Which Gulf countries have data protection laws, and how do they differ?

Short answer: Five of the six GCC states now have comprehensive data protection laws — Saudi Arabia, UAE, Bahrain, Qatar, and Oman. Kuwait is the exception, taking a sectoral approach instead. They differ mainly on consent strictness, localization preference, and transfer mechanism. 
 The regional picture 
 
 
 
 Jurisdiction 
 Status 
 Distinguishing feature 
 
 
 
 
 Saudi Arabia 
 PDPL in force (full effect Sept 2024) 
 Strongest localization preference; SDAIA-approved SCCs 
 
 
 UAE 
 Federal Decree-Law 45/2021 
 GDPR-like lawful bases; DIFC and ADGM run separate regimes 
 
 
 Bahrain 
 In force since 2019 
 Heavily GDPR-inspired; extraterritorial reach; mature enforcement 
 
 
 Qatar 
 In force since 2017 
 Earliest in the region; more consent-centric 
 
 
 Oman 
 Full effect 5 February 2026 
 Mirrors GDPR principles; grace period ending 
 
 
 Kuwait 
 No comprehensive law 
 Sectoral only — CITRA regulation for telecom and IT 
 
 
 
 Status at time of writing; confirm with local counsel. 
 The axis that matters most 
 Two variables separate these regimes in practice: 
 
 Consent strictness. Qatar and Saudi Arabia lean consent-centric. The UAE permits a broader set of lawful bases, closer to GDPR. 
 Localization preference. Saudi Arabia is strongest; the UAE and Qatar take a more risk-based, safeguards-oriented approach. 
 
 Why one architecture answers all six 
 The regimes disagree on mechanism and agree on substance: collect the minimum, secure it, control where it goes. 
 Because Cyber Crucible never collects keys, credentials, tokens, or content, and can run air-gapped with zero outbound telemetry, the answer to "what personal data does this vendor hold, and where does it go?" is short in every one of them. Meeting the strictest — Saudi Arabia — covers the rest. 
 Oman is the near-term priority for anyone who has not reviewed their stack, given the February 2026 date. 
 
 Per-country detail is in Country Compliance Guides .