Saudi PDPL Requirements, UAE, Qatar and Bahrain: What Your Systems Must Do
Saudi PDPL requirements next to the UAE, DIFC, ADGM, Qatar and Bahrain rules: breach clocks, request deadlines, transfer lists and what systems must do.
Luka Abramovic21 min read
Bahrain's Personal Data Protection Law (PDPL) gives you 15 working days to answer an access request and 10 working days to correct or erase data. Saudi Arabia's PDPL allows 30 days, extendable by up to 30 more. A request queue built around the Saudi PDPL requirements, with one 30-day timer, lets a Manama erasure request run about two weeks past its legal deadline before anyone is warned. Transfer rules split the same way: the United States is on Bahrain's list of countries with adequate protection, while the list in the DIFC's 2023 Regulations names California, not the United States.
This list covers what each data protection regime in Saudi Arabia, the UAE (federal law, DIFC and ADGM), Qatar and Bahrain requires your systems to do, checked in September 2026. Each row cites its article, and where we could not confirm a point in the regulator's own text, the section says so. It is a practical summary, not legal advice. The governing texts are the regulators' own, starting with SDAIA's laws and regulations page.
Which law applies to which system
A group with offices in Riyadh, Dubai and Manama can have three or four regimes over one CRM. The regime follows the legal entity and where processing happens, and the Saudi and UAE federal laws also reach businesses abroad that process their residents' data.
| If the processing is by | The regime | Regulator |
|---|---|---|
| Anyone processing personal data in Saudi Arabia, or the data of people residing there from abroad (PDPL Article 2) | Personal Data Protection Law (Royal Decree M/19, amended by M/148 in 2023), its Implementing Regulation and its Transfer Regulation | Saudi Data and AI Authority (SDAIA), texts |
| A company in the UAE outside free zones with their own data protection law, or one abroad processing data of people in the UAE | Federal Decree-Law No. 45 of 2021 (PDPL), with sector exclusions (Article 2) | UAE Data Office, text |
| A company incorporated in the DIFC, wherever it processes, or anyone processing in the DIFC as part of stable arrangements (Article 6) | DIFC Data Protection Law No. 5 of 2020 (consolidated July 2025) and the Data Protection Regulations | DIFC Commissioner of Data Protection, legal database |
| A company established in ADGM | ADGM Data Protection Regulations 2021 | ADGM Commissioner of Data Protection, guidance |
| A business processing personal data in Qatar | Law No. (13) of 2016 on Personal Data Privacy Protection (PDPPL) | National Cyber Security Agency (NCSA), English text |
| A business with a place of business in Bahrain, or one abroad using means situated in Bahrain (Article 2) | Law No. (30) of 2018 (PDPL) and its implementing Orders of 2022 | Personal Data Protection Authority, texts |
This week: list every system holding customer or staff data, the entity that owns it and its regime. A system serving entities in two rows runs the stricter clock from each table.
Breach and request clocks
| Regime | Breach: to whom and when | Data subject requests | What the system must support |
|---|---|---|---|
| Saudi Arabia | SDAIA within 72 hours of becoming aware, if the breach could cause harm; missing details can follow with a justification. Individuals without undue delay if it could harm them (Implementing Regulation Article 24) | 30 days, extendable by up to 30 more for disproportionate effort or multiple requests, if the requester is told in advance with reasons. Every request is recorded, including oral ones (Article 3) | A breach log stamped with the time you became aware. A tracker that logs phone and walk-in requests, with a 30-day timer and an extension that needs a reason and a notice date |
| UAE federal | The Data Office on becoming aware, "within the period" the executive regulations will set (Article 9). Individuals too | No deadline in the Decree-Law | The same log and tracker on a 72-hour and 30-day default until the regulations fix the numbers (our judgment) |
| DIFC | The Commissioner "as soon as practicable in the circumstances" (Law Article 41), by email to commissioner@dp.difc.ae or the DIFC web form (Regulation 8.1) | One month, extendable by two for complex or numerous requests, with notice within the first month. If you ask for identity evidence, the month starts when it arrives (Article 33(1), (7) and (12)) | Two request channels, one free on your website with no account needed (Article 40). A timer that restarts when identity evidence arrives. A register of extensions and refusals with reasons (Article 33(9)) |
| ADGM | The Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights. A later notice gives reasons (section 32) | Not confirmed for this edition | A 72-hour breach timer, with requests on our 30-day default until you confirm the deadline |
| Qatar | NCSA within 72 hours of becoming aware, under NCSA's breach notification guideline | Not confirmed for this edition | The same 72-hour timer, with requests on our 30-day default |
| Bahrain | The Authority within 72 hours of discovery, unless the breach would not affect data subjects' rights. A late notice carries justifications (Order No. 43 of 2022, Article 4) | Access: 15 working days (Law Article 18). Rectify, block or erase: 10 working days, then tell recipients within 15 days (Article 23). Direct marketing objection: 10 working days (Article 20) | Working-day timers per request type, a recipients list per record, a channel for people to report breaches to you (Order No. 43, Article 4(1)), and a log of every breach, reported or not |
Two more clocks: when data comes from a third party, Saudi Arabia gives you 30 days to tell the person (Implementing Regulation Article 4) and Bahrain five days from when you start recording it (Law Article 17), unless an exception applies. A lead list imported into a CRM starts both.
This week: check whether your request tracker's due date differs by regime. If it is one number for everyone, set it per regime, starting with Bahrain.
Registration, officers and transfers
| Regime | Register or notify the regulator | Data protection officer | Transfers out |
|---|---|---|---|
| Saudi Arabia | Register on SDAIA's National Data Governance Platform if you are a public entity, process sensitive data, or processing personal data is your main activity. The certificate lasts up to five years (Register Rules, Articles 2 and 10) | Required for public entities providing large-scale services, or if your core activity needs regular and systematic monitoring of people or is based on sensitive data (Implementing Regulation Article 32) | To countries on SDAIA's published adequacy list, reviewed every four years. Otherwise, in the cases the Transfer Regulation (August 2024) lists, standard contractual clauses, binding common rules or an accreditation certificate, plus a risk assessment (Articles 3, 4 and 7) |
| UAE federal | No registration. Notify the Data Office of your DPO's contact details (Article 10) | Required for high-risk processing due to new technology or volume, systematic assessment of sensitive data including profiling, or large volumes of sensitive data. The DPO may be outside the UAE | To countries the Data Office approves as adequate (Article 22). Otherwise a contract binding the recipient to the PDPL's standards, explicit consent, or another Article 23 ground |
| DIFC | Notify the Commissioner within 30 days of starting processing, renew every anniversary, and update within 30 days of a change (Regulation 3.2) | Required for DIFC bodies, for high-risk processing on a systematic or regular basis, and when the Commissioner requires one. Must reside in the UAE unless a group employee in an international role (Article 16). Files an annual assessment (Article 19) | To the jurisdictions in Appendix 3 of the Regulations (2023 version): ADGM, the United Kingdom, California and the EU and EEA countries among them, but not the UAE mainland, Saudi Arabia or the United States as a whole. Otherwise an Article 27 route, such as binding corporate rules or the Commissioner's standard contractual clauses (Regulation 5) |
| Bahrain | Notify the Authority before any wholly or partly automated processing, unless exempt (employee data, or a data protection guardian appointed), and report changes within 30 days. Prior written authorization for biometric identity checks, genetic data, linking two controllers' files, CCTV surveillance, and sensitive data processed without consent to protect someone who cannot consent (Law Articles 14 and 15) | A "data protection guardian" is optional unless the Authority's board requires one for your category. Notify the appointment within three working days. The guardian sends the Authority the updated processing register monthly (Article 10) | To the 83 countries and territories in Order No. 42 of 2022, including the United States, the United Kingdom, Saudi Arabia and the UAE, but not Qatar. Otherwise an Article 13 exception, such as consent, or the Authority's authorization. A contract-based request needs six set clauses (Order No. 42, Article 5) |
The lists split: a DIFC company sending HR records to its Riyadh office needs an Article 27 route, while its Manama sister company needs no approval.
This week: list each system's hosting country and every vendor that can read its data, then check each against the current list for each regime.
Automated decisions and AI systems
| Regime | What the rule requires | What the system must support |
|---|---|---|
| Saudi Arabia | Explicit consent for decisions based solely on automated processing (Implementing Regulation Article 11). Tell people such decisions will be made (Article 4). A written impact assessment where your activity includes them (Article 25) | A consent record per purpose with the time and means, a flag on each automated decision type, and the stored assessment |
| UAE federal | A right to object to automated decisions, including profiling, with legal or adverse effects, and a human review on request (Article 18) | A "request human review" path that routes the case to a named reviewer and records the outcome |
| DIFC | A right to object to solely automated decisions with legal or similarly serious effects and have them reviewed manually (Article 38). Regulation 10 adds notice at first use of an AI system, a register of its use cases, and evidence of the rules that make it ask a human when processing may be unfair or discriminatory | The first-use notice, a register you can produce on request, and logged escalations to a person |
| Bahrain | Solely automated decisions assessing work performance, financial standing, creditworthiness, reliability or conduct must be reconsidered, free and not solely by machine, on request, unless part of a contract with safeguards such as hearing the person's view (Law Article 22). Tell people about the decision and offer an electronic objection procedure (Order No. 48 of 2022). An impact assessment is mandatory (Order No. 43 of 2022) | An objection form linked from the decision notice, a reconsideration queue and a record of each outcome |
DIFC Regulation 10 treats the business that benefits from an AI system (the "Deployer") as controller and the provider running it (the "Operator") as processor. It bars such systems from high-risk processing until the Commissioner sets audit and certification requirements, the system meets them and an Autonomous Systems Officer is appointed. Its guidance excludes systems without autonomy that humans control deterministically, so on our reading a fixed rules engine is outside and an AI assistant that chooses its own next step is inside. Check for versions after the September 2023 text.
This week: list every place your software decides something about a person without a human in the loop, such as credit limits or claim triage, and whether a person can ask for a human review today.
Saudi Arabia: PDPL requirements beyond the tables
The PDPL came into force on 14 September 2023, and its one-year grace period ended on 14 September 2024. Five provisions of the Implementing Regulation are easy to miss.
- Stop storing ID copies by default. Article 31 bars photographing or copying official identity documents unless a public authority requests it or a legal requirement applies, and copies are destroyed once their purpose ends. An onboarding form that collects a national ID or Iqama scan from everyone needs a legal basis for each copy.
- Destruction reaches backups. Article 8 requires destroying all copies, including backups, and telling the parties you disclosed the data to. If your backup tooling cannot remove one person's records, our default is a documented way to keep destroyed data out of any restore until that backup expires.
- Linking datasets triggers an impact assessment. Article 25 requires a written assessment for collecting, comparing or linking personal datasets from different sources, so a CRM and ERP integration that merges customer records can trigger it. It has eight minimum elements, and your processors get a copy.
- Records of processing outlive the processing. Keep the record while processing lasts and for five years after (Article 33), with retention periods per data category where possible and each transfer outside the Kingdom with its legal basis and recipients.
- Processor contracts need specific clauses. Under Article 17 the processor must commit to report breaches to you without undue delay, state whether other countries' regulations apply to it, and name its subcontractors. A new sub-processor needs your prior acceptance, with a window to object.
Consent must be documented so it can be verified later, with the time and means recorded and a separate consent for each purpose (Article 11), and withdrawing it must be at least as easy as giving it (Article 12). A single "I agree" checkbox fails both.
Penalties sit in the Law: a warning or a fine of up to SAR 5 million, which can be doubled for a repeat (Article 36). Disclosing or publishing sensitive data to harm someone or for personal benefit carries up to two years' imprisonment, a fine of up to SAR 3 million, or both (Article 35). The National Data Governance Platform has a Personal Data Breach Notification service for the 72-hour notice (Register Rules, Article 12). For Saudi e-invoicing on the same systems, see our list of ZATCA Phase 2 waves.
This week: ask the owner of customer onboarding which identity documents the system stores and why, and ask IT whether a deletion request reaches backups.
UAE federal PDPL: still waiting for its regulations
Federal Decree-Law No. 45 of 2021 came into force on 2 January 2022. Article 28 required executive regulations within six months to set the breach deadline, transfer controls and DPO criteria. As of September 2026 we found no Cabinet decision issuing them. The Chambers 2026 practice guide says they have yet to be issued, as DLA Piper's guide did in January 2025. Some compliance pages say they were issued in 2026, but the ones we found disagree on the instrument and date, and none cites a Cabinet decision. Check the UAE Legislation portal before relying on either view.
- The compliance deadline starts later. Article 29 gives six months from the regulations' issue date, extendable by six more. That is short for changing a live system, so build now.
- Treat quoted numbers with caution. Article 26 leaves penalties to a Cabinet decision, and we found none behind the federal fines some pages quote.
- Build what already has detail. Article 7 requires a special record of personal data, including who is authorized to access it, the erasure mechanism and cross-border movements. Article 9 lists what a breach report must contain, and the breach log in the last section covers it.
Check the Article 2 exclusions before scoping: government data, and health and banking or credit data regulated by their own legislation, fall outside the PDPL, so a clinic's patient system or a lender's credit file may follow sector law. For e-invoicing on the same systems, see our UAE e-invoicing timeline.
This week: ask system owners to export the user groups that can read each system's personal data. That export starts the Article 7 record.
DIFC: fees, records and AI training data
| Obligation | Detail | Source |
|---|---|---|
| Notification (registration) fee | USD 1,250 for DFSA-authorized firms, USD 750 for other non-retail firms, USD 250 for retail. Renewal USD 500, USD 250 or USD 100 a year | Regulations, Appendix 1 (2023 consolidation) |
| Records of processing | Electronic, linking consent records, contracts, data locations, impact assessments, breach records and retention policies. Not required below 50 employees unless you do high-risk processing | Regulations 2.1 and 2.2 |
| Retaining AI training data | Personal data in a dataset used to lawfully train or refine an AI system may be kept after the basis for processing ends, if that does not risk the person's rights, only after an impact assessment and only as far as necessary | Law Article 22(4)(c) and (5) |
| Erasure that is technically impossible | Not a violation if you collected the data from the person and told them explicitly, up front, that rectification or erasure would not be feasible | Law Articles 29(1)(h)(ix) and 33(4) |
| Maximum fines | Up to USD 100,000 per contravention of the rights articles, 33 to 38, including Article 38 on automated decisions, and USD 50,000 for failing to report a breach. General fines are not limited to these amounts | Law Article 62 and Schedule 2 |
| Private right of action | Anyone who suffers damage from a contravention, including distress, can claim compensation from the controller or processor in court, whether or not they also complain to the Commissioner | Law Article 64A (July 2025 consolidation) |
Sources: the DIFC Data Protection Law, consolidated July 2025, and the Regulations in the DIFC legal database. For AI models trained on customer data and append-only stores, the erasure row means saying so prominently in the privacy notice before collection, not after a request arrives.
This week: put three dates in the compliance calendar: the notification anniversary, the annual assessment deadline on the DIFC Client Portal, and a headcount check against the 50-employee threshold.
ADGM: the breach clock and what to confirm
ADGM's Data Protection Regulations 2021 are a separate regime. Beyond the 72-hour breach clock in the table above (section 32, on ADGM's breach notification page), one more point is confirmed for this edition:
- An Appropriate Policy Document for some sensitive data. Processing special categories under certain conditions, such as employment law obligations, requires a policy document on how you comply with the principles and your retention and erasure policy, kept until six months after that processing stops (section 7(3)). ADGM's template asks for a retention period per processing activity (ADGM guidance, version 1.0, August 2021).
We could not check ADGM's request deadline, DPO triggers, automated-decision rules or fines against the Regulations' text, so read those provisions before setting request timers. Our default meanwhile is 30 days.
Qatar: PDPPL and the National Data Policy
Qatar's regime is Law No. (13) of 2016 on Personal Data Privacy Protection, the PDPPL, which the National Planning Council's National Data Policy (October 2024) describes as overseen by the National Cyber Security Agency (NCSA). We could not open NCSA's documents for this edition, so the 72-hour breach clock in the table above and the fine tiers below rest on independent secondary summaries that agree. Confirm them in NCSA's texts, linked above.
- Two fine tiers: up to QAR 1 million for failures such as breach notification and direct marketing, and up to QAR 5 million for more serious ones, including those involving data of a "special nature" and children's data.
Still to confirm: the request deadline, when individuals must be told about a breach, and the rules for special-nature data (health, children and religious beliefs among them), transfers and direct marketing. A Qatar Financial Centre entity should ask the QFC Authority which rules apply.
Government and semi-government customers are also bound by the National Data Policy, whose section 3.11.2 requires classifying all data assets under the National Data Classification Policy (May 2023, version 3.0), applying labels with automated systems and publishing classification levels as metadata in a data catalog. Its one-year compliance period has run, so if you sell a system to a ministry, expect to be asked where its classification labels live.
Bahrain: notify first, then process
Bahrain's law is the most procedural in this list. Its implementing orders, issued in March 2022 by the Minister of Justice, Islamic Affairs and Waqf, fill in the detail.
- Prior notification is the default. After an Article 14 notice, the Authority has ten working days to ask for missing information, you have 15 days to supply it, and processing stops until the notification is complete.
- Some processing needs a yes first. The Article 15 list in the registration table needs prior written authorization, and other sensitive data needs consent unless an Article 5 exception applies, such as employment obligations. Silence for 30 days counts as rejection. A face-recognition door system is on the list, and so may be an integration linking your files with a partner company's.
- Servers in Bahrain can bring a foreign company in scope. Article 2 covers anyone processing data "by using means situated in the Kingdom", unless only for transit, and requires them to appoint a representative in Bahrain. If your hosting is in a cloud region in Bahrain, ask counsel whether this applies.
- Cookie walls do not produce valid consent. Under Order No. 48 of 2022, consent does not count if a cookie wall forces it before the visitor can use the website. Where consent is the basis, it must be explicit and in writing, which can be electronic (Order No. 48, Article 4, and Law Article 24).
- Security testing is named. Order No. 43 of 2022 lists periodic vulnerability assessment and penetration testing, privacy by design and a plan to keep processing running after a breach among the measures to apply according to risk.
Penalties: up to BHD 1,000 a day until a violation stops (BHD 2,000 for a repeat within three years) and an administrative penalty of up to BHD 20,000 (Article 55). Criminal offenses, including unauthorized transfers and processing without notification or authorization, carry up to one year's imprisonment, a fine of BHD 1,000 to BHD 20,000, or both, and both fine limits double for a company when the offense is committed in its name or for its benefit through its management's acts, omissions or gross negligence (Articles 58 and 59). Sources: the PDPL and Orders No. 42, No. 43 and No. 48 of 2022.
This week: open your website from a fresh browser. If it cannot be used until the visitor accepts cookies, that is a cookie wall under Order No. 48.
How to use this list this week
Three artifacts turn the tables into requirements for your request tracker, incident log and vendor register:
1. Put the clocks in configuration, not in someone's head
Store deadlines per regime so the tracker computes due dates. Values marked our_default are our judgment where the law sets no number or we could not confirm one.
# Request and breach clocks per regime, as of September 2026
saudi_pdpl:
breach_to_regulator: { within_hours: 72, clock_starts: became_aware }
rights_request: { within_days: 30, extend_once_by_days: 30,
extension_requires: [reason, advance_notice_to_requester] }
notice_when_data_comes_from_third_party: { within_days: 30 }
uae_federal_pdpl:
breach_to_regulator: { within: set_by_executive_regulations, our_default_hours: 72 }
rights_request: { within: not_set_in_law, our_default_days: 30 }
difc_dpl:
breach_to_regulator: { within: as_soon_as_practicable, our_default_hours: 72 }
rights_request: { within_months: 1, clock_starts: received_or_id_evidence_if_asked,
extend_by_months: 2, extension_notice_within_months: 1,
log_every_extension_or_refusal: true }
adgm_dpr_2021:
breach_to_regulator: { within_hours: 72, clock_starts: became_aware,
late_notice_requires: reasons }
rights_request: { within: confirm_from_regulations, our_default_days: 30 }
qatar_pdppl:
breach_to_regulator: { within_hours: 72, clock_starts: became_aware,
source: ncsa_breach_guideline }
rights_request: { within: confirm_from_ncsa_texts, our_default_days: 30 }
bahrain_pdpl:
breach_to_regulator: { within_hours: 72, clock_starts: discovered }
access_request: { within_working_days: 15 }
rectify_block_erase: { within_working_days: 10, tell_recipients_within_days: 15 }
direct_marketing_objection: { within_working_days: 10 }
notice_when_data_comes_from_third_party: { within_days: 5 }We count Saudi Arabia's "days" as calendar days, the conservative reading. Bahrain's working days need a calendar with its weekends and public holidays: 15 working days is about three calendar weeks, not a month.
2. A breach log that answers every regulator at once
One log with these fields covers every regime above. Fill it in for every incident, reported or not.
| Field | Required by |
|---|---|
| Time you became aware, and who logged it: every clock starts here | Saudi Implementing Regulation 24(1)(a); UAE Article 9; ADGM section 32; Bahrain Order 43, Article 4 |
| Nature of the breach, data categories, approximate number of people and records | Saudi 24(1)(b); DIFC Article 41(4); Bahrain Order 43; UAE Article 9 |
| Contact point for the regulator: the DPO or another named person | Saudi 24(1)(e); DIFC 41(4)(b); Bahrain Order 43, 4(4)(b); UAE 9(1)(b) |
| Likely consequences, which decide whether individuals must be told | Saudi 24(1)(c); DIFC 41(4)(c); Bahrain Order 43 |
| Measures taken, including the fix that prevents a recurrence | Saudi 24(1)(c); DIFC 41(4)(d); Bahrain Order 43, 4(4)(e) |
| Whether and when individuals were told, and how | Saudi 24(1)(d) and 24(5); DIFC Article 42 |
| Decision not to report, with reasons | DIFC 41(6); Bahrain Order 43, 4(2) |
| Reason for any late or phased information | Saudi 24(2); DIFC 41(5); ADGM section 32; Bahrain Order 43 |
| Copy of each report filed, and the evidence | Saudi 24(3); Bahrain Order 43, Article 5 |
3. A transfer register, with a worked example
For each system, record the destination, recipient, data categories, legal route per regime, the date you checked each list and, for Saudi Arabia, the risk assessment. An illustrative example: one CRM hosted by a US vendor outside California, used by entities in Manama, the DIFC, Riyadh and mainland Dubai.
| Entity in | Is the United States pre-approved? | Route |
|---|---|---|
| Bahrain | Yes, on the Order No. 42 list checked in September 2026 | No prior authorization. Record the list version you checked |
| DIFC | No. The 2023 list names California, not the United States | An Article 27 route, such as the Commissioner's standard contractual clauses, declared in your notification to the Commissioner (Regulation 3.1.1(c)) |
| Saudi Arabia | Only if the United States is on SDAIA's adequacy list when you check | Otherwise standard contractual clauses, binding common rules or an accreditation certificate in the cases the Transfer Regulation lists, with a risk assessment before the transfer (Article 7) |
| Mainland UAE | Only if the Data Office approves it as adequate | Until then, an Article 23 route such as a contract binding the vendor to the PDPL's standards |
These clauses live in the vendor's data processing terms. Our notes on terms to negotiate at signature include the data export clause to ask for in the same negotiation.
If you are building an internal AI system or customer data platform that must satisfy two or more of these regimes, bring the list of systems from the first section and one real request or incident from the last year. We would start by setting the per-regime clocks in your tracker, then mark every place an AI component makes a decision a person can ask to have reviewed. That review is the first step in our internal AI systems work.