Saudi and UAE privacy enforcement tracker 2026: every published decision

Privacy enforcement in the Gulf is real, and it is documented. SDAIA confirmed 48 PDPL enforcement decisions in its January 2026 announcement. In Dubai's financial free zone, the DIFC Commissioner of Data Protection publishes decision notices, and one of them, in 2024, set out what was wrong with Careem's cookie banner.

This tracker lists each action with a date and a public source you can open. We add a row only when a regulator's own document or two independent law-firm summaries confirm it. Where a regulator has published nothing we could find, we leave it out rather than guess.

The tracker

Six dated entries: two for Saudi Arabia (SDAIA) and four DIFC decision notices. Fines are in the regulator's currency.

The cookie banner case: what the DIFC asked of Careem

The 2024 directions to the Careem group are the clearest public statement by a Gulf regulator of what a cookie banner must show. Under DIFC Regulation 9.2.3 the Commissioner found the banner lacked three things.

• A clear, colour-neutral choice: buttons that neither push the visitor to accept nor discourage refusing.
• Plain-language text explaining the preference settings and how to change them.
• An easy way to change preferences later, such as a preferences link or dashboard.

The same decision notes that visitors could not open or change their cookie settings on the website or the app at all. Any business that sells to people in the DIFC can read it as a checklist.

The full rules, fines and what they mean for a website: DIFC data protection guide.

Saudi Arabia: what we know about the 48 decisions

SDAIA has not published the decisions one by one. What is public comes from its January 2026 announcement, as summarised by law firms: the count, the categories of violation and the penalty framework.

• 48 enforcement decisions, confirmed in the January 2026 announcement.
• Violation categories named include marketing sent without consent.
• Administrative fines up to SAR 5 million, doubling to SAR 10 million for repeat violations.
• Once notified of an alleged violation, an organisation has five days to respond.

Two summaries of the announcement describe its time period differently, so we give the count without a period.

Penalty tiers and how SDAIA enforces: PDPL penalties and enforcement guide.

The rest of the UAE

We found no published enforcement decisions under the UAE federal data protection law (Decree-Law 45 of 2021) or from the ADGM Office of Data Protection. That is a statement about what is public, not about what has happened. ADGM can fine up to USD 28 million under its 2021 regulations.

How the three UAE regimes differ: ADGM data protection guide.

How we build this tracker

Each DIFC row comes from the Commissioner's own decision notice on difc.com. The Saudi rows come from law-firm summaries of SDAIA's announcement, because SDAIA's page was not reachable when we checked. We do not include news reports without a primary document, and we update the table when a regulator publishes something new. You can download the table as a CSV and quote it with a link.

Sources