لم يُلزم المجلس فئات معينة؛ ويُخطر به الهيئة خلال 3 أيام عمل.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 10-11, 14; Order 46/2022",
    "verified": true,
    "ambiguity_or_note": "Whether any category has since been made mandatory was not checked (UNVERIFIED sub-point)."
   },
   "registration_notification": {
    "value_en": "Prior notification to the Authority is required before carrying out any wholly or partly automated processing, unless exempt (for example where a Data Protection Guardian is appointed). Changes must be notified within 30 days. Prior authorisation is required for the high-risk processing listed in Art 15. Procedures are in Order No. 44 of 2022.",
    "value_ar": "إخطار مسبق للهيئة قبل أي معالجة آلية (ما لم يُعفَ، كتعيين مراقب)، وإخطار التغييرات خلال 30 يوماً؛ وإذن مسبق للمعالجات في م15.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 14-15; Order 44/2022",
    "verified": true
   },
   "breach_notification": {
    "value_en": "The controller must have procedures to inform the Authority of any breach within 72 hours of discovery, unless the breach would not affect data subjects' rights. Late notices must give reasons. The 72-hour rule is in a ministerial order, not in the law.",
    "value_ar": "إبلاغ الهيئة بأي اختراق خلال 72 ساعة من اكتشافه ما لم يكن لا يؤثر على حقوق أصحاب البيانات.",
    "source_url": "https://www.pdp.gov.bh/assets/pdf/executive-decisions/eng/the_be_met_in_the_technical.pdf",
    "article": "Order No. 43 of 2022, Art 4(2)",
    "verified": true,
    "ambiguity_or_note": "The deadline comes from Order 43/2022 (secondary legislation); Law 30/2018 itself sets no deadline."
   },
   "cross_border_transfer": {
    "value_en": "Transfers outside Bahrain are prohibited except to countries or territories on the Authority's adequacy list, or with case-by-case Authority authorisation. Statutory exemptions include consent, contract, legal claims, vital interests, and public registers. Order No. 42 of 2022 lists 83 adequate countries and territories, including the USA, UK, China, India, Russia, Israel, KSA, UAE, Kuwait and Oman. Qatar is not on the list.",
    "value_ar": "يحظر النقل إلا إلى دول على قائمة الكفاية أو بتصريح من الهيئة، مع استثناءات (م13). تضم قائمة القرار 42/2022 83 دولة وإقليماً منها الولايات المتحدة والصين والهند وروسيا والسعودية والإمارات والكويت وعُمان — وليس قطر.",
    "source_url": "https://www.pdp.gov.bh/assets/pdf/executive-decisions/eng/trans-order-countries-and-territories-with-adequate-protection-en.pdf",
    "article": "Arts 12-13; Order No. 42 of 2022 (list)",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement.",
    "value_ar": "لا يوجد اشتراط توطين.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 12-13",
    "verified": true
   },
   "max_penalties": {
    "value_en": "Administrative: fine up to BD 20,000; daily penalty up to BD 1,000 (BD 2,000 for a repeat within 3 years); authorisation withdrawal; publication. Criminal: up to 1 year's imprisonment and/or a fine of BD 1,000–20,000 (for example unlawful sensitive-data processing, unlawful transfer, processing without notification). Fines are doubled for legal persons (up to BD 40,000).",
    "value_ar": "إداري: غرامة حتى 20,000 دينار وغرامة يومية حتى 1,000 (2,000 عند التكرار). جنائي: حبس حتى سنة و/أو غرامة 1,000–20,000 دينار؛ تضاعف للشخص الاعتباري.",
    "source_url": "https://www.pdp.gov.bh/en/regulations.html",
    "article": "Arts 55, 58, 59",
    "verified": true
   },
   "grace_periods": {
    "value_en": "Law effective one year after the first day of the month following publication (1 Aug 2019). No other general transition was found.",
    "value_ar": "مهلة سنة قبل النفاذ (حتى 1 أغسطس 2019).",
    "source_url": "https://legalaffairs.gov.bh/Legislation/HTM/K3018",
    "article": "Promulgation law Art 4",
    "verified": true
   },
   "recent_amendments_2023_2026": {
    "value_en": "No amendment to Law 30/2018 was identified for 2023–2026. The 10 executive orders date from 2022 (Orders 42–46/2022 and others).",
    "value_ar": "لم نجد تعديلات على القانون في 2023–2026؛ القرارات التنفيذية صادرة في 2022.",
    "source_url": "https://www.pdp.gov.bh/en/executive-decisions.html",
    "article": "—",
    "verified": "UNVERIFIED",
    "ambiguity_or_note": "The absence was not confirmed against the Official Gazette index."
   }
  },
  "Qatar": {
   "jurisdiction_en": "State of Qatar (onshore)",
   "jurisdiction_ar": "دولة قطر",
   "official_name_number_dates": {
    "value_en": "Law No. (13) of 2016 on Protecting Personal Data Privacy (PDPPL). Issued 3 Nov 2016 (3/2/1438H); published in Official Gazette No. 15 of 2016; effective on publication (Art 32).",
    "value_ar": "قانون رقم (13) لسنة 2016 بشأن حماية خصوصية البيانات الشخصية؛ صدر في 3/2/1438هـ الموافق 3/11/2016؛ الجريدة الرسمية العدد 15 لسنة 2016.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 32",
    "verified": true,
    "ambiguity_or_note": "The exact gazette date (commonly cited as 29 Dec 2016) is UNVERIFIED. Almeezan is JavaScript-rendered and could not be read. The English text used is NCSA's unofficial translation."
   },
   "regulator": {
    "value_en": "The law names the 'Competent Department' of the Ministry of Transport and Communications. The function now sits with the National Data Privacy Office (NDPO) at the National Cyber Security Agency (NCSA).",
    "value_ar": "تنص المادة على 'الإدارة المختصة' بوزارة المواصلات والاتصالات؛ ويتولاها حالياً مكتب حماية خصوصية البيانات الوطني بالوكالة الوطنية للأمن السيبراني.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 1 (definitions)",
    "verified": "UNVERIFIED",
    "ambiguity_or_note": "The instrument transferring the function to NCSA/NDPO was not located."
   },
   "scope_territorial": {
    "value_en": "Applies to personal data that is processed electronically, obtained or gathered in preparation for electronic processing, or processed by combining electronic and traditional processing. There is no explicit extraterritorial clause. Processing for personal or family purposes is excluded.",
    "value_ar": "يسري على البيانات الشخصية المعالجة إلكترونياً أو المجمعة تمهيداً لذلك؛ لا نص صريح على السريان خارج الحدود.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 2-3",
    "verified": true
   },
   "lawful_bases": {
    "value_en": "Consent of the individual, unless processing is necessary for a 'Lawful Purpose' of the controller or of a third party to whom data is sent. The Competent Department may exempt processing for certain public interests (Art 18).",
    "value_ar": "الموافقة، ما لم تكن المعالجة ضرورية لتحقيق غرض مشروع لمراقب البيانات أو الغير.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 4, 18",
    "verified": true
   },
   "consent_default": {
    "value_en": "Yes, with a broad 'Lawful Purpose' alternative.",
    "value_ar": "نعم، مع بديل 'الغرض المشروع'.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 4",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Personal data of a special nature: ethnic origin, children, health or physical/psychological condition, religious creeds, marital relations, criminal offences. Processing requires a permit from the Competent Department. Websites directed at children are subject to additional rules (Art 17).",
    "value_ar": "بيانات ذات طبيعة خاصة: الأصل العرقي، الأطفال، الصحة، المعتقدات الدينية، العلاقة الزوجية، الجرائم؛ تحتاج تصريحاً من الإدارة المختصة.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 16-17",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Withdraw consent; object; request erasure or correction; be notified of processing and of inaccurate disclosure; access.",
    "value_ar": "سحب الموافقة، الاعتراض، المحو أو التصحيح، الإخطار بالمعالجة، الوصول.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 5-6",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "No DPO requirement in the law.",
    "value_ar": "لا يشترط القانون تعيين مسؤول حماية بيانات.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "—",
    "verified": true,
    "ambiguity_or_note": "This is an absence finding."
   },
   "registration_notification": {
    "value_en": "No general controller registration in the law. A permit is required for processing special-nature data (Art 16).",
    "value_ar": "لا تسجيل عام؛ تصريح لمعالجة البيانات ذات الطبيعة الخاصة.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 16",
    "verified": true
   },
   "breach_notification": {
    "value_en": "Processors must notify the controller 'forthwith' of any breach. The controller must notify the individual and the Competent Department if the breach may cause serious damage. The law sets no deadline.",
    "value_ar": "يخطر المعالج المراقب فوراً؛ ويخطر المراقب الفرد والإدارة المختصة إذا كان الاختراق قد يسبب ضرراً جسيماً؛ لا مهلة محددة.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 13-14",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: there is no numeric deadline in the law. NCSA guidelines reportedly specify 72 hours (UNVERIFIED, guidance not obtained)."
   },
   "cross_border_transfer": {
    "value_en": "Liberal default: the controller may not take measures that restrict cross-border data flows unless processing would breach the law or cause serious damage to the individual. There is no adequacy list in the law.",
    "value_ar": "لا يجوز للمراقب اتخاذ إجراءات تحد من تدفق البيانات عبر الحدود إلا إذا كانت المعالجة مخالفة للقانون أو قد تلحق ضرراً جسيماً.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 15",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement in the law.",
    "value_ar": "لا يوجد اشتراط توطين في القانون.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 15",
    "verified": true
   },
   "max_penalties": {
    "value_en": "Fines up to QAR 1,000,000 (various articles) and up to QAR 5,000,000 for breaches of Arts 13, 16(3) and 17. Legal persons face fines up to QAR 1,000,000. No imprisonment.",
    "value_ar": "غرامات حتى مليون ريال، وحتى 5 ملايين ريال لمخالفة المواد 13 و16(3) و17؛ الشخص المعنوي حتى مليون ريال؛ لا حبس.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Arts 23-25",
    "verified": true
   },
   "grace_periods": {
    "value_en": "6 months from the law's effectiveness to comply, extendable by Council of Ministers decision.",
    "value_ar": "مهلة 6 أشهر لتوفيق الأوضاع قابلة للتمديد بقرار من مجلس الوزراء.",
    "source_url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?filename=Law%20No.%20(13)%20of%202016%20on%20Protecting%20Personal%20Data%20Privacy.pdf&mimetype=application%2Fpdf",
    "article": "Art 30",
    "verified": true,
    "ambiguity_or_note": "Whether any extension was granted is UNVERIFIED."
   },
   "recent_amendments_2023_2026": {
    "value_en": "None identified.",
    "value_ar": "لم نجد تعديلات.",
    "source_url": "https://www.almeezan.qa/LawPage.aspx?id=7121",
    "article": "—",
    "verified": "UNVERIFIED",
    "ambiguity_or_note": "Almeezan could not be rendered to confirm."
   }
  },
  "QFC": {
   "jurisdiction_en": "Qatar Financial Centre",
   "jurisdiction_ar": "مركز قطر للمال",
   "official_name_number_dates": {
    "value_en": "QFC Data Protection Regulations 2021 (replacing the 2005 regulations).",
    "value_ar": "لوائح حماية البيانات لمركز قطر للمال لعام 2021.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": true,
    "ambiguity_or_note": "Exact enactment and effective dates are UNVERIFIED; the full regulation PDF returned 404."
   },
   "regulator": {
    "value_en": "QFC Data Protection Office / Data Protection Commissioner.",
    "value_ar": "مكتب حماية البيانات في مركز قطر للمال.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Fact sheet",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to QFC entities (QFC Authority licensees and others).",
    "value_ar": "يسري على كيانات مركز قطر للمال.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Fact sheet",
    "verified": "UNVERIFIED"
   },
   "lawful_bases": {
    "value_en": "Consent, contract, legal obligation, vital interests, public/QFC interest, legitimate interests.",
    "value_ar": "الموافقة، العقد، الالتزام القانوني، المصالح الحيوية، المصلحة العامة، المصلحة المشروعة.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Arts 10-11",
    "verified": true
   },
   "consent_default": {
    "value_en": "No. Consent is one of six bases.",
    "value_ar": "لا.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Art 10",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Special categories are subject to additional conditions.",
    "value_ar": "الفئات الخاصة بشروط إضافية.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "data_subject_rights": {
    "value_en": "Access, rectification, erasure, restriction, portability, objection, rights on automated decisions.",
    "value_ar": "الوصول، التصحيح، المحو، التقييد، النقل، الاعتراض، القرارات المؤتمتة.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Arts 16-22",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Not confirmed.",
    "value_ar": "غير مؤكد.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "registration_notification": {
    "value_en": "Not confirmed.",
    "value_ar": "غير مؤكد.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "breach_notification": {
    "value_en": "Notify the Data Protection Office without undue delay and within 72 hours, unless the breach is not likely to harm.",
    "value_ar": "إخطار المكتب دون تأخير وخلال 72 ساعة ما لم يكن غير مرجح الضرر.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Art 31",
    "verified": true
   },
   "cross_border_transfer": {
    "value_en": "Transfers are allowed under an adequacy list, SCCs, BCRs, derogations, or a DPO permit.",
    "value_ar": "النقل وفق قائمة الكفاية، البنود المعيارية، القواعد الملزمة، الاستثناءات، أو تصريح.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Arts 23-24",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement identified.",
    "value_ar": "لا يوجد اشتراط توطين.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "Arts 23-24",
    "verified": "UNVERIFIED"
   },
   "max_penalties": {
    "value_en": "Not confirmed.",
    "value_ar": "غير مؤكد.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "grace_periods": {
    "value_en": "Not confirmed.",
    "value_ar": "غير مؤكد.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "recent_amendments_2023_2026": {
    "value_en": "Not confirmed.",
    "value_ar": "غير مؤكد.",
    "source_url": "https://www.qfc.qa/media/444bbeol/qfc-data-protection-regulations-2021-fact-sheet.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   }
  },
  "Oman": {
   "jurisdiction_en": "Sultanate of Oman",
   "jurisdiction_ar": "سلطنة عُمان",
   "official_name_number_dates": {
    "value_en": "Royal Decree No. 6/2022 Promulgating the Personal Data Protection Law. Issued 9 Feb 2022; Official Gazette No. 1429 (13 Feb 2022); in force one year after publication (13 Feb 2023). Executive Regulation: Ministerial Decision No. 34/2024, issued 28 Jan 2024, Official Gazette No. 1531 (4 Feb 2024), in force the following day.",
    "value_ar": "مرسوم سلطاني رقم 6/2022 بإصدار قانون حماية البيانات الشخصية؛ الجريدة الرسمية العدد 1429؛ يعمل به بعد سنة من نشره (13 فبراير 2023). اللائحة التنفيذية: القرار الوزاري رقم 34/2024 (الجريدة الرسمية العدد 1531).",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "RD Arts (promulgation); ER Article (decision)",
    "verified": true
   },
   "regulator": {
    "value_en": "Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department.",
    "value_ar": "وزارة النقل والاتصالات وتقنية المعلومات.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Law Arts 1, 7",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to the processing of personal data. There is no explicit territorial or extraterritorial clause. Art 3 excludes from the law: national security, government entities acting under law, legal obligations, the State's economic interests, vital interests, crime detection, contract performance, personal/family use, historical/statistical/scientific research, and data made public by the data subject.",
    "value_ar": "تسري على معالجة البيانات الشخصية دون نص إقليمي صريح؛ مع استثناءات واسعة في م3.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Arts 2-3",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: the territorial reach is not defined."
   },
   "lawful_bases": {
    "value_en": "Explicit written consent of the data subject is required unless the processing falls within an Art 3 exclusion.",
    "value_ar": "موافقة صريحة مكتوبة من صاحب البيانات ما لم تندرج المعالجة ضمن استثناءات م3.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Arts 3, 10",
    "verified": true
   },
   "consent_default": {
    "value_en": "Yes. Explicit written consent is the default (strictest in the GCC).",
    "value_ar": "نعم؛ الموافقة الصريحة المكتوبة هي الأصل.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Art 10",
    "verified": true
   },
   "sensitive_data": {
    "value_en": "Genetic, biometric and health data, ethnic origin, sexual life, political or religious opinions, criminal convictions and security measures: processing is prohibited without a Ministry permit. Children's data requires guardian consent (Art 6).",
    "value_ar": "البيانات الجينية والحيوية والصحية والأصل العرقي والحياة الجنسية والآراء السياسية أو الدينية والأحكام الجنائية: لا تعالج إلا بتصريح من الوزارة.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Arts 5-6; ER Arts 5-8",
    "verified": true
   },
   "data_subject_rights": {
    "value_en": "Withdraw consent, rectify, update, erase, be notified of processing and of any breach, obtain a copy. The controller must respond within 45 days.",
    "value_ar": "العدول عن الموافقة، التصحيح، التحديث، المحو، الإبلاغ بالمعالجة وبالاختراق، الحصول على نسخة؛ الرد خلال 45 يوماً.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "Law Art 11; ER Art 16",
    "verified": true
   },
   "dpo_requirement": {
    "value_en": "Mandatory for all controllers (no threshold).",
    "value_ar": "إلزامي لكل متحكم.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Law Art 20; ER Arts 34-36",
    "verified": true
   },
   "registration_notification": {
    "value_en": "The Ministry keeps a register of controllers and processors. The ER requires the controller to obtain an authorisation (تصريح) from the Ministry 'in application of Art 5 of the Law' before processing; permits are valid up to 5 years. An external auditor is required (Law Art 16).",
    "value_ar": "سجل للمتحكمين والمعالجين لدى الوزارة؛ تصريح مسبق من الوزارة (تطبيقاً للمادة 5) صالح حتى 5 سنوات؛ مدقق خارجي.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "Law Arts 7(h), 16; ER Arts 5, 8, 23-24",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: ER Art 5 refers to Law Art 5, which covers sensitive data, so it is unclear whether authorisation is needed for all processing or only sensitive data."
   },
   "breach_notification": {
    "value_en": "Notify the competent department within 72 hours of becoming aware, if the breach is likely to cause risk. Notify the data subject within 72 hours if the breach is likely to cause serious harm.",
    "value_ar": "إخطار الوزارة خلال 72 ساعة إذا كان الاختراق مرجح المخاطر؛ وصاحب البيانات خلال 72 ساعة عند الضرر الجسيم.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "Law Art 19; ER Arts 30, 32",
    "verified": true
   },
   "cross_border_transfer": {
    "value_en": "Transfers are allowed if the controller has assessed that the recipient country offers adequate protection (ER Arts 38-39). The ER also requires the explicit consent of the data subject before any transfer abroad, except for international obligations or anonymised data (ER Art 37). Unlawful transfer is the most heavily fined offence.",
    "value_ar": "يلزم موافقة صريحة من صاحب البيانات قبل النقل خارج السلطنة (م37 من اللائحة) وتقييم الكفاية؛ والنقل المخالف أشد المخالفات غرامة.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "Law Art 23; ER Arts 37-39",
    "verified": true
   },
   "data_localisation": {
    "value_en": "No localisation requirement.",
    "value_ar": "لا يوجد اشتراط توطين.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Art 23",
    "verified": true
   },
   "max_penalties": {
    "value_en": "Criminal fines (no imprisonment): OMR 500–2,000 (Art 25); OMR 1,000–5,000 (Art 26); OMR 5,000–10,000 (Art 27); OMR 15,000–20,000 (Art 28); OMR 100,000–500,000 for unlawful cross-border transfer (Art 29). Legal persons: OMR 5,000–100,000 (Art 30). Administrative fine up to OMR 2,000 (Art 32, ER Art 44).",
    "value_ar": "غرامات جزائية دون حبس: من 500 حتى 500,000 ريال عماني (أعلاها للنقل المخالف خارج السلطنة)؛ غرامة إدارية حتى 2,000 ريال.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115132533256/PROMULGATING%20THE%20PERSONAL%20DATA%20PROTECTION%20LAW.pdf",
    "article": "Arts 25-30, 32; ER Art 44",
    "verified": true
   },
   "grace_periods": {
    "value_en": "Law in force 1 year after publication (13 Feb 2023). The ER gives controllers 1 year from its effective date to comply (to about 5 Feb 2025).",
    "value_ar": "سنة قبل نفاذ القانون؛ وسنة من نفاذ اللائحة لتوفيق الأوضاع (حتى نحو 5 فبراير 2025).",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "RD Art 4; ER Article II",
    "verified": true
   },
   "recent_amendments_2023_2026": {
    "value_en": "Executive Regulation issued 2024 (Ministerial Decision 34/2024). No amendment to the law was identified.",
    "value_ar": "صدور اللائحة التنفيذية 2024؛ لا تعديلات على القانون.",
    "source_url": "https://prod.mtcit.gov.om/ITAPortal//Data/English/DocLibrary/2024115131527120/Issuing%20the%20Executive%20Regulation%20of%20the%20Personal%20Data%20Protection%20Law.pdf",
    "article": "MD 34/2024",
    "verified": true,
    "ambiguity_or_note": "The absence of amendments is UNVERIFIED (gazette not searched)."
   }
  },
  "Kuwait": {
   "jurisdiction_en": "State of Kuwait",
   "jurisdiction_ar": "دولة الكويت",
   "official_name_number_dates": {
    "value_en": "There is no comprehensive data protection law. The main instrument is CITRA's Data Privacy Protection Regulation (version 2.5), issued by CITRA Decision No. 26 of 2024 dated 7 Feb 2024 (Board approval 5 Dec 2023), effective from publication. It repealed Decision 42/2021 and its amendments (including 244/2023).",
    "value_ar": "لا يوجد قانون شامل؛ لائحة حماية خصوصية البيانات (الإصدار 2.5) الصادرة بقرار الهيئة العامة للاتصالات وتقنية المعلومات رقم (26) لسنة 2024 بتاريخ 7 فبراير 2024، تلغي القرار 42/2021 وتعديلاته.",
    "source_url": "https://www.citra.gov.kw/sites/ar/Lists/CITRADecisions/Attachments/6/R%2026-2024.pdf",
    "article": "Decision 26/2024, Arts 1-3",
    "verified": true,
    "ambiguity_or_note": "The 'no comprehensive law' point is secondary source (DLA Piper, DataGuidance). The CITRA English PDF (V1.8) is the 2021 text, not the 2024 regulation."
   },
   "regulator": {
    "value_en": "Communication and Information Technology Regulatory Authority (CITRA).",
    "value_ar": "الهيئة العامة للاتصالات وتقنية المعلومات.",
    "source_url": "https://www.citra.gov.kw/sites/ar/Pages/DecisionsDetails.aspx?id=6",
    "article": "Decision 26/2024",
    "verified": true
   },
   "scope_territorial": {
    "value_en": "Applies to all service providers licensed by CITRA that process personal data, whether inside or outside Kuwait. The definition of personal data includes legal persons.",
    "value_ar": "تسري على جميع مقدمي الخدمات المرخصين من الهيئة الذين يعالجون بيانات شخصية داخل الكويت أو خارجها؛ وتعريف البيانات يشمل الشخص الاعتباري.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 1 (and definitions)",
    "verified": true,
    "ambiguity_or_note": "The Arabic PDF was OCR'd, so minor OCR uncertainty applies."
   },
   "lawful_bases": {
    "value_en": "Consent of the user; legal obligation; protecting the user's data; identification requirements. Written guardian consent is needed for users under 18.",
    "value_ar": "موافقة المستخدم، الالتزام القانوني، حماية بيانات المستخدم، متطلبات التحقق من الهوية؛ موافقة كتابية من ولي الأمر لمن دون 18.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 3",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "consent_default": {
    "value_en": "Yes, for licensed service providers.",
    "value_ar": "نعم لمقدمي الخدمات المرخصين.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 3",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "sensitive_data": {
    "value_en": "No separate sensitive-data regime was identified in the 2024 regulation.",
    "value_ar": "لم نحدد نظاماً خاصاً للبيانات الحساسة في لائحة 2024.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "data_subject_rights": {
    "value_en": "Information on where data is stored (in or outside Kuwait); notification before transfer abroad; erasure on withdrawal of consent or end of subscription; consent for marketing disclosure.",
    "value_ar": "الإعلام بمكان تخزين البيانات، الإخطار قبل النقل للخارج، المحو عند سحب الموافقة أو انتهاء الاشتراك، الموافقة على الإفصاح التسويقي.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 4",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "dpo_requirement": {
    "value_en": "No express DPO appointment duty was identified. The records template includes a DPO field, and providers outside Kuwait need a representative.",
    "value_ar": "لا التزام صريح بتعيين مسؤول؛ يظهر حقل 'مسؤول حماية البيانات' في السجلات.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 5",
    "verified": "UNVERIFIED"
   },
   "registration_notification": {
    "value_en": "Notify CITRA when disclosing data to affiliates or third parties. Providers are CITRA licensees, so there is no separate registration.",
    "value_ar": "إخطار الهيئة عند الإفصاح لجهات تابعة أو أطراف ثالثة.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 4",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "breach_notification": {
    "value_en": "Notify CITRA within 24 hours of becoming aware of a breach. Notify affected users unless protective measures make the data unintelligible.",
    "value_ar": "إخطار الهيئة خلال 24 ساعة من العلم بالاختراق؛ وإخطار المستخدمين ما لم تطبق تدابير حماية.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 6(1)",
    "verified": true,
    "ambiguity_or_note": "AMBIGUOUS: Art 4 also refers to notifying users/law enforcement 'as soon as possible and no later than 72 hours' (OCR partly garbled). The 24h deadline to CITRA is the strictest in the GCC."
   },
   "cross_border_transfer": {
    "value_en": "Allowed, but the user must be notified before data is transferred outside Kuwait.",
    "value_ar": "مسموح مع إخطار المستخدم قبل النقل خارج الكويت.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 4",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "data_localisation": {
    "value_en": "No general localisation in the privacy regulation. The CITRA Cloud Regulatory Framework classifies data and may restrict hosting of higher-tier data (not analysed).",
    "value_ar": "لا توطين عام في لائحة الخصوصية؛ إطار الحوسبة السحابية قد يقيد.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "—",
    "verified": "UNVERIFIED"
   },
   "max_penalties": {
    "value_en": "Sanctions under CITRA Law No. 37/2014 as amended by Law 98/2015. Amounts not extracted.",
    "value_ar": "العقوبات وفق القانون 37/2014 المعدل بالقانون 98/2015؛ المبالغ غير مستخرجة.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 7(3)",
    "verified": "UNVERIFIED"
   },
   "grace_periods": {
    "value_en": "One year from publication to comply.",
    "value_ar": "مهلة سنة من النشر لتوفيق الأوضاع.",
    "source_url": "https://www.citra.gov.kw/sites/ar/LegalReferences/%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9%20%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA.pdf",
    "article": "Reg. Art 7(1)",
    "verified": true,
    "ambiguity_or_note": "Read from OCR."
   },
   "recent_amendments_2023_2026": {
    "value_en": "Decision 244/2023 amended the 2021 regulation. Decision 26/2024 (7 Feb 2024) replaced it with the new regulation. Decision 34/2024 (18 Feb 2024) repealed the Data Classification Policy (Decisions 9/2021 and 95/2021).",
    "value_ar": "القرار 244/2023 عدل لائحة 2021؛ القرار 26/2024 استبدلها؛ القرار 34/2024 ألغى سياسة تصنيف البيانات.",
    "source_url": "https://www.citra.gov.kw/sites/ar/Lists/CITRADecisions/Attachments/6/R%2026-2024.pdf",
    "article": "Decisions 244/2023, 26/2024, 34/2024",
    "verified": true
   }
  }
 }
}