What brings a Gulf organisation into scope
GDPR applies beyond the EU in two main situations: where an organisation offers goods or services to individuals in the EU, whether or not payment is required, and where it monitors the behaviour of individuals in the EU. It also applies where processing is carried out in the context of an EU establishment, including a branch or subsidiary.
Targeting is judged on intent, not accident. A website reachable from Europe is not enough on its own; pricing in euros, EU language options, EU shipping or delivery, and EU focused marketing are the kinds of signals that matter.
- Selling to, or marketing at, individuals located in the EU.
- Tracking EU visitors through analytics, advertising or profiling tools.
- Acting as a processor for an EU client, which brings direct obligations of its own.
- Having an EU branch, subsidiary or representative office involved in the processing.
The obligations that catch people out
For in scope organisations without an EU establishment, GDPR requires the appointment of a representative in the EU, in writing, named in privacy notices. Alongside that sit the familiar obligations that need evidence rather than intention.
- An EU representative, where the organisation has no EU establishment.
- Records of processing activities and a documented lawful basis for each purpose.
- Breach notification to the lead supervisory authority within 72 hours where required.
- Data protection impact assessments for high risk processing.
- A data protection officer where the criteria are met.
- Data subject requests answered within one month, extendable in limited cases.
Transfers into and out of the Gulf
Sending personal data from the EU to a Gulf jurisdiction is a restricted transfer. In the absence of an adequacy decision, it requires a transfer tool such as standard contractual clauses, supported by a transfer impact assessment considering local law, including government access powers.
This is where local expertise pays off. A generic assessment written from Europe tends to misread UAE or Saudi law, and an EU counterparty will often push back on it. Getting the local analysis right is usually what unblocks the contract.
Running GDPR and local law together
Most Gulf organisations should not build two programmes. The efficient structure is one set of core controls, covering inventory, lawful basis, notices, vendor management, rights handling and incident response, with a thin jurisdictional layer on top for the differences.
- One data inventory covering every jurisdiction, not one per regime.
- A basis register recording the basis relied on under each applicable law.
- One incident process with different notification clocks and recipients per regime.
- One vendor process, with jurisdiction specific clauses and transfer tools attached.
- Clear ownership, so a single accountable person sees the whole picture.
Where GDPR and GCC laws genuinely differ
The differences are narrower than they used to be, but they matter operationally. GDPR treats consent as one basis among several and sets a high bar for it; the UAE federal law leans on consent more heavily. Notification clocks differ. Saudi Arabia adds its own transfer rules and assessment triggers. DIFC and ADGM sit closest to GDPR of all the regional regimes.
Common questions
Does GDPR apply to a company based only in Dubai?
It can. If you offer goods or services to individuals in the EU or monitor their behaviour, GDPR applies regardless of where you are established, and you will likely need an EU representative.
Does having a website visible in Europe trigger GDPR?
No. Mere accessibility is not enough. What matters is whether you are targeting individuals in the EU, judged on signals such as EU currencies, languages, shipping and marketing, or whether you are tracking their behaviour.
Can we send EU personal data to the UAE or Saudi Arabia?
Yes, with a valid transfer tool. Absent an adequacy decision, that usually means standard contractual clauses plus a transfer impact assessment that looks honestly at local law, including public authority access.
If we already comply with GDPR, are we covered locally?
You are well positioned but not finished. Local regimes have their own consent expectations, notification timeframes, registration steps and transfer rules, so a gap assessment against each applicable law is still needed.