GDPR Compliance Guide
The complete guide to EU General Data Protection Regulation compliance for MENA businesses selling to European customers.
May 2018
Enforcement Date
€20M
Or 4% Revenue
EU/EEA
Jurisdiction
For companies in the UAE and the Gulf
Does GDPR apply to a company in the UAE?
Yes, if it sells to people in the EU or monitors their behaviour online. Article 3(2) of the GDPR covers companies outside the EU that offer goods or services to people in the EU, or monitor their behaviour there, and analytics or advertising cookies on EU visitors count as monitoring. Such a company usually needs an EU representative (Article 27) and, for those visitors, consent before non-essential cookies run.
GDPR applies next to the UAE's own rules, not instead of them: the federal law (Decree-Law No. 45 of 2021) for most companies, and the DIFC and ADGM laws for companies in those free zones, both close to GDPR. The UAE has no EU adequacy decision, so personal data sent from the EU to the UAE needs a transfer tool such as standard contractual clauses. One consent banner can apply each visitor's own rule.
Arqam360 in the UAE: plans and prices in AEDUAE data protection law guideDIFC data protection law guideGDPR, Articles 3 and 27 (EUR-Lex)EDPB Guidelines 3/2018 on territorial scopeOverview
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, in force since May 25, 2018.
It applies to any organization worldwide that processes personal data of individuals in the EU and European Economic Area (EEA), making it directly relevant to MENA businesses with European customers. GDPR establishes strict requirements for data collection, processing, storage, and transfer, with a strong emphasis on individual rights and organizational accountability.
For MENA e-commerce businesses, GDPR compliance is critical because it applies to anyone selling products or services to EU residents, regardless of where the business is based. The regulation defines personal data broadly, encompassing any information relating to an identified or identifiable person — including names, email addresses, IP addresses, cookie identifiers, and device fingerprints.
GDPR requires a lawful basis for processing (consent, contract, legitimate interest, legal obligation, vital interest, or public interest), with consent needing to be freely given, specific, informed, and unambiguous. Data subjects have extensive rights: access, rectification, erasure (right to be forgotten), restriction, portability, and objection.
Organizations must implement data protection by design and default, maintain records of processing activities, conduct impact assessments for high-risk processing, and appoint Data Protection Officers where required. Cross-border data transfers to non-adequate countries require Standard Contractual Clauses, Binding Corporate Rules, or other approved mechanisms.
GDPR mandates breach notification to supervisory authorities within 72 hours. Penalties are substantial: up to EUR 20,000,000 or 4% of global annual turnover, whichever is higher.
Google Consent Mode v2 is required for EEA ad campaigns since March 2024, making proper consent management essential for MENA businesses running Google Ads targeting European audiences.
Key Requirements
- 01
Lawful Basis for Processing
Establish a valid lawful basis before processing personal data. Consent must be freely given, specific, informed, and unambiguous.
- 02
Data Subject Rights
Implement mechanisms for access, rectification, erasure, restriction, portability, and objection to automated processing.
- 03
Data Protection by Design
Integrate data protection measures into all processing activities from the design stage, with data minimization as a default.
- 04
Breach Notification
Notify the relevant supervisory authority within 72 hours of a personal data breach. Notify affected individuals if high risk.
- 05
International Transfers
Ensure adequate protections for cross-border data transfers using SCCs, BCRs, or adequacy decisions.
- 06
Records of Processing
Maintain comprehensive records of all data processing activities including purposes, categories, recipients, and retention periods.
How Arqam360 Helps
- 01
GDPR-Compliant Consent Banner
Full Google Consent Mode v2. Fires all four GCM signals automatically, denied by default, with geo-aware legal text for EU visitors.
- 02
Server-Side Event Forwarding
Forward consent-aware events to Google, Meta, TikTok, and 7 more platforms. Every event carries consent state for GDPR compliance.
- 03
DSAR Automation
Handle data subject requests within GDPR's 30-day deadline. Automated data retrieval and compliant response generation.
- 04
Cross-Border Ready
Auto-regime detection serves GDPR consent to EU visitors and PDPL consent to Saudi visitors. One widget handles all regulations.
Check your GDPR compliance
Run a free scan to identify GDPR compliance gaps on your website.
Done for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
GDPR FAQ for MENA Businesses
Common questions about GDPR compliance for businesses based in the Middle East.
Yes, if you sell products or services to EU residents, or monitor their behavior. GDPR applies regardless of where your business is located.
Get GDPR Compliant Today
Start your free trial and serve GDPR-compliant consent to your European visitors in minutes.