GCC Data Protection & Privacy Laws
A plain-English guide to the data protection laws across the UAE, Saudi Arabia, Qatar, Bahrain, Oman and Kuwait — what each one requires from websites, who it applies to, and what the penalties are.
Every business that collects personal data through its website — names, emails, phone numbers, payment details, even analytics and cookies — falls under one or more data protection laws. Across the GCC, six countries now have their own frameworks, and they are not identical. This guide summarises each in plain English so you can understand what your website actually has to do.
The short version: if you serve customers in the Gulf, your site needs a clear privacy policy, a lawful basis for collecting data, a way for people to request or delete their data, cookie consent where required, and secure handling of everything you store. The country sections below explain the specifics.
Data Protection Laws Across the GCC
The main national framework in each country, who it covers, and what it means for your website.
United Arab Emirates
Law: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), in force since January 2022. The financial free zones have their own regimes: DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021.
For your website: a clear privacy notice, a lawful basis for processing, consent for marketing, data-subject rights (access, correction, deletion), and breach notification. The DIFC and ADGM laws are closely aligned with the EU GDPR and apply if you are registered in those free zones.
Saudi Arabia
Law: Personal Data Protection Law (PDPL), Royal Decree M/19 of 2021, amended in 2023, with enforcement from September 2024. Regulated by SDAIA (the Saudi Data and AI Authority).
For your website: one of the stricter GCC regimes. Requires a lawful basis, an Arabic-friendly privacy policy, data-subject rights, records of processing, and rules on cross-border data transfer. Some organisations must register and may need a data protection officer.
Qatar
Law: Law No. 13 of 2016 concerning Personal Data Privacy Protection — the first comprehensive data protection law in the GCC. The QFC (Qatar Financial Centre) has its own separate data protection regulations.
For your website: transparency about what you collect and why, consent for direct marketing, and special care for data described as of a special nature (health, ethnicity, children and similar categories).
Bahrain
Law: Personal Data Protection Law, Law No. 30 of 2018, in force since 2019. One of the earliest GDPR-style laws in the region.
For your website: a lawful basis for processing, notice to individuals, data-subject rights, and restrictions on transferring data outside Bahrain without adequate safeguards. Certain processing may require prior authorisation.
Oman
Law: Personal Data Protection Law, Royal Decree No. 6 of 2022, in force since February 2023.
For your website: explicit consent for processing in many cases, a clear privacy policy, data-subject rights, and rules on cross-border transfers. Penalties apply for processing without a lawful basis.
Kuwait
Law: Kuwait does not yet have a single comprehensive data protection law. The main instrument is the CITRA Data Privacy Protection Regulation (2021), which sets data privacy rules for telecom and online services.
For your website: follow the CITRA principles — transparency, consent, data minimisation and security — and treat GDPR-style best practice as the safe baseline until broader legislation arrives.
Summary only, current to 2026. Laws and regulations change — always confirm the current text with the official regulator or qualified legal counsel before relying on it. This page is general information, not legal advice.
What Every GCC Website Should Have
The common ground across all six frameworks — get these right and you are compliant with most of what they ask.
Clear privacy policy
A plain-language page explaining what you collect, why, how long you keep it and who you share it with. Arabic and English where your audience needs it.
Lawful basis & consent
A valid reason for every piece of data you collect, and explicit opt-in consent for marketing — no pre-ticked boxes.
Cookie consent
A cookie banner that lets visitors accept or reject non-essential cookies (analytics, ads) before they load.
Data-subject rights
A simple way for people to request, correct or delete their data — usually a contact route and an internal process to act on it.
Secure handling
HTTPS everywhere, encrypted storage of sensitive data, restricted access, and a plan for breach notification.
Cross-border awareness
Know where your data is hosted. Several GCC laws restrict transferring personal data abroad without safeguards.