Data transfer regulations in the MENA region are evolving rapidly. A regional bank, retailer or SaaS provider may collect data in the UAE, process it in Saudi Arabia, store it in a European cloud region and give support teams in India access to it. Each of those flows can be subject to different rules, and several countries have issued new regulations in the last two years.
This article explains why cross-border transfers are so complex in the region, summarizes the main laws, and sets out practical approaches to maintaining compliant data flows while still supporting business operations.
Why cross-border data transfers are complex in MENA
Many laws, written at different times. Some laws are modeled closely on the GDPR, while others take different approaches to consent, adequacy and regulator approval.
Multiple regimes in one country. The UAE has a federal law plus separate regimes in the DIFC and ADGM financial free zones, and Qatar has separate rules for the Qatar Financial Centre.
Regulations still arriving. Several laws were passed years before their implementing regulations, and some regulations are still pending.
Data localization. Some sectors, such as healthcare and government, require certain data to stay in the country.
Cloud and outsourcing. Global cloud platforms, offshore support teams and third-party processors create transfers that are easy to overlook.
Data protection laws across MENA at a glance
The table below summarizes the main laws and how they approach international transfers. It is a starting point for planning, not legal advice, and each law should be reviewed in detail for your specific data flows.
| Jurisdiction | Law | Approach to international transfers |
|---|---|---|
| UAE (federal) | Federal Decree-Law No. 45 of 2021 (PDPL) | Transfers to countries with adequate data protection laws, or under the exceptions in Articles 22 and 23, such as contractual safeguards or explicit consent. Executive Regulations still pending; a new Federal Authority for AI and Data, announced in June 2026, is taking over the UAE Data Office. See our UAE PDPL guide. |
| UAE (DIFC) | DIFC Data Protection Law No. 5 of 2020, amended in 2025 | Transfers to jurisdictions assessed as adequate, or with appropriate safeguards such as standard contractual clauses |
| UAE (ADGM) | ADGM Data Protection Regulations 2021 | Adequacy, appropriate safeguards or specific derogations, similar to the GDPR |
| Saudi Arabia | Personal Data Protection Law, with Transfer Regulations updated in 2024 | Transfers to countries with adequate protection, or with safeguards such as standard contractual clauses, binding common rules or certification; risk assessments in some cases (King & Spalding) |
| Qatar | Law No. 13 of 2016 (PDPPL) | Generally permits transfers unless the processing breaches the law or could cause serious damage; the QFC has separate regulations |
| Bahrain | Law No. 30 of 2018 (PDPL) | Transfers to countries with adequate protection, or with the data protection authority's approval or other conditions in the law |
| Oman | Royal Decree No. 6 of 2022, Executive Regulations 2024 | Transfers permitted subject to conditions in the law and regulations (Clyde & Co) |
| Kuwait | CITRA Data Privacy Protection Regulation No. 26 of 2024 | Applies to CITRA-licensed service providers, with conditions on processing and sharing data |
| Jordan | Law No. 24 of 2023 (PDPL), in force since March 2024 | Transfers subject to adequate protection or conditions set by the law (Clyde & Co) |
| Egypt | Law No. 151 of 2020, Executive Regulations issued November 2025 | Transfers require an equivalent level of protection and a licence or permit from the Personal Data Protection Center (CMS) |
Common transfer mechanisms in the region
Although the details differ, most MENA laws rely on a similar set of mechanisms:
| Mechanism | How it works | Where it is used |
|---|---|---|
| Adequacy | The destination country is recognized as having adequate data protection | UAE PDPL, DIFC, ADGM, Saudi Arabia, Bahrain, Jordan |
| Standard contractual clauses | Contract terms between exporter and importer that impose protection obligations | DIFC, ADGM, Saudi Arabia, and commonly used under the UAE PDPL |
| Binding corporate or common rules | Group-wide rules approved for transfers within a multinational | Saudi Arabia, ADGM, DIFC |
| Explicit consent | The individual agrees to the transfer after being informed of the risks | UAE PDPL and several other laws, usually as a fallback rather than the main basis |
| Contractual necessity | The transfer is needed to perform a contract with the individual | Most regimes, for specific situations |
| Regulator approval or licence | The authority approves the transfer or issues a permit | Egypt, Bahrain and some sector regulators |
Data localization and sector-specific rules
Data protection laws are only part of the picture. Sector rules may require certain data to stay in the country altogether:
Healthcare in the UAE: Federal Law No. 2 of 2019 on the use of ICT in health fields restricts storing and processing health data outside the country, with limited exceptions. See our article on healthcare cybersecurity.
Financial services: central banks and financial regulators, including the Central Bank of the UAE, set conditions for outsourcing and cloud use, which can include where data is stored.
Government and critical infrastructure: government entities across the region often require data to be hosted in-country. Our article on government cybersecurity frameworks in MENA covers these requirements.
In-country cloud regions in the UAE, Saudi Arabia and Qatar make localization easier, but localization does not remove the need to control remote access, support teams and backups located elsewhere.
A practical approach to compliant cross-border data flows
1. Map every transfer
Build a record of which personal data leaves each country, where it goes, who receives it and why. Include cloud providers, support and IT teams, group companies, marketing tools and backups. Remote access from another country counts as a transfer in most regimes.
2. Classify the data and identify localization requirements
Identify sensitive data such as health, financial, biometric and children's data, and check whether any sector rules require it to remain in the country.
3. Choose a valid mechanism for each transfer
For each flow, select the mechanism that applies in the exporting country, such as adequacy, standard contractual clauses or binding common rules, and document why it applies.
4. Assess transfer risks
Where the law or good practice requires it, assess the legal environment of the destination country and the safeguards in place, as you would for a data protection impact assessment.
5. Put contracts in place
Use data processing agreements, standard contractual clauses and intra-group data transfer agreements that reflect the requirements of each jurisdiction involved.
6. Add technical safeguards
Encrypt data in transit and at rest, keep encryption keys in the exporting country where possible, pseudonymize data used for analytics, and use data loss prevention to stop unapproved transfers.
7. Govern vendors and cloud services
Make data location, sub-processor approval and transfer obligations part of every supplier contract and review. For organizations using several providers, see our article on secure multi-cloud strategy.
8. Monitor regulatory changes
New regulations, adequacy lists and guidance are still being issued across the region. Assign responsibility for tracking changes and updating your transfer register.
How MENA rules interact with the GDPR
Organizations that receive personal data from the EU must also meet the GDPR's transfer rules. No GCC country currently has an EU adequacy decision, so EU exporters usually rely on standard contractual clauses and transfer impact assessments when sending data to the region. The EDPB's guidance on international transfers is a useful starting point, and our article on the GDPR in 2026 covers the latest developments.
Common mistakes
Overlooking remote access. Offshore support teams viewing data in the UAE is still a transfer.
Relying on consent for everything. Consent can be withdrawn and is rarely suitable for routine business transfers.
Treating free zones as part of the federal regime. DIFC and ADGM entities follow their own rules.
Using one global contract template. Clauses written for the GDPR may not meet Saudi, Egyptian or UAE requirements.
Forgetting backups and logs. Copies stored in another region are transfers too.
How Intello helps manage cross-border data transfers
Intello helps organizations across the UAE and the wider region map their data flows, select the right transfer mechanisms, assess risks and put contracts and technical safeguards in place. Our data privacy services cover the UAE PDPL, DIFC, ADGM, Saudi PDPL and GDPR, and our privacy compliance reviews keep transfer registers current as laws change.
Speak to our data privacy team or book a free security assessment.
Frequently asked questions
Can personal data be transferred outside the UAE?
Yes, under the UAE PDPL, transfers are allowed to countries with adequate data protection laws or under the exceptions in Articles 22 and 23, such as contractual safeguards or explicit consent. DIFC and ADGM entities follow their own transfer rules.
What are the data transfer rules in Saudi Arabia?
Saudi Arabia's Personal Data Protection Law and its Transfer Regulations, updated in 2024, allow transfers to countries with adequate protection or with safeguards such as standard contractual clauses, binding common rules or certification, with a risk assessment required in some cases.
Do GCC countries require data localization?
Not generally, but some sectors do. For example, UAE health data is restricted by Federal Law No. 2 of 2019, and government and financial regulators across the region often require certain data to be hosted in-country.
Does remote access from another country count as a data transfer?
In most regimes, yes. Allowing staff or suppliers in another country to view or access personal data is treated as a transfer and needs a valid mechanism.
Has any GCC country received an EU adequacy decision?
No. EU organizations sending personal data to GCC countries usually rely on standard contractual clauses and transfer impact assessments under the GDPR.
What is the first step to managing cross-border transfers?
Map your data flows. Identify what personal data leaves each country, where it goes, who receives it and why, including cloud providers, support teams and backups.