Moving Personal Data Across Borders in the Gulf and Egypt: A Plain-Language Map

Organizations that operate across the Gulf and Egypt often run one data platform for several countries. Each of those countries has its own rules for personal data leaving its territory, and the United Arab Emirates has three regimes of its own. This post is a plain-language map as of October 2026. It is a starting point for a conversation with your legal advisers, not a substitute for one.

United Arab Emirates (federal law)

The UAE’s federal Personal Data Protection Law has been in force since 2 January 2022. According to law firms that track it, it allows transfers to countries with adequate protection and, without adequacy, transfers under a contract that binds the recipient to equivalent standards, with explicit consent, or where needed for a contract with the individual. The detailed rules were left to executive regulations, which had not been issued according to the latest sources we found, and the official government portal still describes the federal data regulator in the future tense. Plan on the law’s principles and watch for the regulations.

Dubai International Financial Centre and Abu Dhabi Global Market

The two financial free zones have their own data protection laws, close to the European model, and the federal law does not apply inside them. Each allows transfers to jurisdictions on its own adequacy list and otherwise under safeguards such as its standard contractual clauses or binding corporate rules. Two details often surprise people. Abu Dhabi Global Market treats a transfer to the rest of the UAE as a transfer to another jurisdiction. And it counts giving someone remote access to data as a transfer, even if the data never moves. A company present onshore and in both free zones can therefore deal with three transfer regimes in one country.

Saudi Arabia

Saudi Arabia’s Personal Data Protection Law, as amended in 2023, has been fully enforceable since September 2024, with the Saudi Data and Artificial Intelligence Authority as regulator. Its official knowledge center lists a regulation on transferring personal data outside the Kingdom, standard contractual clauses and a guideline on assessing transfer risks. According to law firms, the amended regulation allows transfers to jurisdictions the regulator finds adequate and for listed purposes, and otherwise under the regulator’s own contractual clauses, used without changes, binding common rules for corporate groups or accreditation certificates. A risk assessment is required in several cases, and no adequacy list had been published on the sources we found.

Egypt

Egypt’s Personal Data Protection Law dates from 2020 but became operational only when its executive regulations were issued in November 2025, according to law firms; we could not open an official copy. Transfers abroad need a license or permit from the Personal Data Protection Center, the individual’s explicit consent and a destination with adequate protection. The one-year period to comply ends at about the start of November 2026, so full enforcement begins now.

What the regimes share

Despite their differences, all of these regimes can be handled by one program:

1. Keep an inventory of where personal data goes, including remote access, support, backups and replicas.
2. Record a legal route for each flow: adequacy, an approved safeguard or a permit.
3. Document a risk assessment for flows that rely on safeguards, and repeat it when laws, providers or data change.
4. Be able to pause a flow when the assessment changes.

The main differences are prior approval, which Egypt requires through licenses and permits, and the form of the clauses, which Saudi Arabia requires to be used as issued.

How Bassirah can help

We help teams build the technical side of this program: data inventories, location controls in the cloud, lineage that shows where copies live, and evidence for each flow. Our white paper on data sovereignty covers the EU rules and the technical controls in depth. For the legal analysis of a specific flow, work with qualified counsel in each jurisdiction.