Saudi Arabia’s primary legislation governing personal data is the Personal Data Protection Law (PDPL). This law officially took effect on September 14, 2023, with a one-year grace period granted to organizations for full compliance, ending on September 14, 2024.

The PDPL outlines comprehensive rules for how personal data must be collected, used, stored, and shared. It emphasizes principles such as:

• Purpose limitation – data must be collected for specific, legitimate reasons.
• Data minimization – only the necessary amount of data should be processed.
• Transparency – individuals must be informed about how their data is handled.

Under the PDPL, individuals—referred to as data subjects—are granted rights including access to their data, correction of inaccuracies, and the ability to withdraw consent.

The law applies to any entity processing personal data within Saudi Arabia, as well as foreign organizations handling data of individuals residing in the Kingdom, regardless of where the processing occurs.

Oversight and enforcement of the PDPL are managed by the Saudi Data and Artificial Intelligence Authority (SDAIA). SDAIA is responsible for issuing regulations, monitoring compliance, and may impose penalties for violations. In some cases, enforcement may also involve the National Data Management Office (NDMO) and the Public Prosecution Office, particularly for serious breaches involving sensitive data.

The United Arab Emirates enforces personal data protection through the Federal Decree-Law No. 45 of 2021, commonly referred to as the UAE Personal Data Protection Law (PDPL). This legislation came into force on January 2, 2022, and establishes a unified framework for safeguarding personal data across the country.

The PDPL applies broadly to any organization—whether based in the UAE or abroad—that processes the personal data of individuals located within the UAE. It sets out clear obligations for data controllers and processors, including:

• Obtaining valid consent before collecting or using personal data, except in specific cases such as public interest or legal obligations.
• Ensuring data accuracy, allowing individuals to request corrections or restrict processing.
• Implementing security measures to protect data from unauthorized access or breaches.
• Regulating cross-border data transfers, requiring adequate protection standards in recipient countries.

The law grants individuals several rights, including access to their data, the ability to correct inaccuracies, and the right to object to certain types of processing, such as automated decision-making.

Oversight of the PDPL is managed by the UAE Data Office, a federal authority responsible for issuing guidance, handling complaints, and monitoring compliance. Enforcement is expected to begin six months after the publication of the law’s executive regulations, which will detail specific implementation requirements.

Oman has established a comprehensive legal framework for personal data protection through its Personal Data Protection Law, enacted by Royal Decree No. 6/2022. This law came into force on February 13, 2023, and organizations are expected to be fully compliant by February 5, 2025, following the release of detailed executive regulations.

The law applies to any entity that processes personal data within Oman, as well as foreign organizations that handle data belonging to individuals residing in the country. It defines personal data broadly, covering any information that can identify a person directly or indirectly.

Core Principles

• Consent First: Organizations must obtain clear and written consent from individuals before collecting or using their personal data, except in cases involving legal obligations or public interest.
• Sensitive Data Controls: Processing sensitive data—such as health, religious beliefs, or biometric information—requires special authorization from the Ministry of Transport, Communications, and Information Technology (MTCIT).
• Individual Rights: People have the right to:
  • Access their personal data
  • Request corrections or deletions
  • Withdraw consent at any time
  • Transfer their data to another provider
  • Be informed of any data breaches

Compliance Requirements

• Data Protection Officer: Organizations must appoint a DPO to oversee data handling practices.
• Security Measures: Adequate safeguards must be in place to prevent unauthorized access or misuse of data.
• Breach Notification: If a data breach occurs, it must be reported to both the MTCIT and affected individuals within 72 hours.
• International Transfers: Data can only be transferred outside Oman if the receiving country ensures a comparable level of protection and the individual has consented.

Enforcement

The MTCIT is responsible for monitoring compliance and enforcing the law. It has the authority to investigate violations and impose fines, which can range from modest penalties for procedural issues to substantial fines for serious breaches involving sensitive data

Lebanon’s legal framework for personal data protection is established under Law No. 81 of 2018, titled the Law on Electronic Transactions and Personal Data. This legislation was passed on October 10, 2018, published in the official gazette on December 31, 2018, and became effective on March 31, 2019.

Scope and Applicability

The law applies to all entities processing personal data within Lebanon, including both public and private organizations. It also extends to foreign companies that handle the personal data of Lebanese residents, provided they operate within Lebanon or use Lebanese data infrastructure.

Key Principles

• Lawful Processing: Data must be collected and used based on consent or a legitimate legal basis.
• Purpose Limitation: Personal data should only be processed for specific, clearly defined purposes.
• Data Minimization and Accuracy: Only relevant data should be collected, and it must be kept accurate and up to date.
• Security Measures: Organizations are required to implement safeguards to protect data from unauthorized access or breaches.

Rights of Individuals

Lebanese residents have several rights under the law, including:

• Access: The right to view and obtain copies of their personal data.
• Correction and Erasure: The right to request updates or deletion of inaccurate or outdated data.
• Objection: The ability to refuse processing for direct marketing or automated decision-making.
• Portability: The right to receive their data in a structured format and transfer it to another provider.
• Restriction: The right to limit how their data is processed in certain circumstances.

Compliance Requirements

• Data Protection Officer (DPO): While the law references DPOs, it does not explicitly require organizations to appoint one.
• Impact Assessments: Required for high-risk data processing activities.
• Cross-Border Transfers: Permitted only when adequate protection is ensured or with explicit consent from the data subject.

Enforcement

The Ministry of Economy and Trade is responsible for overseeing compliance. Penalties for violations include:

• Fines ranging from 1 million to 30 million Lebanese pounds (approximately $665 to $20,000 USD).
• Suspension of data processing activities.
• In severe cases, criminal penalties, including imprisonment, may apply.

Bahrain’s approach to personal data protection is governed by Law No. 30 of 2018, known as the Personal Data Protection Law (PDPL). This law came into force on August 1, 2019, and establishes a national framework for safeguarding personal information in both public and private sectors. [Data prote…the World]

Who Must Comply

The PDPL applies to:

• Individuals and organizations based in Bahrain.
• Entities outside Bahrain that use tools or infrastructure located within the country to process personal data, unless the data is merely transiting through Bahrain.

What Is Protected

The law defines personal data as any information that can identify a person directly or indirectly—such as names, ID numbers, contact details, biometric data, and financial records. It also recognizes sensitive personal data, which includes health information, religious beliefs, political opinions, and criminal records.

Key Principles

• Lawful and Fair Processing: Data must be collected for clear, legitimate purposes and handled transparently.
• Consent-Based Use: Individuals must give consent unless processing is required for legal obligations, contracts, or vital interests.
• Data Minimization: Only relevant and necessary data should be collected.
• Security Measures: Organizations must implement safeguards to prevent unauthorized access, loss, or misuse of data.

Rights of Individuals

Under the PDPL, individuals have the right to:

• Access their personal data and understand how it is used.
• Correct or delete inaccurate or outdated data.
• Object to certain types of processing, including direct marketing or automated decision-making.
• Withdraw consent at any time.
• Request data encryption or anonymization to protect their identity.

Organizational Duties

• Notification: Data controllers must notify the Personal Data Protection Authority before conducting certain types of data processing.
• Registration: Public data registers must be limited to what is necessary and aligned with their intended purpose.
• Privacy Notices: Clear information must be provided to individuals about how their data is used.
  Appointment of Data Protection Guardians: Required in some cases to oversee compliance.

Enforcement

The Personal Data Protection Authority (PDPA) oversees compliance and has the power to:

• Issue fines up to BHD 20,000 (approx. $53,000 USD) for violations.
• Impose daily penalties for ongoing breaches.
• Revoke authorizations for processing sensitive data.
• Publicly disclose violations to deter non-compliance.

Iran is in the process of formalising its data protection regime through a proposed Data Protection Bill, often referred to as the Iranian GDPR. While not yet enacted, the bill represents a significant step forward.

Historically, Iran relied on sector-specific laws and constitutional principles, such as Principle 25 (privacy of correspondence) and Principle 22 (protection of dignity and property).

The proposed bill includes GDPR-like provisions, explicit consent, data subject rights (access, correction, deletion), security obligations, and the establishment of a supervisory authority. It also mandates breach notifications and transparency in data processing.

Comparison with GDPR

The Iranian bill mirrors GDPR in its rights-based approach and regulatory oversight. However, it is shaped by Islamic legal principles and local cultural norms, which may influence enforcement and interpretation. Unlike GDPR’s extraterritorial scope, Iran’s bill focuses on domestic data processing. Sanctions under Iranian law are expected to be less severe than GDPR’s, and enforcement mechanisms are still developing.

Iraq’s Personal Data Protection Law, enacted in 2021, marks a significant step toward modernising its legal framework for privacy. The law is overseen by the proposed Iraqi National Data Protection Authority (INDPA). It defines personal data broadly and grants individuals rights to access, correct, delete, and object to processing. Organizations must obtain explicit consent, maintain processing records, and implement security safeguards. Cross-border transfers are allowed only if the recipient country ensures adequate protection.

Comparison with GDPR

Iraq’s law mirrors GDPR in its emphasis on consent, transparency, and individual rights. However, enforcement mechanisms are still developing, and penalties are less severe. Unlike GDPR’s extraterritorial scope, Iraq’s law is primarily domestic. The GDPR’s data subject rights (e.g., portability, automated decision-making) are more extensive. Iraq’s framework is evolving and aims to align with global standards.

Israel’s Privacy Protection Law (IPPL) was significantly amended in 2024 via Amendment No. 13, effective August 15, 2025. The law is enforced by the Privacy Protection Authority (PPA). Key updates include expanded definitions of personal and sensitive data, mandatory appointment of Privacy Protection Officers, and stricter breach notification rules. Fines can reach 5% of annual turnover for large organizations. The law applies to any entity processing data on Israeli residents, regardless of location.

Comparison with GDPR

The IPPL now closely resembles GDPR, especially in its definitions, roles (controller/processor), and enforcement powers. Israel retains some unique features, such as mandatory database registration and sector-specific exemptions. GDPR’s broader scope and harmonised EU enforcement still set a higher bar, but Israel’s reforms position it as a global privacy leader.

Jordan enacted its Personal Data Protection Law No. 24 of 2023, published on September 17, 2023, and effective from March 17, 2024.

It is overseen by the Ministry of Digital Economy and Entrepreneurship. The law mandates explicit, documented consent, defines sensitive data, and criminalises unauthorised processing. It includes exceptions for public interest, health, and national security. Cross-border transfers require prior consent and assurance of adequate protection.

Comparison with GDPR

Jordan’s law aligns with GDPR in consent, data subject rights, and processing principles. However, enforcement is less mature, and the supervisory structure lacks full independence. GDPR’s broader rights (e.g., portability, profiling objections) and stronger penalties make it more robust. Jordan’s law is a strong regional step toward GDPR-style regulation.

Kuwait does not currently have a single, comprehensive data protection law that applies universally across all sectors. Instead, its legal framework is built on a combination of laws and regulations that address privacy and data handling in specific contexts.

Key Legal Instruments

1. Electronic Transactions Law (Law No. 20 of 2014)
   This law governs the use of electronic records and signatures in civil, commercial, and administrative transactions. It requires entities to obtain consent before collecting or processing personal data and mandates safeguards to protect data from unauthorized access or loss.
2. Cybercrime Law (Law No. 63 of 2015)
   This law imposes criminal penalties for unauthorized access, tampering, or misuse of personal or governmental data. Penalties range from fines to imprisonment, depending on the severity of the breach.
3. Data Privacy Protection Regulation (Decision No. 26 of 2024)
   Enforced from January 1, 2025, this regulation—issued by the Communications and Information Technology Regulatory Authority (CITRA)—applies specifically to telecommunications and IT service providers licensed in Kuwait. It sets out detailed obligations for data collection, processing, storage, and breach notification.

Scope and Applicability

The Data Privacy Protection Regulation applies to:

• Licensed telecom and IT service providers
• Website operators, app developers, and cloud service providers
• Entities processing personal data within Kuwait or using Kuwaiti infrastructure

It does not apply to:

• Individuals processing personal or family data
• Government authorities handling data for national security or law enforcement purposes

Core Requirements

• Consent: Organizations must obtain clear, informed consent before collecting or using personal data.
• Transparency: Privacy notices must be accessible and explain how data is used.
• Security: Adequate measures must be in place to protect data from breaches.
• Data Subject Rights:
  • Access, correction, and deletion of personal data
  • Withdrawal of consent
  • Objection to certain types of processing
• Breach Notification: Incidents must be reported to CITRA and affected individuals within 72 hours.
• Cross-Border Transfers: Permitted only with appropriate safeguards.
• Parental Consent: Required for processing children’s data.

Enforcement

CITRA is the primary authority responsible for enforcing compliance. It has the power to:

• Investigate complaints
• Impose fines and sanctions
• Suspend services for non-compliance

Penalties under related laws can include fines up to KWD 20,000 and imprisonment for up to 10 years, depending on the nature of the violation

Qatar’s Personal Data Privacy Protection Law (PDPPL), enacted as Law No. 13 of 2016, was the first comprehensive data protection law in the GCC. It applies to personal data processed electronically or through combined electronic and traditional methods. The law is regulated by the Compliance and Data Protection Department (CDPD) under the Ministry of Communications and Information Technology (MCIT), with enforcement support from the National Cyber Security Agency (NCSA).

The PDPPL mandates explicit consent for data processing, data minimization, and security safeguards. Organizations must notify authorities of data breaches and ensure third-party processors comply with the law. The law also includes sector-specific provisions, such as those for telecoms, banking, and statistics, and is supplemented by guidelines issued in 2021 to clarify obligations.

Qatar’s Qatar Financial Centre (QFC) operates under a separate regime — the QFC Data Protection Regulations 2021 — which are more aligned with international standards and overseen by the QFC Data Protection Office.

Comparison with GDPR

While the PDPPL shares foundational principles with the GDPR — such as consent, transparency, and accountability — there are notable differences. The territorial scope of PDPPL is narrower, focusing on data processed within Qatar, whereas GDPR applies extraterritorially. PDPPL is influenced by Islamic legal principles, emphasizing dignity and cultural values, while GDPR is rooted in a rights-based European framework. GDPR provides broader data subject rights (e.g., portability, automated decision-making objections), whereas PDPPL is more limited in scope. Enforcement under GDPR is more mature, with established supervisory authorities and significant fines, while Qatar’s enforcement is still evolving.

Syria’s Electronic Personal Data Protection Law (Law No. 12 of 2024) came into effect on January 1, 2025. It regulates data collection, processing, and transfer, with penalties up to 12 million SYP and 3 years imprisonment.

The law requires explicit consent, mandates licensing for controllers/processors, and restricts sensitive data processing. Cross-border transfers need prior approval and adequate safeguards. A Data Protection Authority is proposed but not yet operational.

Comparison with GDPR

Syria’s law adopts GDPR like principles but is constrained by vague provisions and mandatory data retention. Enforcement is limited, and rights like portability or automated decision-making objections are absent. The law is a foundational step but lacks GDPR’s depth and independence.

Yemen currently lacks a comprehensive data protection law. Privacy is addressed through the Constitution (Article 52), Penal Code, and sector-specific rules (telecom, healthcare).

There is no Data Protection Authority, and enforcement is weak due to political instability. Surveillance concerns persist, and digital privacy protections are minimal. The Electronic Transactions Law (2010) offers limited coverage for digital contracts and signatures.

Comparison to GDPR

Yemen’s framework is fragmented and lacks GDPR’s structure, rights, and enforcement. There are no formal data subject rights, breach notification rules, or cross-border transfer regulations. Yemen may align with GDPR in the future, but current conditions hinder progress.