Guide · GCC data protection
GCC data protection and data residency: a guide for law firms and in-house legal teams
Written for law firms and for in-house legal teams that put client or company data into cloud and AI tools. This page is the compliance guide: duties, breach notice and what to ask a vendor. It covers the personal data protection rules of the UAE (federal, DIFC and ADGM), Saudi Arabia, Qatar, Bahrain, Kuwait and Oman. The field-by-field comparison is GCC data protection laws compared. Data residency is where data is stored; a cross-border transfer is sending data, or giving access to it, outside a jurisdiction. Every statement links to the official source it relies on, and points we could not verify are marked “to be confirmed”.
General information, not legal advice. Laws and regulator guidance change; check the official sources linked and consult qualified counsel in the relevant jurisdiction. Last reviewed: 22 October 2026.
Key takeaways
- There is no single GCC data protection law. Each state has its own instrument, and the DIFC and ADGM financial free zones have their own regimes.[4][5][6]
- The UAE federal PDPL excludes free-zone entities that have their own data protection legislation, so DIFC and ADGM entities look to DIFC Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021.[4][5][6]
- Saudi Arabia’s NCA Cloud Cybersecurity Controls (CCC-2:2024) deleted the subcontrols requiring cloud services from within the Kingdom and state that data localisation moved to the NDMO at SDAIA. Commentary based on the earlier version may be out of date.[14]
- Defaults differ. Qatar’s law bars controllers from limiting cross-border data flows unless the processing breaches the law or may cause serious damage; Bahrain prohibits transfers except to countries on its Authority’s adequacy list, with case-by-case authorisation, or under listed exemptions.[16][20]
- A transfer can happen without moving files: ADGM guidance treats granting access from another jurisdiction, such as a cloud platform accessed from abroad, as a transfer.[6]
Residency vs transfer vs localisation: the terms
Vendors use these words loosely. This guide uses them as follows. For the underlying concept, see personal data protection in our GCC legal glossary. Separate entries define the controller (جهة التحكم in Saudi Arabia, المتحكم in the UAE), the processor, sensitive personal data and the data protection officer.
- Data residency: the country or region where data, backups and logs are physically stored.
- Cross-border transfer: sending personal data outside a jurisdiction, or making it accessible from outside. Some regimes, such as ADGM, expressly treat granting access as a transfer.[6]
- Data localisation: a legal or contractual requirement that certain data stays in the country. Whether it applies depends on the jurisdiction, the sector, the type of data and the client.
Compliance summary: instrument, regulator and transfers
A short compliance summary for legal teams. Each cell links to its official source. “To be confirmed” marks a point we could not verify from an official source for this edition. The 15-field matrix is <compare>GCC data protection laws compared</compare>.
Scroll sideways to see all columns.
| Jurisdiction | Instrument (English) | Official Arabic name | Regulator | Cross-border stance (summary) | In force |
|---|---|---|---|---|---|
| UAE (onshore) | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data[4] | مرسوم بقانون اتحادي رقم (45) لسنة 2021 بشأن حماية البيانات الشخصية[1] | UAE Data Office, established by Federal Decree-Law No. 44 of 2021[3][2] | Allowed to countries with adequate data protection legislation, or under a bilateral or multilateral agreement, in cases approved by the Office. Where no adequate level exists, listed exceptions apply (contract, explicit consent, legal claims, contract performance, international judicial cooperation, public interest). Controls are left to the Executive Regulations.[4] | To be confirmedStatus of the Executive Regulations not verified |
| UAE – DIFC | DIFC Data Protection Law No. 5 of 2020[5] | To be confirmedOfficial Arabic title not verified | Commissioner of Data Protection[5] | Transfers outside the DIFC only to adequate jurisdictions; otherwise through exceptions such as additional contractual clauses (DIFC standard contractual clauses), internal policies or limited derogations.[5] | To be confirmedNot verified for this edition |
| UAE – ADGM | Data Protection Regulations 2021[6] | أنظمة حماية البيانات لعام 2021[8] | Office of Data Protection, headed by the Commissioner of Data Protection[8] | Restricted. Allowed on adequacy, appropriate safeguards (ADGM standard contractual clauses, binding corporate rules), approved codes or certification, or derogations. “Transfer” includes granting remote access.[6][7] | To be confirmedNot verified for this edition |
| Saudi Arabia | Personal Data Protection Law (Royal Decree M/19, amended by Royal Decree M/148) and the Regulation on Personal Data Transfer outside the Kingdom[10][12] | نظام حماية البيانات الشخصية[9] | SDAIA publishes the law and its regulations and runs the National Data Governance Platform[9] | The competent authority publishes an adequacy list. Exemption cases require appropriate safeguards (standard contractual clauses, binding common rules, a certificate of accreditation). A risk assessment is required in specified cases.[12] | 14 September 2023, with a one-year grace period[11] |
| Saudi Arabia – cloud | NCA Cloud Cybersecurity Controls (CCC-2:2024)[14] | To be confirmedضوابط الأمن السيبراني للحوسبة السحابية (Arabic title not checked against NCA’s Arabic edition) | National Cybersecurity Authority (NCA)[14] | Applies to government entities, private owners or operators of critical national infrastructure, and the cloud service providers serving them. The 2024 version deleted the in-Kingdom hosting subcontrols and moved data localisation to the NDMO at SDAIA.[14] | To be confirmedNot verified for this edition |
| Qatar | Law No. (13) of 2016 on Protecting Personal Data Privacy[15][16] | قانون رقم (13) لسنة 2016 بشأن حماية خصوصية البيانات الشخصية[15] | National Data Privacy Office (NDPO), part of the National Cyber Security Agency (NCSA)[17] | Controllers may not limit cross-border data flows unless the processing breaches the law or may cause serious damage. Special-nature data needs permission from the competent department.[16] | To be confirmedNot verified for this edition |
| Bahrain | Law No. (30) of 2018 on Personal Data Protection[18] | قانون رقم (30) لسنة 2018 بإصدار قانون حماية البيانات الشخصية[18] | Personal Data Protection Authority (duties assigned to the Ministry of Justice, Islamic Affairs and Waqf by Royal Decree No. 78 of 2019)[19] | Prohibited except to countries on the Authority’s adequacy list, with case-by-case authorisation, or under listed exemptions (such as consent, contract, legal claims and court orders).[20] | 1 August 2019[19] |
| Kuwait | CITRA Data Privacy Protection Regulation (Decision No. 26/2024, repealing Decision No. 42/2021)[21] | لائحة حماية خصوصية البيانات[21] | Communication and Information Technology Regulatory Authority (CITRA)[21] | Sectoral (CITRA licensees). The user must be notified before personal data is transferred outside Kuwait (Decision 26/2024, Regulation Art 4).[27] | Decision dated 7 February 2024[21] |
| Oman | Personal Data Protection Law (Royal Decree 6/2022) and Executive Regulation (Ministerial Decision 34/2024)[24][26] | مرسوم سلطاني رقم ٦ / ٢٠٢٢ بإصدار قانون حماية البيانات الشخصية[24] | Ministry of Transport, Communications and Information Technology (MTCIT)[24] | Controllers may transfer data outside Oman under the controls set by the Regulation. Prohibited if the data was processed unlawfully or the transfer is likely to harm the data subject. The Regulation has a chapter on cross-border transfers.[25][26] | One year after publication of the decree[24] |
United Arab Emirates (UAE PDPL)
Federal Decree-Law No. 45 of 2021
The onshore law is Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (مرسوم بقانون اتحادي رقم (45) لسنة 2021 بشأن حماية البيانات الشخصية).[1][4]
It applies to controllers and processors in the UAE, and to controllers and processors outside the UAE that process personal data of data subjects in the UAE.[4]
It excludes government data and government entities, data held by security and judicial authorities, health and banking data governed by their own legislation, and free-zone entities that have their own data protection legislation.[4]
The regulator is the UAE Data Office, established by Federal Decree-Law No. 44 of 2021. The UAE Government portal describes it as the federal data regulator, affiliated with the Cabinet.[3][2]
Personal data may be transferred to countries with adequate data protection legislation, or under a bilateral or multilateral agreement, in cases approved by the Office. Where no adequate level exists, the law lists exceptions, including a contract, explicit consent, legal claims, performance of a contract, international judicial cooperation and the public interest, with controls set by the Executive Regulations.[4]
To be confirmedWhether the Executive Regulations have been issued, and from when the law is enforced, could not be confirmed from official sources. Check the current status with the UAE Data Office before relying on a date.
DIFC Data Protection Law No. 5 of 2020
The Dubai International Financial Centre has its own regime, DIFC Data Protection Law No. 5 of 2020, supervised by the Commissioner of Data Protection.[5]
Personal data may leave the DIFC only for jurisdictions with adequate protection. Otherwise exporters rely on exceptions such as additional contractual clauses (the DIFC publishes standard contractual clauses), internal policies or limited derogations.[5]
The law also sets obligations for sharing personal data with public authorities and law enforcement.[5]
To be confirmedThe official Arabic title of the DIFC law has not been verified for this edition.
ADGM Data Protection Regulations 2021
Abu Dhabi Global Market applies its Data Protection Regulations 2021 (أنظمة حماية البيانات لعام 2021), overseen by an independent Office of Data Protection headed by a Commissioner.[8]
Transfers outside ADGM are restricted. Permitted routes are adequacy, appropriate safeguards such as standard contractual clauses or binding corporate rules, and derogations. Approved codes of conduct and certification are also possible; ADGM’s May 2025 brochure noted that none had been approved.[6]
ADGM guidance treats granting access from another jurisdiction, for example to a cloud platform accessed from abroad, as a transfer.[6]
The Office of Data Protection publishes the list of jurisdictions it considers adequate.[7]
Saudi Arabia (Saudi PDPL)
PDPL and the Transfer Regulation (SDAIA)
The Personal Data Protection Law (نظام حماية البيانات الشخصية) was issued by Royal Decree M/19 (9/2/1443 AH) and amended by Royal Decree M/148 (5/9/1444 AH).[10]
It applies to any processing of personal data relating to individuals that takes place in the Kingdom, by any means, including processing of personal data relating to individuals in the Kingdom by any entity outside the Kingdom.[9]
The law came into force on 14 September 2023 with a one-year grace period, which has now ended.[11]
SDAIA publishes the law and its regulations, and compliance is assessed through its National Data Governance Platform (منصة حوكمة البيانات الوطنية).[9]
Under the Regulation on Personal Data Transfer outside the Kingdom, the competent authority publishes a list of countries with an adequate level of protection and reviews it every four years or as needed.[12]
Transfers under the exemption cases require appropriate safeguards: standard contractual clauses, binding common rules or a certificate of accreditation.[12]
A risk assessment is required before transfers under the exemption cases, and for continuous or widespread transfers of sensitive data.[12]
NCA Cloud Cybersecurity Controls (CCC)
The National Cybersecurity Authority’s Cloud Cybersecurity Controls (CCC-2:2024) apply to government entities, inside or outside the Kingdom, to private entities that own, operate or host critical national infrastructure, and to the cloud service providers serving them.[14]
The 2024 version deleted the subcontrols that required cloud services to be provided from within the Kingdom, and states that data localisation was transferred to the National Data Management Office (NDMO) at SDAIA.[14]
The controls use four data classification levels: top secret, secret, confidential and public.[14]
To be confirmedThe NDMO’s current data localisation rules for private-sector personal data have not been verified for this edition. Check them with SDAIA before relying on any summary.
Qatar (PDPPL)
Qatar’s Law No. (13) of 2016 on Protecting Personal Data Privacy (قانون رقم (13) لسنة 2016 بشأن حماية خصوصية البيانات الشخصية) is the main instrument.[15]
The regulator is the National Data Privacy Office (NDPO), part of the National Cyber Security Agency, which issues legally binding decisions.[17]
The default favours data flows: a controller may not take measures that limit cross-border data flows unless the processing breaches the law or may cause serious damage. The English translation NCSA hosts is marked as not official.[16]
Personal data of a special nature, including data on ethnic origin, children, health, religion, marriage and criminal records, needs permission from the competent department.[16]
To be confirmedThe Qatar Financial Centre’s separate data protection regime is not covered in this edition.
Bahrain (PDPL)
Bahrain’s instrument is Law No. (30) of 2018 (قانون رقم (30) لسنة 2018 بإصدار قانون حماية البيانات الشخصية).[18]
It came into force on 1 August 2019. Royal Decree No. 78 of 2019 assigned the duties of the Personal Data Protection Authority to the Ministry of Justice, Islamic Affairs and Waqf.[19]
Transfers outside Bahrain are prohibited unless the destination is on the Authority’s list of countries with adequate protection, or the Authority authorises the transfer case by case.[20]
Exemptions include the data subject’s consent, performance of a contract, vital interests, a legal obligation or court order, and legal claims.[20]
Some processing needs the Authority’s prior written authorisation, for example automatic processing of sensitive data, processing of biometric data and linking of records.[19]
Order No. 43 of 2022, Article 4, requires the controller to have procedures to inform the Authority of a breach within 72 hours of discovery, unless the breach would not affect data subjects' rights.[28]
Kuwait (CITRA Data Privacy Protection Regulation)
CITRA Decision No. 26/2024, dated 7 February 2024, issued the Data Privacy Protection Regulation (لائحة حماية خصوصية البيانات) and repealed Decision No. 42/2021.[21][22]
Under CITRA Decision 26/2024, the regulation applies to service providers licensed by CITRA that process personal data, inside or outside Kuwait. The user must be notified before personal data is transferred outside Kuwait (Regulation Art 4).[27]
The English PDF marked V1.8 is the 2021 text. Decision 26/2024 replaced it. Cite the 2024 decision and the 2024 Arabic regulation, not the V1.8 file.[22]
A licensed provider must notify CITRA within 24 hours of becoming aware of a breach (Regulation Art 6(1)). Article 4 also refers to notice to users and law enforcement within 72 hours; that sentence in the published Arabic text is partly unclear.[27]
Separately, CITRA’s cloud rules require cloud service providers hosting Tier 3 or Tier 4 data in Kuwait to be licensed, while providers hosting Tier 1 or Tier 2 data register.[23]
To be confirmedWhether Kuwait has a general, non-sectoral personal data protection statute has not been verified for this edition.
Oman (PDPL)
Royal Decree 6/2022 (مرسوم سلطاني رقم ٦ / ٢٠٢٢ بإصدار قانون حماية البيانات الشخصية) issued the Personal Data Protection Law, effective one year after its publication. The Ministry the law refers to is the Ministry of Transport, Communications and Information Technology (MTCIT).[24]
A controller may transfer personal data outside Oman under the controls set by the Executive Regulation, but not if the data was processed unlawfully or the transfer is likely to harm the data subject.[25]
The Executive Regulation, issued by Ministerial Decision 34/2024, sets a permit regime, requires breach notification to the Ministry within 72 hours, and has chapters on data protection officers and cross-border transfers. The administrative fine is capped at OMR 2,000 (Art 32). Criminal fines for unlawful cross-border transfer reach OMR 500,000 (Art 29).[26][25]
What this means when your team uses AI or cloud tools
- Confidentiality is a separate duty. Client confidentiality and professional secrecy apply alongside data protection law, including to documents that contain no personal data.
- Prompts and uploads are processing. Text you type into an AI tool, the documents you upload and the outputs it generates are processed by the vendor, along with any personal data they contain.
- Check the processor contract. A vendor that processes personal data on your behalf acts as your processor. Review its contract against the law that applies to you and your client.
- Follow the sub-processors. Model providers, hosting providers and support teams can each be a sub-processor, and each can be a separate transfer.
- Access can be a transfer. ADGM guidance treats granting access from another jurisdiction as a transfer, which matters for offshore support teams and global AI platforms.[6]
For how sourced answers work in practice, see AI legal research. For team-specific considerations, see Qanu for in-house legal teams and for law firms. A starting point for internal rules is the AI use policy template for law firms. For hosting, see how Qanu hosts data. For the workspace, see legal AI and document storage.
Vendor-questions checklist for legal teams
Send these questions to any cloud or AI vendor before you upload client or company data.
- In which countries are our data, backups, logs and disaster-recovery copies stored? Can we pin a region?
- From which countries can your staff or sub-processors access our data, for example for support or monitoring? ADGM treats access as a transfer.[6]
- Are prompts, uploaded documents and outputs used to train or improve models? Is that off by default, and is it in the contract?
- Which AI model providers process our data, where, and with what retention?
- Can we see the full sub-processor list, and how are we notified of changes?
- Which transfer mechanism do you rely on for each jurisdiction (adequacy, standard contractual clauses such as the DIFC, ADGM or Saudi clauses, binding corporate rules, consent)? Will you sign them?[5][6][12]
- Will you sign a data processing agreement that meets the relevant law? See reviewing DPAs and vendor contracts.
- How fast will you tell us about a breach? Oman’s Executive Regulation, for example, requires notification to the Ministry within 72 hours, so a vendor needs to tell you sooner.[26]
- How long do you keep our data? Can we delete it when a matter closes, and is deletion certified?
- Is data encrypted at rest and in transit, and who holds the keys?
- Do you support SSO, role-based access, matter-level permissions and audit logs we can export for our records?
- What is your policy on government and law-enforcement requests, will you notify us, and what safeguards apply? The DIFC law sets specific obligations for sharing with public authorities.[5]
- Which independent security attestations do you hold? Ask for the reports themselves; do not rely on logos.
- For KSA government or critical national infrastructure clients: is the service within the scope of the NCA Cloud Cybersecurity Controls, and how do you meet them?[14]
- How do you support data subject requests (access, correction, deletion) within statutory timelines?
- On exit, in what format and how quickly can we export our data, and will you delete it after termination?
- Can the service process Arabic documents natively, without sending them to a translation service in a third country? Ask; do not assume.