GCC data protection laws compared: nine regimes, fifteen fields

Personal Data Protection Law (PDPL), Royal Decree No. M/19 dated 9/2/1443H (16 Sep 2021), approving Council of Ministers Resolution No. 98 dated 7/2/1443H; published 17/2/1443H (24 Sep 2021). Amended by Royal Decree No. M/148 dated 5/9/1444H (27 Mar 2023). In force 14 Sep 2023 (720 days after publication, original Art 43). BOE status: in force.

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Issued 20 Sep 2021; Official Gazette No. 712 (supplement), 26 Sep 2021; effective 2 Jan 2022.

Data Protection Law, DIFC Law No. 5 of 2020. Enacted 21 May 2020; in force 1 Jul 2020 (Art 4). Amended by DIFC Laws Amendment Law No. 2 of 2022 and DIFC Laws Amendment Law No. 1 of 2025 (consolidated July 2025). Supplemented by the Data Protection Regulations (consolidated version No. 2, in force 1 Sep 2023).

Data Protection Regulations 2021. Enacted 11 Feb 2021; came into force when the DPR 2015 was repealed (6 months after publication for new establishments, 12 months for existing ones). Consolidated version August 2025.

Law No. (30) of 2018 with respect to the Personal Data Protection Law. Promulgated 12 Jul 2018 (28/10/1439H). Effective 1 Aug 2019 (one year from the first day of the month following publication in the Official Gazette).

Law No. (13) of 2016 on Protecting Personal Data Privacy (PDPPL). Issued 3 Nov 2016 (3/2/1438H); published in Official Gazette No. 15 of 2016; effective on publication (Art 32).

A detail in this cell is not confirmed

QFC Data Protection Regulations 2021 (replacing the 2005 regulations).

A detail in this cell is not confirmed

Royal Decree No. 6/2022 Promulgating the Personal Data Protection Law. Issued 9 Feb 2022; Official Gazette No. 1429 (13 Feb 2022); in force one year after publication (13 Feb 2023). Executive Regulation: Ministerial Decision No. 34/2024, issued 28 Jan 2024, Official Gazette No. 1531 (4 Feb 2024), in force the following day.

There is no comprehensive data protection law. The main instrument is CITRA's Data Privacy Protection Regulation (version 2.5), issued by CITRA Decision No. 26 of 2024 dated 7 Feb 2024 (Board approval 5 Dec 2023), effective from publication. It repealed Decision 42/2021 and its amendments (including 244/2023).

Secondary source

Competent Authority under Art 30: currently the Saudi Data & AI Authority (SDAIA). CoM Resolution 98 designated SDAIA 'for two years', after which transfer of supervision to the National Data Management Office (NDMO) was to be considered. Coordination MoUs with SAMA (Saudi Central Bank) and CST are required (Resolution 98, items). Portal: https://dgp.sdaia.gov.sa

UAE Data Office, established by Federal Decree-Law No. 44 of 2021.

Commissioner of Data Protection (DIFC).

Office of Data Protection, headed by the Commissioner of Data Protection (ADGM).

Personal Data Protection Authority. Its duties are assigned to the Ministry of Justice, Islamic Affairs and Waqf by Decree No. 78 of 2019.

Not confirmed from official text

QFC Data Protection Office / Data Protection Commissioner.

Ministry of Transport, Communications and Information Technology (MTCIT), through its competent department.

Communication and Information Technology Regulatory Authority (CITRA).

Any processing of personal data relating to individuals that takes place in the Kingdom by any means, including processing of personal data of individuals residing in the Kingdom by any party outside the Kingdom (extraterritorial). Covers data of deceased persons where it identifies them or a family member. Excludes purely personal/family use.

Applies to: (1) data subjects who reside in or have a place of business in the State; (2) controllers or processors in the State, whether processing inside or outside the State; (3) controllers or processors outside the State that process data of data subjects inside the State (extraterritorial). Excludes: government data and entities, security and judicial authorities, data processed for personal purposes, health and banking/credit data that have their own legislation, and free zones with their own data protection laws (DIFC, ADGM).

Applies to processing: (a) by a controller or processor incorporated in the DIFC, regardless of where processing takes place; (b) in the DIFC by a controller or processor (or sub-processor), regardless of place of incorporation, as part of stable arrangements, including transfers out of the DIFC. There is no 'offering goods/services' or monitoring limb in the consolidated July 2025 text.

Applies to processing in the context of the activities of an establishment of a controller or processor in ADGM, regardless of whether processing takes place in ADGM. There is no offering/monitoring limb.

Applies to: individuals normally resident in, or with a place of business in, Bahrain; legal persons with a place of business in Bahrain; and persons not resident or established in Bahrain who process data using means located in Bahrain (other than for transit). The last group must appoint an accredited representative. Excludes purely personal processing and certain national security processing.

Applies to personal data that is processed electronically, obtained or gathered in preparation for electronic processing, or processed by combining electronic and traditional processing. There is no explicit extraterritorial clause. Processing for personal or family purposes is excluded.

Not confirmed from official text

Applies to the processing of personal data. There is no explicit territorial or extraterritorial clause. Art 3 excludes from the law: national security, government entities acting under law, legal obligations, the State's economic interests, vital interests, crime detection, contract performance, personal/family use, historical/statistical/scientific research, and data made public by the data subject.

Applies to all service providers licensed by CITRA that process personal data, whether inside or outside Kuwait. The definition of personal data includes legal persons.

Consent (Art 5) plus exceptions in Art 6: (1) actual interest of data subject where contact is impossible/difficult; (2) required by another law or prior agreement; (3) controller is a public entity and processing is required for security or judicial purposes; (4) legitimate interest of the controller (not for sensitive data, subject to IR conditions).

Processing without consent is prohibited, except in 11 cases: public interest; personal data made public by the data subject; legal claims and judicial proceedings; occupational or preventive medicine; public health; archiving or scientific research; protecting the data subject's interests; employment and social security obligations; contract performance; legal obligations; other cases set by the Executive Regulations. There is no general legitimate-interest basis.

GDPR-style: consent; contract; compliance with Applicable Law; vital interests; DIFC Body tasks/powers; legitimate interests (subject to Art 13).

GDPR-style six bases: consent, contract, legal obligation, vital interests, public task, legitimate interests.

Consent; or processing necessary for: contract performance or pre-contract steps; a legal obligation (other than contractual) or court order; protecting the data subject's vital interests; or the legitimate interests of the controller or a third-party recipient, unless overridden by the data subject's rights.

Consent of the individual, unless processing is necessary for a 'Lawful Purpose' of the controller or of a third party to whom data is sent. The Competent Department may exempt processing for certain public interests (Art 18).

Consent, contract, legal obligation, vital interests, public/QFC interest, legitimate interests.

Explicit written consent of the data subject is required unless the processing falls within an Art 3 exclusion.

Consent of the user; legal obligation; protecting the user's data; identification requirements. Written guardian consent is needed for users under 18.

Yes. Consent is the default rule. Explicit consent is required for sensitive data, credit data, and decisions based solely on automated processing.

Yes. Consent is the rule and processing without it is prohibited unless an Art 4 exception applies. Consent must be specific, clear and unambiguous, and withdrawable (Art 6).

No. Consent is one of six equal bases.

No. Consent is one of six bases.

Consent is listed first, but legitimate interests and other bases are alternatives, so consent is not the exclusive default (GDPR-like). Sensitive data requires consent or an Art 5 exception.

Yes, with a broad 'Lawful Purpose' alternative.

No. Consent is one of six bases.

Yes. Explicit written consent is the default (strictest in the GCC).

Yes, for licensed service providers.

Sensitive data: racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric or genetic data for identification; health data; data indicating that one or both parents are unknown. Explicit consent is needed, and legitimate interest is not available. Disclosing sensitive data with intent to harm is a crime (Art 35).

Sensitive personal data: data revealing family, ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, health data, and genetic or sexual condition. Sensitive data triggers DPO/DPIA duties (Arts 10, 21). There is no separate consent tier in the decree-law text.

Special Categories of Personal Data may be processed only if an Art 11 condition applies (explicit consent, employment, vital interests, and others).

Processing of special categories is prohibited unless a s7(2) exception applies. The 2025 amendment added 'other conditions in Rules' (s7(2)(k)(xii)), and the Substantial Public Interest Rules 2025 followed.

Sensitive data: race, ethnic origin, political or philosophical opinions, religious beliefs, union affiliation, criminal record, health or sexual life. Processing requires consent or an Art 5 exception. Prior written authorisation from the Authority is required for automated processing of sensitive data, biometric and genetic data, linking of files, and visual recording for surveillance.

Personal data of a special nature: ethnic origin, children, health or physical/psychological condition, religious creeds, marital relations, criminal offences. Processing requires a permit from the Competent Department. Websites directed at children are subject to additional rules (Art 17).

Not confirmed from official text

Genetic, biometric and health data, ethnic origin, sexual life, political or religious opinions, criminal convictions and security measures: processing is prohibited without a Ministry permit. Children's data requires guardian consent (Art 6).

Not confirmed from official text

Right to be informed; access; obtain copy in readable/clear format; correction/completion/update; destruction. Requests must be answered within 30 days, which can be extended by up to 30 more. Complaints go to the Competent Authority (Art 34). Compensation is available through the courts (Art 40).

Information/access, portability, rectification and erasure, restriction, objection (including to direct marketing), and objection to automated decisions. Complaints go to the Data Office.

Withdraw consent; access, rectification, erasure; objection; restriction; portability; rights on automated decisions and profiling; non-discrimination. A private right of action for compensation was added in 2025 (Art 64A).

Information, access, rectification, erasure, restriction, portability, objection, rights on automated decisions; complaint to the Commissioner; court claims.

Right to be informed; access (response within 15 working days); objection to processing causing damage; objection to direct marketing; objection to automated decisions; rectification, blocking and erasure (response within 10 working days); complaint to the Authority; compensation.

Withdraw consent; object; request erasure or correction; be notified of processing and of inaccurate disclosure; access.

Access, rectification, erasure, restriction, portability, objection, rights on automated decisions.

Withdraw consent, rectify, update, erase, be notified of processing and of any breach, obtain a copy. The controller must respond within 45 days.

Information on where data is stored (in or outside Kuwait); notification before transfer abroad; erasure on withdrawal of consent or end of subscription; consent for marketing disclosure.

Mandatory where: (1) a public entity provides services involving large-scale processing; (2) core activities require regular and systematic monitoring of data subjects; (3) core activities consist of processing sensitive data. The DPO may be an employee or an external contractor.

Mandatory where processing carries a high risk because of new technologies or data volume, involves systematic and comprehensive assessment of sensitive data (including profiling), or involves large volumes of sensitive data. The DPO may be located inside or outside the State, and the Office must be notified of the DPO's contact details.

Mandatory for DIFC Bodies (other than courts acting judicially) and for controllers or processors performing High Risk Processing Activities on a systematic or regular basis. The Commissioner may require others to appoint one. The DPO must reside in the UAE unless they are a group employee performing a similar international function.

Mandatory for public authorities, for large-scale regular and systematic monitoring, and for large-scale processing of special categories.

Appointing a Data Protection Guardian is optional unless the Board obliges certain categories. A controller that appoints one must notify the Authority within 3 working days. Appointing a Guardian exempts the controller from the Art 14 prior notification. Rules are in Order No. 46 of 2022.

A detail in this cell is not confirmed

No DPO requirement in the law.

Not confirmed from official text

Mandatory for all controllers (no threshold).

Not confirmed from official text

Registration on the National Data Governance Platform is mandatory where: (1) the controller is a public entity; (2) its main activity is personal data processing; (3) it processes sensitive data; (4) an individual processes data beyond personal/family use. Law Art 32 (the original registration article) was repealed by M/148. The register now rests on Art 30(4)(c) and IR Art 34.

Secondary source

There is no general controller registration or notification regime in the Decree-Law. The Executive Regulations, which have not been located, could add one.

Controllers and processors must register with the Commissioner by filing a notification of processing operations, keep it updated, and pay the prescribed fee. Notifications go on a public register.

Controllers must pay the Data Protection Fee and notify the Commissioner of their name and address before, or as soon as practicable after, processing begins, and renew annually. A fixed penalty applies for non-payment (s56).

Prior notification to the Authority is required before carrying out any wholly or partly automated processing, unless exempt (for example where a Data Protection Guardian is appointed). Changes must be notified within 30 days. Prior authorisation is required for the high-risk processing listed in Art 15. Procedures are in Order No. 44 of 2022.

No general controller registration in the law. A permit is required for processing special-nature data (Art 16).

Not confirmed from official text

The Ministry keeps a register of controllers and processors. The ER requires the controller to obtain an authorisation (تصريح) from the Ministry 'in application of Art 5 of the Law' before processing; permits are valid up to 5 years. An external auditor is required (Law Art 16).

Notify CITRA when disclosing data to affiliates or third parties. Providers are CITRA licensees, so there is no separate registration.

Notify the Competent Authority within 72 hours of becoming aware, if the incident may cause harm to the personal data or the data subject or conflict with their rights. Any missing information may follow as soon as possible, with reasons. Data subjects must be notified without undue delay if the breach may harm their data or conflict with their rights.

Secondary source

The controller must notify the Data Office of a breach that would prejudice privacy, confidentiality or security, 'within the period and in the manner determined by the Executive Regulations', and must also notify the data subject. Processors must notify the controller as soon as they become aware.

Secondary source

Notify the Commissioner 'as soon as practicable in the circumstances' of a breach that compromises data subjects' confidentiality, security or privacy. Notify data subjects as soon as practicable where the breach is likely to result in high risk.

Notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. Delays must be explained. Data subjects must be told without undue delay where the risk is high.

The controller must have procedures to inform the Authority of any breach within 72 hours of discovery, unless the breach would not affect data subjects' rights. Late notices must give reasons. The 72-hour rule is in a ministerial order, not in the law.

Processors must notify the controller 'forthwith' of any breach. The controller must notify the individual and the Competent Department if the breach may cause serious damage. The law sets no deadline.

A detail in this cell is not confirmed

Notify the Data Protection Office without undue delay and within 72 hours, unless the breach is not likely to harm.

Notify the competent department within 72 hours of becoming aware, if the breach is likely to cause risk. Notify the data subject within 72 hours if the breach is likely to cause serious harm.

Notify CITRA within 24 hours of becoming aware of a breach. Notify affected users unless protective measures make the data unintelligible.

Transfer or disclosure outside the Kingdom is allowed for the purposes listed in Art 29 (Kingdom's obligations, Kingdom's interests, contract performance, other purposes in the regulations) if: no prejudice to national security or vital interests; adequate protection (adequacy list, reviewed at least every 4 years); limited to minimum data. Without adequacy, transfers may rely on SCCs, Binding Common Rules, an accreditation certificate, or limited derogations. Risk assessment is needed for exemption-based transfers and for continuous or large-scale transfers of sensitive data.

Transfers are allowed to countries with adequate data protection legislation, or under bilateral/multilateral agreements, in cases approved by the Office (Art 22). Without adequacy, transfers may rely on: a binding contract or agreement with equivalent protection; express consent of the data subject; legal claims; contract performance; international judicial cooperation; or public interest (Art 23).

Transfers are allowed to jurisdictions the Commissioner has found adequate (Art 26). Otherwise transfers need appropriate safeguards (SCCs, BCRs, and similar) or specific derogations (Art 27). Data sharing with public authorities is regulated by Art 28 (amended 2025).

Transfers are allowed on the basis of adequacy decisions, appropriate safeguards (including SCCs), BCRs, or derogations. Data sharing with public authorities is covered separately.

Transfers outside Bahrain are prohibited except to countries or territories on the Authority's adequacy list, or with case-by-case Authority authorisation. Statutory exemptions include consent, contract, legal claims, vital interests, and public registers. Order No. 42 of 2022 lists 83 adequate countries and territories, including the USA, UK, China, India, Russia, Israel, KSA, UAE, Kuwait and Oman. Qatar is not on the list.

Liberal default: the controller may not take measures that restrict cross-border data flows unless processing would breach the law or cause serious damage to the individual. There is no adequacy list in the law.

Transfers are allowed under an adequacy list, SCCs, BCRs, derogations, or a DPO permit.

Transfers are allowed if the controller has assessed that the recipient country offers adequate protection (ER Arts 38-39). The ER also requires the explicit consent of the data subject before any transfer abroad, except for international obligations or anonymised data (ER Art 37). Unlawful transfer is the most heavily fined offence.

Allowed, but the user must be notified before data is transferred outside Kuwait.

No general data-localisation requirement in the in-force Law, IR or Transfer Regulation. Sector rules (government/NDMO/NCA, SAMA, CST cloud) may impose residency, but those are outside this dataset. A pending 2026 IR draft proposes a new Art 23(2) requiring storage within the Kingdom (consultation only).

Secondary source

No localisation requirement in the Decree-Law. Sector laws (for example health data under Federal Law 2/2019) may require local storage, but those are outside this dataset.

No localisation requirement.

No localisation requirement.

No localisation requirement.

No localisation requirement in the law.

Not confirmed from official text

No localisation requirement.

Not confirmed from official text

Criminal: disclosing or publishing sensitive data in breach of the law with intent to harm or for personal benefit carries up to 2 years' imprisonment and/or a fine up to SAR 3,000,000. Other violations: warning or fine up to SAR 5,000,000. Both can be doubled for repeat offences. Courts may also order confiscation and publication of the judgment, and compensation is available.

No penalty amounts exist yet. Art 26 provides that administrative penalties will be set by a Cabinet decision, and no such decision is listed on the official legislation portal (related-legislations page checked 22 Oct 2026). The decree-law contains no criminal penalties. Criminal exposure may arise under the Cybercrime Decree-Law 34/2021, which is out of scope.

Secondary source

Administrative fines up to the Schedule 2 amounts for each listed contravention, ranging from USD 25,000 to USD 100,000 (USD 100,000 for Arts 33-38 rights breaches; USD 50,000 for breach-notification failures). Separately, Art 62(3) allows a fine 'not limited to' the Schedule 2 amounts for general contraventions, which means there is no stated cap. Courts can award compensation (Arts 63-64A). No criminal penalties.

Administrative fines up to USD 28 million, plus a fixed penalty for fee non-payment. No criminal penalties in the DPR.

Administrative: fine up to BD 20,000; daily penalty up to BD 1,000 (BD 2,000 for a repeat within 3 years); authorisation withdrawal; publication. Criminal: up to 1 year's imprisonment and/or a fine of BD 1,000–20,000 (for example unlawful sensitive-data processing, unlawful transfer, processing without notification). Fines are doubled for legal persons (up to BD 40,000).

Fines up to QAR 1,000,000 (various articles) and up to QAR 5,000,000 for breaches of Arts 13, 16(3) and 17. Legal persons face fines up to QAR 1,000,000. No imprisonment.

Not confirmed from official text

Criminal fines (no imprisonment): OMR 500–2,000 (Art 25); OMR 1,000–5,000 (Art 26); OMR 5,000–10,000 (Art 27); OMR 15,000–20,000 (Art 28); OMR 100,000–500,000 for unlawful cross-border transfer (Art 29). Legal persons: OMR 5,000–100,000 (Art 30). Administrative fine up to OMR 2,000 (Art 32, ER Art 44).

Not confirmed from official text

Controllers had up to one year from entry into force (to 14 Sep 2024) to comply, and the Competent Authority may grant extra time to some entities. Application of Art 33(1)-(2) was deferred for up to 5 years, but that deferral was repealed by M/148.

The Executive Regulations were due within 6 months of publication (Art 28). Controllers and processors have 6 months from the issuance of the Executive Regulations to comply, extendable by Cabinet (Art 29). Because no Executive Regulations have been located, that compliance window has arguably not started.

Not confirmed from official text

Transition from DPR 2015: 6 months after publication for establishments set up on or after publication, and 12 months for existing establishments.

Law effective one year after the first day of the month following publication (1 Aug 2019). No other general transition was found.

6 months from the law's effectiveness to comply, extendable by Council of Ministers decision.

A detail in this cell is not confirmed

Not confirmed from official text

Law in force 1 year after publication (13 Feb 2023). The ER gives controllers 1 year from its effective date to comply (to about 5 Feb 2025).

One year from publication to comply.

2023: RD M/148 amended the law (definitions, consent wording, repeal of registration Art 32, etc.); IR and first Transfer Regulation issued (Sep 2023). Aug 2024: Transfer Regulation v2.0. 2024–2025: National Register Rules, DPO Rules, SCCs and BCR guidelines. 27 Apr–27 May 2025: first draft IR amendments consulted. 6 Oct–5 Nov 2026: second draft 'تعديلات اللائحة التنفيذية لنظام حماية البيانات الشخصية' open on Istitlaa. Reported content (secondary): in-Kingdom storage, no harm threshold for 72h notice, registration triggered by transfers abroad, requests deemed rejected after 30+30 days.

Secondary source

No amendment to Decree-Law 45/2021 and no Executive Regulations are listed on the official portal (the page shows last update 20 Sep 2021). Related instruments listed there: the KYC Digital Platform decree-law and the Child Digital Safety decree-law.

DP Regulations consolidated v2 in force 1 Sep 2023. DIFC Laws Amendment Law No. 1 of 2025 (enacted Jul 2025) added a private right of action (Art 64A), revised data sharing with public authorities (Art 28), and made other changes.

Amendments of 1 Nov 2023 (Al Reem Island transition), 28 Feb 2024 (fines), Amendment No. 1 of 2025, and the Substantial Public Interest Rules 2025 (announced 11 Sep 2025). Consolidated version August 2025.

Not confirmed from official text

Not confirmed from official text

Not confirmed from official text

Executive Regulation issued 2024 (Ministerial Decision 34/2024). No amendment to the law was identified.

A detail in this cell is not confirmed

Decision 244/2023 amended the 2021 regulation. Decision 26/2024 (7 Feb 2024) replaced it with the new regulation. Decision 34/2024 (18 Feb 2024) repealed the Data Classification Policy (Decisions 9/2021 and 95/2021).