GCC Privacy Laws: A Country-by-Country Guide

The Gulf Cooperation Council nations are in the midst of a regulatory transformation. Over the past five years, five of the six GCC states have enacted comprehensive data protection legislation, transforming a region that previously had minimal privacy regulation into one with overlapping frameworks that businesses must navigate carefully. For any company operating across the GCC — whether a Saudi e-commerce brand shipping to all six countries, a UAE-based SaaS platform with regional customers, or a multinational with offices across the Gulf — understanding the specific requirements in each jurisdiction is essential to avoid penalties, maintain trust, and operate legally.

Saudi Arabia — Personal Data Protection Law (PDPL)

Saudi Arabia's PDPL (Royal Decree M/19) is the most comprehensive and actively enforced privacy law in the GCC. Fully effective since September 2023, it is administered by SDAIA (the Saudi Data and Artificial Intelligence Authority), which functions as a centralized supervisory authority with broad investigative and enforcement powers. The law has extraterritorial reach — applying to any organization processing personal data of individuals in Saudi Arabia, regardless of where the organization is headquartered.

United Arab Emirates — Federal PDPL + DIFC + ADGM

The UAE has the most complex data protection landscape in the GCC, with three overlapping frameworks. Federal Decree-Law No. 45 of 2021 establishes the baseline for the entire country, administered by the UAE Data Office. However, the DIFC (Dubai International Financial Centre) and ADGM (Abu Dhabi Global Market) maintain their own independent data protection regulations with separate enforcement authorities. Businesses in free zones must comply with both the zone-specific regulation and the federal law.

Bahrain — Personal Data Protection Law (PDPL 2019)

Bahrain's Personal Data Protection Law (Law No. 30 of 2018, effective 2019) is one of the earlier GCC privacy laws. It is enforced by the Personal Data Protection Authority under the Ministry of Industry and Commerce. The law requires that all data processing activities be registered with the authority, and mandates consent for data collection with specific exceptions for contractual necessity, legal obligations, and vital interests.

Qatar — Law No. 13 of 2016 on Personal Data Privacy

Qatar's personal data privacy law has been in effect since 2017 and is enforced by the Compliance and Data Protection Department within the Ministry of Transport and Communications. The law applies to all processing of personal data within Qatar and by Qatari entities abroad. It requires that data collection have a legitimate purpose, that data subjects be informed of the purpose, and that personal data not be retained beyond the period necessary for the stated purpose.

Oman — Personal Data Protection Law (Royal Decree 6/2022)

Oman's Personal Data Protection Law, issued by Royal Decree 6/2022, closely mirrors Saudi Arabia's PDPL in scope and requirements. The law is enforced by the Ministry of Transport, Communications and Information Technology, and applies to all processing of personal data within Oman and by Omani entities abroad. It establishes comprehensive requirements for consent, data subject rights, breach notification, and cross-border transfers.

Kuwait — Emerging Framework

Kuwait remains the only GCC nation without a comprehensive data protection law as of 2026, though sector-specific regulations exist for banking (Central Bank of Kuwait data protection circulars), telecommunications (CITRA regulations), and healthcare. A draft comprehensive data protection law has been under discussion in the National Assembly, but has not yet been enacted.

Pan-GCC Compliance Strategy

For businesses operating across multiple GCC countries, maintaining separate compliance programs for each jurisdiction is impractical and expensive. The most efficient approach is to implement the strictest regional standard — Saudi PDPL — as your baseline, then layer on jurisdiction-specific requirements where they differ. This works because PDPL's requirements are a superset of what most other GCC frameworks require.