Data protection in the Middle East and North Africa is no longer a patchwork of drafts. Egypt, Saudi Arabia, the UAE, Qatar and Bahrain each have a personal data law in force, and Kuwait regulates through a CITRA decision, an electronic transactions law and a cybercrime law. The rules differ on scope, consent, breach deadlines, transfers and penalties, so a business that operates across the region cannot copy one country's policy into another. From our Kuwait and Cairo offices, Hind Bin Al Sheikh & Partners compares the six regimes below by statute and article number, so that compliance teams can see where one program will serve several countries and where local work is unavoidable.
Six jurisdictions, six models
Saudi Arabia, the UAE, Qatar, Bahrain and Egypt each rely on a dedicated statute: the Personal Data Protection Law issued by Royal Decree No. M/19 and amended by Royal Decree No. M/148 in Saudi Arabia, Federal Decree-Law No. 45 of 2021 in the UAE, Law No. 13 of 2016 in Qatar, Law No. 30 of 2018 in Bahrain and Law No. 151 of 2020 in Egypt. Each statute has its own supervisory body, and the details sit in executive regulations or decisions.
Kuwait is the exception. It has no general data protection statute. Decision No. 26 of 2024 of the Communication and Information Technology Regulatory Authority (CITRA) governs licensed telecommunications and internet providers, Law No. 20 of 2014 on electronic transactions covers personal data in electronic records, and Law No. 63 of 2015 on cybercrime adds criminal liability. A client therefore starts by identifying which regime applies to which entity and activity.
Scope: who is covered in each country
Saudi Arabia applies its law under Article 2 to processing of personal data relating to individuals in the Kingdom by any means, including processing from outside the Kingdom, and excludes personal and family use that is not published or disclosed. The UAE law applies under Article 2 to controllers and processors in the UAE and to those outside it that process data of subjects in the UAE, and excludes government data, security and judicial authorities, health and banking data that have their own legislation, and companies in free zones with their own data laws such as DIFC and ADGM. Qatar's Article 2 covers personal data on electronic processing.
Egypt protects natural persons only, with criminal reach over some acts committed abroad, and excludes personal use, official statistics, journalism, judicial records, national security authorities and Central Bank-supervised entities other than money transfer and exchange companies. Kuwait's CITRA regulation applies under Article 1 to CITRA-licensed service providers, in or outside Kuwait, while other entities rely on Law No. 20 of 2014. Bahrain's Article 2 applies to processing by automated means and to structured manual files.
Where each regime stands in 2026
Egypt's Executive Regulations were issued by MCIT Decision No. 816 of 2025 (secondary sources date it 1 November 2025), and the one-year period to regularize ends around 31 October or 1 November 2026, depending on how the year is counted, so Egypt is the country with the nearest deadline. Saudi Arabia's law came into force on 14 September 2023 with a one-year corrective period that has now ended. Qatar and Bahrain have been enforceable for years, Bahrain since 1 August 2019.
The UAE is different. Article 28 of Decree-Law No. 45 of 2021 told the Cabinet to issue the Executive Regulations within six months, and Article 29 gives controllers six months from their issue to comply, but secondary sources report that the Regulations have still not been published and that no administrative penalties list has been issued under Article 26. We treat the law as in force and flag that its operational detail remains open. Kuwait's one-year grace period under Article 7 of the CITRA decision, counted from the February 2024 publication, has expired.
Consent and lawful grounds
Consent is the base rule almost everywhere. Saudi Article 5, as amended, requires explicit consent unless a ground in Article 6 applies, and Article 6 as amended adds legitimate interest. UAE Article 4 prohibits processing without consent, subject to listed exceptions, and Article 6 requires the controller to prove consent and to make withdrawal easy. Qatar's Article 4 allows processing only with consent unless it is needed for a legitimate purpose, and Article 5 gives the right to withdraw. Bahrain's Article 4 prohibits processing without consent except for contract, legal obligation, vital interests or legitimate interests.
Egypt requires explicit consent under Article 2 of Law 151, with lawful grounds in Article 6. Kuwait's CITRA regulation requires consent and proof of consent under Articles 2 and 3 for licensees, and Law No. 20 of 2014 requires consent and a stated purpose for personal data in electronic records under Articles 32 and 35. In practice a single consent flow that is explicit, purpose-specific, provable and easy to withdraw will meet most of these tests.
Individual rights
Rights are broadest in the UAE, Saudi Arabia and Egypt. UAE Articles 13 to 18 give access to information, portability, correction and erasure, restriction, objection to direct marketing and objection to automated decisions. Saudi Article 4 gives the rights to be informed, to access, to obtain a copy, to correct and to destroy. Egypt's Article 2 gives knowledge, access, withdrawal, correction, deletion, restriction and objection, and Articles 10 and 32 set a six-working-day response time.
Qatar's Articles 5 and 6 give withdrawal, objection, erasure, correction, access and a copy at no more than the service fee. Bahrain's Articles 17 to 23 cover information, access, objection to direct marketing, objection to harmful processing and automated decisions, and rectification, blocking and erasure. Kuwait's CITRA regulation adds access, correction, removal, restriction, objection and portability for licensees under Article 4.
Controller duties, records and officers
Records and officers are where the regimes diverge most. Egypt's Article 8 requires a legal entity to appoint a registered data protection officer. UAE Article 10 requires a Data Protection Officer where processing is high-risk, systematic or large-scale on sensitive data. Bahrain's Article 10 creates the Data Protection Guardian, accredited by the Authority. Saudi Article 31 requires records of processing activities that the competent authority can request. Kuwait's CITRA regulation requires processing records in Article 5.
Qatar's Articles 8 and 11 require controllers to protect data, review privacy measures before new processing, identify and train processors, and run an internal data management system. Security duties appear everywhere: Qatar Article 13, UAE Article 20, Saudi Article 19, Bahrain Article 8, Egypt Article 4 and Kuwait CITRA Article 5. A single security baseline mapped to these articles avoids duplicated work.
Licenses, registration and notification
Egypt is the most license-heavy regime. Article 26 of Law 151 lets the Personal Data Protection Center issue licenses and permits for controllers and processors, and Article 4 requires a controller to hold one, so the application portal matters as the November 2026 deadline approaches. Bahrain requires prior notice to the Authority of automated processing under Article 14 and prior authorization for certain operations under Article 15.
Qatar requires permission from the Competent Department to process personal data of a special nature under Article 16. Saudi Arabia's Article 33 gives the authority powers over accreditation and practice requirements, and the amendment repealed the old registration duty in Article 32. In the UAE, the law has no general licensing step. Kuwait links obligations to holding a CITRA license, so the first question for a Kuwait client is whether it is a licensee.
Breach notification deadlines
The deadlines vary and are a common trap. Kuwait's Article 6 requires a licensee to notify CITRA within 24 hours of becoming aware, and Article 4 refers separately to 72 hours for harmful large-scale disclosure. Egypt's Article 7 requires notice to the Center within 72 hours and to the data subject within three working days. Saudi Article 20, as amended, requires the controller to notify the competent authority, and Article 24 of the Implementing Regulation sets 72 hours where the conditions apply.
UAE Article 9 requires notice to the Data Office with a description of the breach, the officer's details, likely effects and corrective measures, within the period the Executive Regulations set, which are not yet issued. Qatar's Article 14 requires notice to the individual and the Competent Department where a breach may cause serious damage, with no hour count. Secondary sources report a 72-hour limit for Bahrain, which we flag as not tied to an article we read. The sensible group rule is a 24-hour internal escalation path that can meet the strictest deadline.
Cross-border transfers
Transfers need the most local analysis. Saudi Article 29, as amended, allows transfers only for listed purposes and on conditions that protect national security and vital interests, under the Regulation on Personal Data Transfer outside the Kingdom. UAE Article 22 allows transfers to countries with adequate protection approved by the Data Office, and Article 23 allows transfers under contracts and other safeguards where protection is not adequate. Bahrain's Article 12 prohibits transfers except to countries on the Authority's list or with its case-by-case authorization, and Article 13 lists exemptions.
Egypt's Article 14 requires adequate protection and a Center license, and its Executive Regulations add consent and named countries. Qatar's Article 15 goes the other way: a controller may not restrict cross-boundary data flow unless the processing breaches the law or may cause serious damage. Kuwait has no general localization rule, and private entities under Law No. 20 of 2014 generally need no approval for transfers abroad unless the data is state or government information. A transfer map by country is the first deliverable we prepare.
Sensitive data, children and direct marketing
Sensitive data attracts extra conditions. Egypt's Article 12 requires a Center license and written consent. Qatar's Article 16 defines special-nature data, including children and health, and requires permission from the Competent Department, while Article 17 requires parental consent for child-focused websites. Bahrain's Article 5 sets specific conditions for sensitive data. UAE Article 4 treats sensitive data under its own exceptions, and Saudi Article 35 criminalizes disclosing sensitive data with intent to harm or for personal gain.
Marketing rules also differ. Qatar's Article 22 requires prior consent, sender identity, a marketing notice and an easy stop address. Saudi Article 25 limits use of personal contact channels for advertising, and Article 26 allows marketing use only for data collected directly with consent. UAE Article 17 gives the right to object to direct marketing, Bahrain's Articles 19 and 20 cover objection to direct marketing, Egypt's Article 17 requires prior consent, and Kuwait's CITRA Article 4 requires prior consent for third-party marketing.
Penalties and enforcement
Saudi Article 35, as amended, punishes disclosing sensitive data with intent to harm or for personal gain with up to two years' imprisonment and a fine of up to SAR 3,000,000, or either penalty, and Article 36 allows a warning or a fine of up to SAR 5,000,000 for other violations, which can be doubled for a repeat violation. Qatar's Article 23 sets penalties of up to QAR 1,000,000 for breaches of listed articles, Article 24 up to QAR 5,000,000 for breaches of Articles 13, 16(3) and 17, and Article 25 reaches legal persons. Egypt's fines run from EGP 100,000 to EGP 5,000,000, with prison for sensitive data and transfer offenses under Articles 41 and 42.
In Kuwait, Law No. 20 of 2014 Article 37 provides up to three years' imprisonment and a fine of KWD 5,000 to KWD 20,000, or either penalty, and Law No. 37 of 2014 Article 64 is read as allowing fines up to KWD 1,000,000 per violation for licensees. The UAE has no published penalties list yet under Article 26, and Bahrain's offenses cover sensitive data, unlawful transfers and failure to notify, with a fine of up to BHD 20,000 or imprisonment up to one year reported by secondary sources.
What we review in a MENA data protection file
When we review a multi-country data protection file, we first map each entity and activity to its regime, and for Kuwait we check whether the client holds a CITRA license. We then align consent wording, rights procedures and records to the strictest article that applies, build one breach escalation path that can meet the 24-hour and 72-hour deadlines, map transfers country by country, and prepare the Egyptian license file before the November 2026 deadline.
See also: our Kuwait data protection guide and our Egypt data protection guide, plus our commercial and corporate practice.
Frequently asked questions
Is there one data protection law for the whole MENA region?
No. Each country has its own regime: Law No. 151 of 2020 in Egypt, the Personal Data Protection Law in Saudi Arabia, Federal Decree-Law No. 45 of 2021 in the UAE, Law No. 13 of 2016 in Qatar and Law No. 30 of 2018 in Bahrain, while Kuwait relies on CITRA Decision No. 26 of 2024 for CITRA licensees, Law No. 20 of 2014 and Law No. 63 of 2015.
Does Kuwait have a data protection law?
Not a general one. CITRA Decision No. 26 of 2024 applies under Article 1 to CITRA licensees, and other entities fall under Law No. 20 of 2014 on electronic transactions and the cybercrime law.
Which country has the nearest compliance deadline?
Egypt. The one-year period after Executive Regulations Decision No. 816 of 2025 ends around 31 October or 1 November 2026.
Are the UAE Executive Regulations issued?
Secondary sources report that they have not been published, although Article 28 of Decree-Law No. 45 of 2021 called for them within six months. We treat the law as in force and track the Regulations.
How fast must a breach be reported?
It depends. Kuwait Article 6 sets 24 hours for CITRA licensees, Egypt Article 7 sets 72 hours, Saudi Arabia's Implementing Regulation Article 24 sets 72 hours where it applies, and Qatar Article 14 sets no hour count. A 24-hour internal path meets the strictest rule.
Can personal data leave these countries?
Often yes, with conditions. Saudi Article 29, UAE Articles 22 and 23, Bahrain Articles 12 and 13 and Egypt Article 14 set transfer conditions, while Qatar Article 15 restricts limits on data flows and Kuwait has no general localization rule.
What are the highest penalties?
Saudi Article 36 allows fines of up to SAR 5,000,000, which can be doubled for a repeat violation, Qatar Article 24 up to QAR 5,000,000, and Egypt fines up to EGP 5,000,000, with imprisonment for some offenses in each country.
Do you advise on cross-border data protection compliance?
Yes. We classify each entity, map the applicable regime, draft consent and privacy documents, prepare license files in Egypt and handle regulator contact. Please contact us through our contact page to discuss your situation.