InsightsGuide
AI and personal data in the GCC: a country-by-country guide
What each Gulf data protection regime asks before an AI agent reads personal data: the law and its dates, the regulator, the lawful bases, the rules for sending data abroad, the breach clock, and where the cloud and the model actually run.
Abstract
A Gulf company that puts AI agents on its operational data, its orders, invoices, delivery notes and customer messages, puts personal data in front of a model. We asked what the data protection regimes of the six Gulf Cooperation Council states require before that happens, and what in-country cloud can and cannot promise. We read the laws and the regulators' own texts where we could open them, law-firm summaries where we could not, and the four large cloud providers' own region and model documentation, all as of 14 October 2026. Five states have a general data protection law in force; Kuwait's privacy regulation covers only licensed telecom and internet providers. Consent is central everywhere, but transfer rules diverge, from Oman's explicit consent to Qatar's presumption that data may flow, and breach clocks run from 24 to 72 hours. Public cloud regions exist in Saudi Arabia, the UAE, Qatar and Bahrain, and Oracle runs dedicated regions in Oman, but the frontier models offered in Gulf regions are documented as able to run abroad. Where data is stored and where the model reads it are separate questions, each needing a written answer. This guide is not legal advice.
Key findings
- Five of the six Gulf states have a general personal data law in force, Oman's fully enforceable since 5 February 2026; Kuwait's privacy regulation covers only licensed telecom and internet providers, and the UAE's federal law still awaits the executive regulations that its own Article 28 required within six months of its issue in September 2021.
- Consent is central in every regime, but the rules for sending data abroad diverge the most: Oman's Executive Regulation asks for the data subject's explicit consent before a transfer, Saudi Arabia requires a safeguard and a risk assessment because no adequacy list has been published, the UAE and Bahrain combine adequacy with listed alternatives, and Qatar forbids controllers to restrict cross-border flows unless the processing breaks the law.
- Breach clocks run from 24 hours for Kuwait's licensees to 72 hours in Oman, Saudi Arabia, Qatar's guideline, Bahrain and Abu Dhabi Global Market, while the UAE federal law and the Dubai International Financial Centre set no fixed number of hours.
- Public regions of AWS, Microsoft Azure, Google Cloud or Oracle exist in Saudi Arabia, the UAE, Qatar and Bahrain, with Microsoft's and AWS's first Saudi regions due in the last quarter of 2026; Oman has two Oracle dedicated regions rather than a public one, and Kuwait has none.
- A region in the country settles where data is stored, not where the model reads it: the providers' own documentation offers frontier models in Gulf regions through global routing, so the place of inference must be stated per model and per workflow, in writing.
1Introduction
An AI agent inside a company's operations reads what its people read: a WhatsApp order with a buyer's name and number, a delivery note signed by a driver, an invoice addressed to a contractor. Much of that is personal data under Gulf law, so the agent faces the questions asked of any new system: on what basis the data is processed, where it is stored, whether it leaves the country, and what happens if it leaks. It adds one that older systems rarely raised: where the model that reads the data runs.
The answers moved in 2026. Oman's law became fully enforceable on 5 February 2026 [1]. Saudi Arabia, enforcing its law since September 2024 with 48 penalty decisions in 2025 by one vendor's count [2], opened consultation on 6 October 2026 on a draft that would require personal data to be stored in the Kingdom [3]. The UAE announced a federal authority for AI and data in June 2026, with its federal law's executive regulations still unissued [4]. Microsoft and AWS say their first Saudi cloud regions open in the last quarter of 2026 [5, 6].
A Gulf operating company rarely sits under one law. A distributor in Muscat sells to hotels in Dubai; a logistics group in Riyadh runs a hub in Bahrain. Six states, two UAE financial free zones with laws of their own and the Qatar Financial Centre give such a group up to nine rulebooks, and each answers the agent's questions differently. This guide contributes four things:
- A dated reading of each regime: the instrument and its dates, the regulator, the lawful bases, transfer abroad, the breach clock and the sector rules worth knowing (sections 3 and 4).
- A one-screen comparison of eight regimes on five questions (Figure 2).
- A dated table of in-country cloud regions by provider, and a table of where the providers say a model's inference runs when called from a Gulf region (Tables 1 and 2).
- Five questions to answer in writing before an agent reads personal data (Figure 3).
2Background and related work
Gulf data protection law is young. Qatar's law of November 2016 is the oldest of the six states' instruments [7], and the others followed between 2018 and 2024. They resemble the European approach: lawful bases, rights for the person the data is about, duties for the controllerThe party that decides why and how personal data is processed. A company putting an agent on its own customer records is usually the controller; a vendor running the agent on its instructions is usually a processor. and its processors, breach notification, and conditions on sending data abroad. They differ in the details that matter most to an operating company.
Two kinds of work cover this ground. Law-firm compendia describe each country in a common template, DLA Piper's Data Protection Laws of the World [8] and the Chambers practice guides [9] the most complete among them, and law-firm notes track instruments as they appear [1, 3, 10]. Separately, the cloud providers document their regions, and the routing of model requests, for engineers [11, 12].
Neither joins the two halves. The legal guides answer whether personal data may leave a country and under what paper; the cloud documentation answers where a request is processed. For an agent the second answer feeds the first: if the model that reads a customer's message runs abroad, the message has travelled, whichever region the database sits in.
How we read the sources
On 14 October 2026 we read the primary text wherever we could open it: Oman's law in English translation and its Executive Regulation in Arabic [13, 14], the UAE's federal decree-law on the government's legislation portal [15], Qatar's law and its regulator's breach guideline [7, 16], and Saudi Arabia's Essential Cybersecurity Controls [17]. SDAIA's website rejected our automated requests for the Saudi texts and the Bahraini authority's denied access, so for Saudi Arabia, Bahrain, Kuwait and the two UAE free zones we rely on law-firm, vendor and practice-guide summaries, marked as such in the references. For cloud regions and model routing we read only the providers' own pages.
3The laws in order
Figure 1 sets the instruments in the order they took effect. Enforcement arrived years after enactment: Oman's law was issued in February 2022 and fully enforceable four years later, Saudi Arabia's issued in September 2021 and enforced from September 2024 [13, 1, 8]. And the calendar is still moving, as the last four entries show.
Read down: each line is one instrument taking effect, or one step in its enforcement, in date order.
- Nov 2016Qatar issues Law No. 13 of 2016Issued 3 November 2016; in force in 2017, with six months to comply.
- Aug 2019Bahrain's Law No. 30 of 2018 in force1 August 2019; ten resolutions followed on 17 March 2022.
- Jul 2020Dubai International Financial Centre: Law No. 5 of 2020 in force
- Feb 2021Abu Dhabi Global Market issues its Data Protection Regulations 2021
- Jan 2022UAE Federal Decree-Law No. 45 of 2021 in force2 January 2022; its executive regulations were still not issued in October 2026.
- Feb 2023Oman's Royal Decree 6/2022 in forceOne year after its issue on 9 February 2022.
- Sep 2023Saudi Arabia's PDPL in force14 September 2023, with a year to comply; the transfer regulation was first published on 7 September 2023.
- Feb 2024Oman's Executive Regulation takes effectMinisterial Decision 34/2024, published 4 February 2024, with a year to comply.
- Feb 2024Kuwait repeals its data classification policyPrivacy rules apply only to telecom and internet licensees (Decision No. 26 of 2024).
- Sep 2024Saudi Arabia: grace period endsEnforced from 14 September 2024; transfer regulation updated on 1 September 2024.
- Feb 2026Oman: transition endsFully enforceable from 5 February 2026, after an extension by Ministerial Decision 6/2025.
- Feb 2026Saudi Arabia: rules for certificates of accreditation17 February 2026; a third safeguard for transfers abroad.
- Jun 2026UAE announces a Federal Authority for AI and Data14 June 2026; it absorbs the UAE Data Office.
- Oct 2026Saudi Arabia consults on storing personal data in the KingdomDraft amendments, open 6 October to 5 November 2026; not law.
4Country by country
Each entry follows the same order: the law and its dates, the regulator, the lawful bases, transfer abroad, the breach clock, and sector rules worth knowing.
Oman
The newest law to reach full enforcement, and the strictest on transfer: the data subject's explicit consent is the main basis for processing and, under the Executive Regulation, for sending data abroad.
- Law and dates. Royal Decree 6/2022, issued 9 February 2022 and published in Official Gazette 1429 on 13 February, came into force a year after issue [13]. The Executive Regulation, Ministerial Decision 34/2024, was published on 4 February 2024 and took effect the next day with a year to comply [14]; Ministerial Decision 6/2025 extended the transition to 5 February 2026 [1]. One law-firm note dates the regulation from 29 January 2024 [18].
- Regulator. The Ministry of Transport, Communications and Information Technology (Articles 1 and 7) [13].
- Lawful bases. Processing requires the data subject's explicit consent (Article 10); Article 3 takes some processing, such as performing a contract with the data subject, outside the law; and genetic, biometric, health and other sensitive data need a Ministry permit (Article 5) [13]. CMS notes it is unclear whether the Article 3 exclusions work as lawful bases [1].
- Transfer abroad. Allowed under the Regulation's procedures, never for data processed in breach of the law (Article 23) [13]. The Regulation requires the data subject's explicit consent before a transfer, unless a treaty requires it or the data is anonymised (Article 37), and protection abroad no lower than Oman's (Article 38) [14]. There is no adequacy list, no set of standard clauses and no prior approval [18]. Breaching Article 23 carries a fine of OMR 100,000 to 500,000, against administrative fines of up to OMR 2,000 (Articles 29 and 32) [13].
- Breach. Within 72 hours to the competent department, and to data subjects where the breach may cause serious harm or high risk (Articles 30 and 32) [14].
- Officer. Required, with public contact details, preferably based in Oman; CMS advises treating Arabic as the primary version of privacy notices [1].
- Sector rules. The Ministry's Cloud and Hosting Services Standard (2018) keeps government data, backups included, inside Oman [19].
Saudi Arabia
The most developed machinery of the six: controller registration, breach reports, standard clauses and a record of penalties. SDAIA's site would not serve us the texts, so this entry rests on DLA Piper, the privacy vendor Securiti and Clyde & Co.
- Law and dates. Royal Decree M/19 of 16 September 2021, amended by Royal Decree M/148 of 27 March 2023, in effect from 14 September 2023 with a year to comply, and applied through Implementing Regulations and Transfer Regulations [8]. The transfer regulation was updated on 1 September 2024 and rules for certificates of accreditation issued on 17 February 2026 [2].
- Regulator. SDAIA, with the central bank and the communications regulator keeping their sectors; most controllers register on its National Data Governance Platform [8].
- Lawful bases. Consent is the primary basis, and the law lists the cases where it is not required [8].
- Transfer abroad. Permitted to adequate countries or under safeguards, provided national security and the Kingdom's vital interests are not harmed [8]. With no adequacy list published by September 2026, every transfer rests on SDAIA's standard contractual clausesA fixed contract text, issued by a regulator, that the sender and the receiver of personal data sign so that a transfer abroad is lawful., binding common rules or a certificate of accreditation, with a risk assessment before relying on a safeguard and before continuous or large-scale transfers of sensitive data [2].
- Breach. Within 72 hours to SDAIA through the national portal; data subjects without undue delay where required [8].
- Officer and penalties. An officer is required for public entities processing at scale, for regular large-scale monitoring, and where sensitive data is a core activity; fines reach SAR 5 million [8].
- The 2026 draft. Open for comment from 6 October to 5 November 2026: a new Article 23 of the Implementing Regulations would require controllers to store personal data in the Kingdom while still allowing lawful transfers, and registration would become mandatory for controllers that transfer data abroad. If approved, it takes effect 60 days after publication in the Official Gazette [3]. It is a draft, not law.
- Sector rules. The Essential Cybersecurity Controls (ECC-2:2024), binding on government agencies, their companies and operators of critical national infrastructure, require third-party contracts to cover non-disclosure, secure removal of data at the end of service and incident communication (4-1-2); the 2024 revision deleted the old in-Kingdom hosting sub-control and moved localisation to SDAIA's National Data Management Office [17]. Banks may need SAMA's approval for cloud outside the Kingdom, capital-market firms must use cloud inside it, and insurers must keep customer data there [10].
United Arab Emirates
A federal law still waiting for its regulations, and two financial free zones with regimes of their own.
- Law and dates. Federal Decree-Law No. 45 of 2021, issued 20 September 2021, in force 2 January 2022. It excludes government data, health and banking data governed by their own laws, and free-zone companies with their own data protection law (Article 2) [15].
- The missing regulations. Article 28 required executive regulations within six months; Article 29 gives six months from their issue to comply [15]. None had been issued by 15 June 2026 [4], and the legislation portal listed none on 14 October 2026 [15].
- Regulator. The UAE Data Office, created by Federal Decree-Law No. 44 of 2021 [15], which never became fully operational and is being absorbed into the Federal Authority for Artificial Intelligence and Data announced on 14 June 2026 [4].
- Lawful bases. Consent, except in listed cases such as performing a contract with the data subject, legal claims and the public interest (Article 4) [15].
- Transfer abroad. To countries with data protection law and a regulator, in cases the Data Office approves, or under an agreement the UAE has joined (Article 22); otherwise under a contract binding the recipient to the law's standards, with explicit consent, to perform a contract with the data subject, or for legal claims or the public interest (Article 23) [15].
- Breach. To the Data Office on becoming aware, within a period the executive regulations are to set (Article 9) [15]. For now no number of hours applies.
- Officer. Required for high-risk processing or large volumes of sensitive data, and may sit outside the UAE (Article 10) [15].
- Sector rules. Electronic health data must be stored in the UAE under Federal Law No. 2 of 2019, subject to exceptions, and personal and payment data under the central bank's 2021 retail payments regulation [10].
The Dubai and Abu Dhabi financial free zones
The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) sit outside the federal law, closer to the European model. DIFC Law No. 5 of 2020, in force since July 2020 under a Commissioner of Data Protection, admits six lawful bases, asks for breach notice as soon as practicable, and permits transfers on adequacy, safeguards or listed derogations [20]. Its Regulation 10 of September 2023 covers systems that process personal data without a person directing each step: the deployer is deemed the controller, users must be told at first use, and a system offered commercially must serve human-defined or human-approved purposes [21]. The ADGM Data Protection Regulations 2021 require breach notice within 72 hours where feasible and restrict transfers out of ADGM, including to the rest of the UAE [22].
Qatar
The oldest law in the group and the most open on transfer: rather than restricting cross-border flows, it forbids controllers to restrict them.
- Law and dates. Law No. 13 of 2016, issued 3 November 2016 and published in Official Gazette No. 15 of 2016, with six months to comply (Article 30) [7]; in effect from 2017 [9].
- Regulator. The National Cyber Security Agency, through its National Cyber Governance and Assurance Affairs, under Amiri Decree No. 1 of 2021 [16]; a 2026 practice guide still calls the division of roles with the ministry unsettled [9].
- Lawful bases. Consent, unless processing is necessary for a lawful purpose (Article 4) [7].
- Transfer abroad. A controller may not limit cross-border data flow unless the processing breaches the law or may cause serious damage (Article 15) [7]. No transfer mechanism is prescribed, and the 2022 Cloud Policy Framework states that data residency is no longer a requirement [9]. Data of a special natureQatar's term for the personal data its law treats as sensitive. Other Gulf laws say sensitive data, with similar lists., such as health, children's data, religious creeds and criminal offences, needs the competent department's permission (Article 16) [7].
- Breach. Individuals and the competent department must be told of a breach that may cause serious damage (Article 14) [7], within 72 hours under the agency's guideline of September 2022 [16].
- Officer and penalties. No officer is named; controllers identify those responsible for protection (Article 11). Fines reach QAR 1 million, or QAR 5 million for the security, special-nature and children's data articles (Articles 23 and 24) [7].
- A separate regime. The Qatar Financial Centre has its own 2021 regulations, with a permit for transfers to recipients without adequate protection [9].
Bahrain
A published adequacyA regulator's finding that another country protects personal data well enough for data to go there without further paperwork. list with a permission route: the closest of the six to the European model.
- Law and dates. Law No. 30 of 2018, in force since 1 August 2019, supplemented by ten resolutions of 17 March 2022 [23].
- Regulator. The Personal Data Protection Authority, whose functions the Ministry of Justice, Islamic Affairs and Endowments performs under Decree No. 78 of 2019 [23].
- Lawful bases. Consent, or necessity for a contract, a legal obligation, vital interests or legitimate interests [23].
- Transfer abroad. Free to the 83 countries that Resolution No. 42 of 2022 lists as adequate; other destinations need the Authority's authorisation, case by case, unless an exclusion applies [24].
- Breach. Within 72 hours, under Resolution No. 43 of 2022 [24].
- Officer and penalties. Optional under Resolution No. 46 of 2022 [24], but required for licensed financial institutions; unlawful transfers can carry up to a year's imprisonment and fines up to BHD 20,000 [23].
Kuwait
The exception among the six: there is no general data protection statute.
- Law and dates. The E-Transactions Law No. 20 of 2014 sets a general baseline. The telecoms regulator CITRA's Data Privacy Protection Regulation, as amended by Decision No. 26 of 2024, applies only to CITRA-licensed telecom and internet providers [25].
- Regulator. No single authority: the telecoms regulator for its licensees, the Central Agency for Information Technology for the E-Transactions Law, and the National Centre for Cybersecurity, mainly for government entities [25].
- Consent, transfer and breach. Licensees must obtain consent before collecting personal data, tell users of transfers outside Kuwait and may need CITRA's approval for them, and notify CITRA and affected users within 24 hours of a breach. Others generally need no approval unless government information is involved [25].
- Classification. The Data Classification Policy, which required certain data to be stored in Kuwait, was repealed in February 2024 [25].
5The regimes side by side
Figure 2 sets the eight regimes against the five questions an agent deployment must answer first. Three patterns matter for an operating company.
Each row is one regime and each column one question; the cells are short, and section 4 gives the conditions behind each.
| Item | Consent central | Transfer abroad | Breach notice | Officer | Regulator |
|---|---|---|---|---|---|
| Oman (Royal Decree 6/2022) | Yes: explicit consent | Explicit consent, and protection no lower than Oman's | 72 hours | Required | Ministry of Transport, Communications and IT |
| Saudi Arabia (PDPL, 2021) | Primary basis, with listed exceptions | A safeguard and a risk assessment; no adequacy list yet | 72 hours | In listed cases | SDAIA |
| UAE federal (Decree-Law 45/2021) | Yes, with listed exceptions | Adequacy, or a contract, consent and other listed cases | On awareness; the period awaits the regulations | In high-risk cases | UAE Data Office, being folded into a new federal authority |
| UAE: DIFC (Law No. 5 of 2020) | One of six bases | Adequacy, safeguards or derogations | As soon as practicable | For systematic high-risk processing | Commissioner of Data Protection |
| UAE: ADGM (Regulations 2021) | One of six bases | Adequacy, approved clauses or derogations | 72 hours where feasible | In listed cases | Commissioner of Data Protection |
| Qatar (Law No. 13 of 2016) | Yes, or a lawful purpose | Flows may not be restricted; special-nature data needs permission | 72 hours, by guideline | Not named in the law | National Cyber Security Agency |
| Bahrain (Law No. 30 of 2018) | Yes, or another listed basis | An 83-country list, or the Authority's permission | 72 hours | Optional; required for licensed financial firms | Personal Data Protection Authority |
| Kuwait (Decision No. 26 of 2024) | Yes, for licensees | Tell users the destination countries | 24 hours | Not set out | Telecoms regulator, for its licensees only |
Consent is central everywhere, but its weight differs. In Oman it is also a condition met before data leaves the country (Article 37) [14]; we read that to mean consent given for a delivery does not on its face cover sending the order to a model abroad. In the UAE's federal law consent is the default, with listed exceptions that include performing a contract [15]. The DIFC, ADGM and Bahrain treat it as one basis among several, legitimate interests included [20, 22, 23].
Transfer rules diverge the most, from Oman's consent requirement to Qatar's rule that a controller may not restrict the flow. A group policy that treats 'GCC data' as one category will be too strict for Qatar and too loose for Oman.
Breach clocks are short, mostly 72 hours. Kuwait's licensees have 24, and the UAE federal law and the DIFC set no number. A company must be able to say, within one to three days, which records an agent read and where they went: a logging requirement before it is a legal one.
6In-country cloud, and what it does not settle
Table 1 lists the in-country regions on each provider's own pages, read on 14 October 2026 [11, 26, 27, 28]. Microsoft's Saudi Arabia East is announced for the fourth quarter of 2026 but was not yet in Azure's list updated on 13 October [5, 26]; AWS's Saudi region is on track for December 2026 [6]. Oman has two Oracle dedicated regions, Muscat and, since October 2025, Ibri, offered to government entities [29, 30].
| Country | AWS | Microsoft Azure | Google Cloud | Oracle public regions | Oracle dedicated regions |
|---|---|---|---|---|---|
| Saudi Arabia | Announced; on track for December 2026 | Saudi Arabia East, announced for Q4 2026; not yet listed | Dammam (me-central2); Saudi customers buy through CNTXT | Riyadh (me-riyadh-1), Jeddah (me-jeddah-1) | Riyadh, Al Khobar |
| UAE | Middle East (UAE), me-central-1, 3 zones | UAE North (Dubai), 3 zones; UAE Central (Abu Dhabi), restricted access | None | Abu Dhabi (me-abudhabi-1), Dubai (me-dubai-1) | Two in Abu Dhabi |
| Qatar | None | Qatar Central (Doha), 3 zones | Doha (me-central1), 3 zones | None | Doha |
| Bahrain | Middle East (Bahrain), me-south-1, 3 zones | None | None | None | None |
| Oman | None | None | None | None | Muscat; Ibri, live since October 2025 |
| Kuwait | None | None | None | None | None |
Sources: AWS, Microsoft, Google and Oracle region pages and announcements [11, 6, 26, 5, 27, 31, 28, 29, 30]. Dedicated regions are built for named customers and are not generally on sale.
What in-country settles
A region in the country settles where data sits at restHeld in storage, in databases, files, backups and logs, as opposed to moving over a network or being worked on in a processor's memory.: the database, the documents, the logs and, if configured, the backups. That answers most transfer questions for stored data, and meets the rules that require storage in the country, such as the UAE's for health and payments and Oman's for government data [10, 19].
What it does not settle: where the model runs
It does not settle where the model that reads the data runs. InferenceRunning a trained model on an input to produce an output. When an agent asks a model to read an invoice, the reading happens wherever the model's inference runs, which can differ from where the invoice is stored. is a separate service from storage, and the providers document it separately (Table 2).
| Provider | What stays in the region | Where inference can run | In-region options the provider names |
|---|---|---|---|
| AWS Bedrock, UAE and Bahrain regions | Stored data, logs, knowledge bases and configurations | Claude models: global routing only; data may be processed in any commercial region | Amazon Nova Lite and Nova Pro in the UAE region |
| Microsoft Azure, Foundry Models | Data at rest, in the chosen geography | Global types: any Azure region. Data Zone types: United States, European Union or Asia Pacific | Standard and Regional Provisioned types keep processing in the geography, where a model offers them |
| Google Cloud, Vertex AI | Not guaranteed by the endpoint alone | Global endpoint: the customer cannot control or know the region | Multi-region endpoints with a jurisdictional boundary, for the United States and the European Union |
Sources: Amazon Bedrock regional availability and the AWS announcement of 24 February 2026 [12, 32]; Microsoft Learn on deployment types, updated 12 August 2026 [33]; Google Cloud on deployments and endpoints, updated 14 October 2026 [34].
On AWS, every Claude model listed for the UAE and Bahrain regions is offered only through global cross-region inferenceA cloud feature that sends a model request from the region where it was made to another region with capacity, and returns the answer to the first., and none of Bedrock's geographic profiles covers the Gulf [12]; customer data is not stored in the destination region and logs stay in the source region [32]. Storage stays, inference travels. Azure's Data Zones cover only the United States, the European Union and Asia Pacific [33], and Google states that its endpoints do not guarantee in-region processing [34].
So a Dubai distributor whose database sits in the UAE region, calling a frontier model through a global route, sends each prompt wherever the provider routes it. Whether a prompt processed abroad and not stored there counts as a transfer is not settled in the texts we read. The conservative reading, which we follow, treats it as one: under the UAE's federal law it then needs an Article 22 or 23 basis [15], and in Oman the place of inference becomes a consent question [14]. The same call from Qatar raises a much smaller one [7].
Continuity
In-country also concentrates risk. In early March 2026 AWS reported drone strikes on two of its UAE facilities, impairing two of the three zones of its UAE region, and advised Middle East customers to consider moving workloads to other regions [35]. A backup abroad is itself a transfer; where a continuity copy may go, and under what paper, is best decided before it is needed.
7Five questions before an agent reads personal data
Figure 3 turns the guide into five questions, each answer narrowing the next.
Follow the arrows from the data to the paper; the orange box is the question most often left out, and the dashed arrow is the way back when the last question has no good answer.
- What data. Which fields the agent reads, which are personal, and whether any are sensitive: health, biometrics, children's data, criminal records. A field the work does not need is better left unread than protected.
- Whose. Where the people are, and which regime governs the company holding the data; a free-zone entity and its mainland sister answer to different laws.
- Where stored. The named region or building for the record, the documents, the logs and the backups.
- Where the model runs. For each model the workflow calls: the provider, the deployment type and the region of inference, as documented on the day. This is the question most often left out.
- What transfer paper. If question 4 puts personal data abroad, the basis that allows it, from explicit consent in Oman to, for ordinary data, nothing beyond lawful processing in Qatar.
Where question 5 has no good answer, the options are the ones questions 1 and 4 open: read fewer personal fields, remove them before the call, or choose a model that runs in the country.
8Implications for deployment
The guide comes down to five practices.
- Decide storage first, country by country. Keep the record, documents and logs in a named region in the country; where no public region exists, as in Oman and Kuwait, name the facility.
- Treat the model as a separate location. State for each workflow which model reads which fields and where its inference runs, and recheck when a provider's documentation changes or a region opens.
- Minimise before the call. Under every regime the simplest transfer is the one that carries no personal data.
- Log every read. With breach clocks of 24 to 72 hours, a company must know which records an agent read and what it sent where. An agent with credentials of its own and a log line for every read turns that answer into a query rather than an investigation.
- Prepare the transfer paper before go-live. Consent wording in Oman, clauses and a risk assessment in Saudi Arabia, the right Article 23 basis in the UAE, permission for an unlisted country in Bahrain. If Saudi Arabia's draft is adopted, controllers that transfer data abroad will also have to register [3].
This is how Qantara approaches it. The operating record and its log are kept in the customer's country. For each workflow, before it goes live, we state in writing which model reads what and where that model runs. Each agent signs in with credentials of its own, scoped to one deployment and revocable, and every read and write is a line in the log. Above thresholds the customer sets, a person approves. None of this replaces the customer's counsel; it gives counsel the facts the five questions ask for.
9Limitations
This guide is not legal advice and is current only as of 14 October 2026. For Saudi Arabia, Bahrain, Kuwait and the free zones it relies on summaries that can lag the texts: the DLA Piper pages for the DIFC and ADGM date from January 2025 and January 2024 [20, 22], and our copy of Regulation 10 is unofficial [21]. The English texts for Oman, the UAE and Qatar are translations. Whether inference abroad without storage counts as a transfer is not settled in the texts; we took the conservative reading. Sector rules are covered selectively, and free zones other than the DIFC and ADGM not at all.
Several facts here will change soon: the UAE's executive regulations, Saudi Arabia's draft, the new Saudi regions and every region's model list. Each would change a cell in Figure 2 or Tables 1 and 2, not the method.
10Conclusion
The six Gulf states regulate personal data in ways that agree in outline and differ in the details that decide an AI deployment: whether consent must cover a transfer, what paper a transfer needs, and how many hours a company has to report a breach. The cloud has moved closer, with public regions in four states and two more due in Saudi Arabia, but a region settles where data is stored, not where the model reads it.
The practical answer is the same everywhere: write down, per workflow and before go-live, what the agent reads, which of it is personal, where it is stored, where the model runs, and what paper covers any gap. The answers will differ between Muscat, Riyadh, Dubai and Doha. The questions do not.
References
- [1]Al Bulushi, S., Ooijevaar, M. and Dolphin, C. (2026). Oman personal data protection law: entering the enforcement phase. CMS legal update, 11 February 2026 (law-firm summary). Accessed 14 October 2026.
- [2]Baig, A., Qureshy, A. A. and Khan, S. (2026). An overview of Regulation on Personal Data Transfer Outside the Kingdom. Securiti, privacy software vendor, updated 30 September 2026 (vendor summary). Accessed 14 October 2026.
- [3]Bajunaid, L. and Ezzat, N. (2026). The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL. Clyde & Co insights, 8 October 2026 (law-firm summary). Accessed 14 October 2026.
- [4]Andreeva, K. (2026). UAE establishes Federal Authority for Artificial Intelligence and Data. Morgan Lewis, 15 June 2026 (law-firm summary). Accessed 14 October 2026.
- [5]Microsoft (2026). Microsoft confirms Saudi Arabia datacenter region available for customers to run cloud workloads from Q4 2026. Microsoft Source EMEA, February 2026. Accessed 14 October 2026.
- [6]Amazon (2026). AWS to launch first cloud infrastructure region in the Kingdom of Saudi Arabia by December 2026. About Amazon. Accessed 14 October 2026.
- [7]State of Qatar (2016). Law No. (13) of 2016 on Protecting Personal Data Privacy. National Cyber Security Agency, unofficial English text; official text in Official Gazette No. 15 of 2016. Accessed 14 October 2026.
- [8]DLA Piper (2026). Data protection laws in Saudi Arabia - Data Protection Laws of the World. Data Protection Laws of the World, last modified 11 February 2026 (law-firm guide). Accessed 14 October 2026.
- [9]Saleh, A., Ahmad, A., Saleh, J., et al. (2026). Data Protection & Privacy 2026: Qatar. Chambers and Partners Global Practice Guides, updated 10 March 2026 (law-firm guide). Accessed 14 October 2026.
- [10]Clifford Chance (2025). Doing business in the Middle East: data transfers in the UAE and the KSA. Talking Tech, Clifford Chance, 10 March 2025 (law-firm summary). Accessed 14 October 2026.
- [11]Amazon Web Services (2026). AWS Regions. AWS Global Infrastructure documentation. Accessed 14 October 2026.
- [12]Amazon Web Services (2026). Regional availability by models. Amazon Bedrock User Guide. Accessed 14 October 2026.
- [13]Sultanate of Oman (2022). Royal Decree 6/2022 Issuing the Personal Data Protection Law. Royal Decree 6/2022, Sultanate of Oman; translation published by Decree.om. Accessed 14 October 2026.
- [14]Ministry of Transport, Communications and Information Technology, Oman (2024). Ministerial Decision 34/2024 issuing the Executive Regulation of the Personal Data Protection Law (title translated from the Arabic). Official Gazette 1531, 4 February 2024; text reproduced by Qanoon.om. Accessed 14 October 2026.
- [15]United Arab Emirates (2021). Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data. UAE Legislation portal, Ministry of Cabinet Affairs (English translation; the Arabic text prevails). Accessed 14 October 2026.
- [16]National Cyber Security Agency, Qatar (2022). Personal Data Breach Notifications: Guidelines for Regulated Entities, version 2.0. National Cyber Governance and Assurance Affairs, guideline PDPPL-02050217E, September 2022. Accessed 14 October 2026.
- [17]National Cybersecurity Authority, Saudi Arabia (2024). Essential Cybersecurity Controls (ECC – 2: 2024). National Cybersecurity Authority; web page last updated 19 July 2026. Accessed 14 October 2026.
- [18]Wigley, T. and Teng, L. Y. (2024). Oman's data protection law – new regulations. Trowers & Hamlins insights, 13 February 2024 (law-firm summary). Accessed 14 October 2026.
- [19]Ministry of Transport, Communications and Information Technology, Oman (2018). Cloud and Hosting Services Standard. Ministry of Transport, Communications and Information Technology, standards library. Accessed 14 October 2026.
- [20]DLA Piper (2025). Data protection laws in UAE - Dubai (DIFC). Data Protection Laws of the World, last modified 27 January 2025 (law-firm guide). Accessed 14 October 2026.
- [21]Emerging Technology Observatory, Georgetown University (2023). DIFC Data Protection Regulations, Regulation 10. AGORA instrument 1773 (unofficial copy of the text, enacted 1 September 2023). Accessed 14 October 2026.
- [22]DLA Piper (2024). Data protection laws in UAE - Abu Dhabi Global Market Free Zone. Data Protection Laws of the World, last modified 9 January 2024 (law-firm guide). Accessed 14 October 2026.
- [23]DLA Piper (2026). Data protection laws in Bahrain - Data Protection Laws of the World. Data Protection Laws of the World, last modified 2 February 2026 (law-firm guide). Accessed 14 October 2026.
- [24]Clyde & Co (2022). Bahrain issues new privacy guidelines supplementing the Personal Data Protection Law. Clyde & Co insights, 28 April 2022 (law-firm summary). Accessed 14 October 2026.
- [25]Saleh, A., Ahmad, A., Al Awadhi, M. N., et al. (2026). Data Protection & Privacy 2026: Kuwait. Chambers and Partners Global Practice Guides, updated 10 March 2026 (law-firm guide). Accessed 14 October 2026.
- [26]Microsoft (2026). List of Azure regions. Microsoft Learn, updated 13 October 2026. Accessed 14 October 2026.
- [27]Google Cloud (2026). Regions and zones. Compute Engine documentation, updated 13 October 2026. Accessed 14 October 2026.
- [28]Oracle (2026). Regions and availability domains. Oracle Cloud Infrastructure documentation. Accessed 14 October 2026.
- [29]Oracle (2026). EPM Cloud geographic, data, and air-gapped regions. Oracle Enterprise Performance Management Cloud documentation (lists the dedicated regions). Accessed 14 October 2026.
- [30]Grey, D. (2025). Oracle announces second OCI region in Oman. W.Media, 14 October 2025. Accessed 14 October 2026.
- [31]Google Cloud (2026). Dammam region access. Google Cloud documentation, updated 13 October 2026. Accessed 14 October 2026.
- [32]Basudan, H., Li, M., Dabboussi, S., et al. (2026). Introducing Amazon Bedrock global cross-Region inference for Anthropic's Claude models in the Middle East Regions (UAE and Bahrain). AWS Machine Learning Blog, 24 February 2026. Accessed 14 October 2026.
- [33]Microsoft (2026). Understanding deployment types in Microsoft Foundry Models. Microsoft Learn, updated 12 August 2026. Accessed 14 October 2026.
- [34]Google Cloud (2026). Deployments and endpoints. Google Cloud generative AI documentation, updated 14 October 2026. Accessed 14 October 2026.
- [35]Mann, T. (2026). AWS says drones hit two of its datacenters in UAE, urges users to move resources to different regions. The Register, 2 March 2026, updated 3 March 2026. Accessed 14 October 2026.
Cite this paper
Qantara Research (2026). AI and personal data in the GCC: a country-by-country guide. Qantara, 14 October 2026. https://qantara.systems/insights/gcc-personal-data
@techreport{qantara2026gccpersonaldata,
title = {AI and personal data in the GCC: a country-by-country guide},
author = {Qantara Research},
institution = {Qantara},
year = {2026},
month = {oct},
url = {https://qantara.systems/insights/gcc-personal-data}
}Disclosure
This guide is not legal advice; it describes the law, the cloud regions and the providers' documentation as we read them on 14 October 2026, and each may have changed since. The statements of law are cited to the texts where we could open them and otherwise to the law-firm, vendor and practice-guide summaries named in the references; English translations are unofficial and the Arabic texts prevail. The timeline, the comparison matrix, the five questions and the two tables are our own compilation from those sources, the reading of inference abroad as a transfer is ours and labelled as conservative, and the distributor example is illustrative.
