The address on your license changes the rules
A financial firm in DIFC and a retailer a short drive away on mainland Dubai can use the same software and answer to different data laws. In Abu Dhabi, sending data from an ADGM company to its mainland partner counts as a transfer out, with rules to follow. Across a border, the differences grow: Bahrain starts from a ban on sending personal data abroad, while Qatar's law mainly stops controllers from restricting it.
So a shared system for a Gulf group isn't one decision. Where it's hosted, which AI services it can use and how invoices leave it can all change from one company in the group to the next.
The rules, side by side
| Where | Data law | Sending data abroad | AI rules | E-invoicing |
|---|---|---|---|---|
| UAE, mainland and most free zonesUTC+4 | Federal Decree-Law No. 45 of 2021 on personal data | Allowed under conditions in the law. The practical detail depends on regulations yet to be seen. | The UAE Charter for the Development and Use of AI (2024) sets principles. It is a policy, not a statute. | Mandatory from January 1, 2027 for revenue of AED 50 million or more, and July 1, 2027 for others, through accredited providers. |
| Dubai International Financial Centre (DIFC)UTC+4 | DIFC Law No. 5 of 2020 and the DIFC Data Protection Regulations | Allowed to places the Commissioner lists as adequate. Otherwise safeguards are needed, and standard clauses are published for that. | Binding: Regulation 10 covers systems, including AI, that process personal data with some autonomy. Users must be told, and high-risk processing needs an Autonomous Systems Officer. Changes were proposed in June 2026. | See the UAE entry. |
| Abu Dhabi Global Market (ADGM)UTC+4 | ADGM Data Protection Regulations 2021 | Any transfer out of ADGM must follow the rules, using an adequacy decision, safeguards or an exception. Sending data to onshore UAE counts as a transfer out. | We found no binding AI-specific rule. The regulator's guidance uses AI examples to show how the data rules apply. | See the UAE entry. |
| Saudi ArabiaUTC+3 | Personal Data Protection Law (Royal Decree M/19, as amended) | Allowed with an adequacy decision or approved safeguards, or under narrow exceptions, sometimes with a risk assessment. | National AI ethics principles and generative AI guidelines. These are guidance, not a statute. | In force, and rolling out in waves. Wave 25 covers revenue above SAR 187,500, with integration due by February 1, 2027. Invoices must be in Arabic. |
| QatarUTC+3 | Law No. 13 of 2016 on personal data privacy, with separate regulations inside the Qatar Financial Centre | Unusually, the law mainly bars controllers from limiting cross-border data flows, unless the processing breaks the law or could cause serious harm. | We found no AI statute. The Qatar Financial Centre's data office publishes an AI framework that applies its regulations to AI. | A draft law was approved by the Cabinet on May 6, 2026. We found no start date yet. |
| KuwaitUTC+3 | Data Privacy Protection Regulation, CITRA Resolution No. 26 of 2024 | Please check the regulation directly with your lawyer. | We found no AI law. | We found no e-invoicing mandate. |
| BahrainUTC+3 | Law No. 30 of 2018 on personal data protection | Banned unless the destination is on the Authority's adequate list, the Authority authorizes it, or an exception such as the person's consent applies. | A national AI policy and the GCC ethics manual. AI use stays subject to existing laws. A proposed AI law is not in force. | We found no official e-invoicing mandate. |
| OmanUTC+4 | Personal Data Protection Law (Royal Decree 6/2022), with Ministerial Decision 34/2024 | The Executive Regulation sets controls and conditions for moving personal data abroad. | A national policy on the safe and ethical use of AI (2025). We found no AI statute. | Fawtara applies from April 1, 2027 to supplies over OMR 5 million, and from October 1, 2027 to everyone else. |
Who each one covers
UAE, mainland and most free zones
In force since January 2, 2022. When we checked, we could not find its detailed executive regulations published, so check their status with your lawyer.
Companies handling personal data of people in the UAE by electronic means, including companies based abroad. Government data and sectors with their own data laws are carved out.
Working week. Federal government: Monday to Thursday, plus a half day on Friday. Private employers set their own.
Dubai International Financial Centre (DIFC)
In force, with its own Commissioner of Data Protection.
Companies registered in the DIFC and, in some cases, processing connected to them. A company on mainland Dubai generally falls under the federal law instead.
Abu Dhabi Global Market (ADGM)
In force, with its own Office of Data Protection.
Companies established in ADGM, on Al Maryah and Al Reem islands. A company elsewhere in Abu Dhabi generally falls under the federal law instead.
Saudi Arabia
Fully enforced since September 14, 2024, by the Saudi Data and AI Authority.
Anyone processing personal data of people in the Kingdom, including organizations abroad. Purely personal or family use is excluded.
Working week. Government: Sunday to Thursday.
Qatar
In force. The National Cyber Security Agency oversees it, and the Qatar Financial Centre has its own data office.
Those handling personal data in Qatar outside the Qatar Financial Centre. Firms registered in the Centre follow its regulations.
Law No. 13 of 2016 (National Cyber Security Agency copy) Qatar News Agency on the Cabinet decision
Kuwait
In force, issued by the telecom regulator. We found no general personal data law.
At least companies licensed by the regulator. Check with your lawyer whether it reaches yours.
Bahrain
In force, overseen by the Personal Data Protection Authority.
Organizations handling personal data in Bahrain.
Oman
In force, overseen by the Ministry of Transport, Communications and Information Technology.
Those handling personal data in Oman. Government bodies follow stricter rules of their own.
Oman's Ministry on the regulation Oman Tax Authority on e-invoicing
What this means for a software project
- List every company in your group and where it is registered, including free zones.
- Map what personal data each system holds, and which countries it moves between.
- Check any AI service against those limits before you choose it: where it runs matters as much as what it costs.
- Note your e-invoicing dates, and work back from them, leaving time to test with real invoices.
Gulf data and AI law questions
Does a DIFC company follow the UAE federal data law?
Generally not. DIFC has its own data law and Commissioner, and ADGM has its own regulations and office. A group with companies in several places may need to follow more than one set of rules, so confirm with your lawyer.
Is there an AI law in the UAE?
We found no general federal AI statute. The UAE has a national AI charter setting out principles. Inside DIFC, Regulation 10 sets binding rules for AI and other autonomous systems that process personal data.
Is there an AI law in Saudi Arabia?
We found no AI statute in force. The Saudi Data and AI Authority publishes ethics principles and generative AI guidelines, and the Personal Data Protection Law applies when AI handles personal data.
Can personal data leave the Gulf?
It depends on the country. Saudi Arabia and DIFC allow it through set legal routes, Bahrain bans it unless an exception applies, and Qatar's law mainly limits restrictions on data flows. Check your own case with your lawyer.
When does e-invoicing start?
Saudi Arabia is already rolling it out in waves. The UAE starts on January 1, 2027 for revenue of AED 50 million or more and July 1, 2027 for others. Oman starts on April 1, 2027 for the largest businesses and October 1, 2027 for the rest. We found no start date yet for Qatar.
Is this legal advice?
No. It is general information to help you ask the right questions. Rules change quickly, so confirm what applies with your lawyer.
Building software for the Gulf?
Tell us where your companies are registered and what you need to build. We will plan it around the rules that apply, alongside your lawyer.