Gulf regulations for tech companies: Saudi Arabia, Qatar, Bahrain, Oman, Kuwait and Egypt

This is the second article in a series on what a technology company faces in different regions. The first covered the UAE; this one covers Gulf regulations and Egypt: Saudi Arabia, Qatar, Bahrain, Oman, Kuwait and Egypt. The five questions are the same: personal data, cybersecurity, financial regulators, e-invoicing and electronic signatures.

The frame is the same too. The map relies on primary sources: laws, royal and emiri decrees, ministerial decisions and regulators’ rules. Every fact was checked twice: when it was collected, and again by an independent pass on 27–28 September 2026. Where the official text is closed and a fact is known only from the press, legal commentary or unofficial publications of the text, I say so. I do not give legal opinions: the map shows which document to read, and how it applies to your company is a lawyer’s call.

Gulf regulations: what is shared and what differs

• Personal data. Every country has a general law except Kuwait. The breach-notification deadline is almost everywhere 72 hours; in Kuwait it is 24 hours for telecom and internet companies. No data protection law in the region has a general rule to keep data in the country; that comes through sector and government rules.
• Cybersecurity. The obligations are mostly addressed to government bodies and critical infrastructure, and a private tech company usually picks them up through a contract with such a customer. The exceptions are Qatar, whose national standard formally applies to any organisation, Saudi Arabia, which since late 2025 has separate controls for private companies that the NCA has sent them to, and Egypt, whose cybercrime law and its executive regulation bind every IT service provider directly. Cloud providers in Oman, and under CITRA’s framework in Kuwait, also need their own permit or licence from the regulator.
• Financial regulators. Cloud needs the regulator’s prior approval in Saudi Arabia and Qatar, and in Kuwait where sensitive data is involved; in Bahrain cloud data services only need notice after signing, and the Omani and Egyptian rules could not be located. Banks report incidents immediately (Saudi Arabia) or within an hour (Qatar, Bahrain, Kuwait).
• E-invoicing. Mandatory in Saudi Arabia and Egypt, in Oman from 2027; Qatar has only a draft law approved by the cabinet, Bahrain is voluntary, and Kuwait has no VAT.
• Electronic signatures. Recognised by law everywhere, but the registers of trust service providers are either opaque or unpublished. Only Egypt publishes its licensees as a plain list.

Personal data

Country	Law	Breach notification	Transfers abroad	Fines
Saudi Arabia	PDPL, Royal Decree M/19 of 2021, in force since 14.09.2023	SDAIA within 72 hours	For the law’s purposes, without harm to security, with adequate protection and minimal data; without adequacy only in the regulation’s listed cases, with SCCs, BCRs or a certificate	Up to SAR 5 million, up to SAR 10 million for a repeat
Qatar	Law No. 13 of 2016	Regulator and individual if serious harm is likely; 72 hours only in NCSA guidance	Free, unless it breaches the law or risks serious harm	Up to QAR 5 million
Bahrain	Law No. 30 of 2018, in force since 01.08.2019	Within 72 hours of discovery	Free to 83 listed countries (Qatar is not listed); otherwise on the law’s grounds	Administrative up to BHD 20,000, criminal up to 1 year
Oman	Royal Decree No. 6 of 2022, amended by Royal Decree No. 68 of 2026	Regulator within 72 hours	Explicit consent and a risk assessment	Up to OMR 500,000 for breaching transfer rules
Kuwait	No general law; Chapter 7 of Law No. 20 of 2014 and a CITRA regulation for telecom and internet	CITRA within 24 hours	Not prohibited by the CITRA regulation: disclose where data is held and notify the individual; the cloud framework restricts storage abroad	Under the CITRA law up to KWD 1 million; under Law No. 20 of 2014 up to KWD 20,000 and 3 years in prison
Egypt	Law No. 151 of 2020, regulation in force since 02.11.2025	PDPC within 72 hours	To a country with protection no lower than Egypt’s, with a PDPC licence and the individual’s consent	Up to EGP 5 million and imprisonment

Saudi Arabia. The PDPL came into force on 14 September 2023, and the one-year compliance period ended in September 2024. SDAIA supervises it. Royal Decree M/148 abolished universal registration of controllers with an annual fee: registration in the national register is now mandatory for government bodies, for companies whose main business is processing personal data, and for those processing sensitive data. SDAIA is notified of an incident within 72 hours, and reporting to the NCA runs separately. Transfers abroad are allowed only for the purposes listed in the law and regulations, provided they do not harm national security, the protection level is no lower than Saudi Arabia’s and the data are kept to the minimum. Without adequate protection, data may go abroad only in the cases listed in the transfer regulation (such as central processing within a multinational group, a one-off limited transfer, a service to the individual, or research) and with safeguards: standard contractual clauses, binding corporate rules or a certificate, plus a risk assessment. Fines go up to SAR 5 million and may be doubled for a repeat, to SAR 10 million; disclosing sensitive data to cause harm or gain a benefit is punishable by up to two years in prison, a fine of up to SAR 3 million, or both.

An important detail on localisation. In the updated version of the NCA’s Essential Cybersecurity Controls (ECC-2:2024), the requirement to keep information only in the Kingdom was removed and handed to the NDMO at SDAIA: questions about data storage now go there. For entities under the ECC (government bodies, their companies and critical infrastructure), the requirement stays that contractors’ managed monitoring centres using remote access be fully located in the Kingdom.

Qatar. Law No. 13 of 2016 expressly forbids a controller to restrict cross-border data flows, except where processing breaches the law or risks serious harm. The regulator’s functions are performed by the National Cyber Security Agency (NCSA). The law requires notifying the regulator and the individual of a breach where serious harm is likely, with no deadline; the 72 hours appear only in NCSA guidance. Special-nature data, including children’s and health data, may be processed only with the regulator’s permission. The QFC financial centre has its own regime, with breach notification within 72 hours where feasible and fines up to USD 1.5 million.

Bahrain. Before starting automated processing the controller notifies the regulator on the form on its website (exceptions: its own employees’ data, an appointed Data Protection Guardian, non-profits and public registers), and processing without notice is a criminal offence. Prior written permission is needed for sensitive data processed without consent to protect a person unable to consent, biometrics used for identity verification, genetic data outside medical establishments, linking different controllers’ databases kept for different purposes, and video surveillance, with a decision within 30 days where silence means refusal. Data may leave the country freely for 83 countries on the regulator’s list, which includes the UAE, Saudi Arabia, Egypt, Russia and Kazakhstan but not Qatar. A foreign company that processes data using means in Bahrain appoints a representative there.

Oman. The executive regulation has applied in full since February 2026. Since 7 September 2026, Royal Decree No. 68 of 2026 has been in force: the law now reaches outside the country, only a legal entity can be a controller, and a contract, a legal obligation and public availability of the data no longer take processing outside the law; they now only waive the consent requirement. I checked the decree against an unofficial publication of the text on Qanoon.om: the Official Gazette site is unavailable, and as of late September 2026 the English text on the ministry’s website does not include these amendments. Transfers abroad need the individual’s explicit consent and a documented risk assessment, and storing sensitive data abroad also needs the Cyber Defence Centre’s approval. Government bodies must process personal data only in Oman.

Kuwait has no general data protection law. Companies and government bodies are bound by the general rules in Chapter 7 of Law No. 20 of 2014 on Electronic Transactions: personal data in electronic systems may not be collected unlawfully or without consent, disclosed without a legal basis or used for another purpose, on pain of up to 3 years in prison, a fine of up to KWD 20,000, or both. There is also a CITRA data privacy regulation, but it covers only telecom and internet licensees and online content providers. For them, CITRA is notified of a breach within 24 hours. CITRA’s cloud framework forbids cloud customers to store high-classification data abroad, and one of its clauses covers personal data in general. Yet the classification policy those levels rest on was repealed in February 2024.

Egypt deserves special attention because of the date. The executive regulation of Law No. 151 of 2020 has been in force since 2 November 2025, and the transition year runs to around 1–2 November 2026. According to the PDPC’s guidance, processing without a licence after that date is a violation. Instead of registration Egypt has licensing: a licence for ongoing processing is issued for three years, and the fee depends on the number of records, reaching EGP 2 million for three years. Transfers abroad, including cloud servers outside Egypt, need a separate licence and the individual’s consent. A foreign controller appoints a representative in Egypt, and a legal entity appoints a DPO and registers them with the PDPC.

Cybersecurity

Saudi Arabia is the densest jurisdiction here. The NCA’s Essential Cybersecurity Controls ECC-2:2024 are mandatory for government bodies, their companies, and private organisations that own, operate or host critical national infrastructure. On 28 December 2025 the NCA issued separate controls, NCNICC-1:2025, for private companies without such infrastructure. They bind those to which the NCA has sent them: 65 controls for large companies (more than 250 full-time employees, or annual revenue above SAR 200 million) and 26 for companies with 6 to 249 employees or revenue of SAR 3 to 200 million. The act on the NCA’s legal powers (Royal Decree M/117 of 22 December 2024) lets it fine up to SAR 25 million and suspend or revoke licences. Since 1 August 2022, any organisation offering cybersecurity services in the Kingdom must register on the NCA platform, and managed security operations centres are licensed. For contracts with third parties, the ECC require a confidentiality agreement, secure data deletion and an incident communication procedure.

Qatar. The national NIA standard, version 2.1 of May 2023, by its own text applies to all organisations in the country, and its baseline controls are mandatory for assets above classification level zero; its requirements extend to contractors and their subcontractors. Any organisation reports critical incidents to the NCSA within two hours. Certification against the standard stays voluntary, and a critical infrastructure law and mandatory licensing of security providers exist so far only as goals in the 2024–2030 strategy.

Bahrain. Since July 2025 the National Cyber Security Center has had the power to set mandatory policies and standards. Critical infrastructure sectors are defined: energy, finance, ICT, health, government services, industry and transport. But the cabinet decision listing the specific organisations had not been published as of late September 2026.

Oman. The Cyber Defence Centre under the Internal Security Service requires “concerned organisations”, public and private ones connected with its remit, to report risks and intrusions immediately, follow its standards and get its consent before storing sensitive data abroad. Under the TRA regulation in force since 30 September 2024 (I could not find the official text; this follows an unofficial publication of the text on Qanoon.om), cloud services and data centres need a TRA permit. A provider notifies customers of a breach within 72 hours, the TRA within 12 hours of any incident or fault affecting its services, and the TRA and the Cyber Defence Centre within the same 12 hours of a breach or leak affecting level 3–4 content, data of more than 30% of subscribers or a large group of people in Oman. High-level content may leave the country only with the TRA’s consent.

Kuwait. According to press reports, in April 2026 the National Cyber Security Center introduced national baseline controls by Decision No. 2/2026 as a mandatory minimum, with deadlines set in the decision itself and an annual self-assessment. The decision was published in Kuwait Al-Youm No. 1785 of 5 April 2026, but its text is available only after registration, so I do not know the deadlines. For cloud, CITRA still publishes its 2021 framework: a provider hosting level 3 and 4 data gets a licence and must have a data centre in Kuwait. But CITRA repealed the data classification policy that defines these levels in February 2024, so how the framework applies now is worth checking with the regulator.

Egypt. Cybercrime Law No. 175 of 2018 requires service providers to keep system logs for 180 days, with fines of EGP 5 to 10 million for a breach. The law defines a service provider broadly, and by interpretation that covers hosting and cloud. The executive regulation sets minimum measures for all IT service providers, from encryption of at least AES-128 to an annual test for intrusions and security risks, and stricter ones for critical infrastructure operators, which report incidents to EG-CERT as soon as they are discovered.

Financial regulators

Regulator	Cloud and outsourcing	Incidents	Data
SAMA (Saudi Arabia)	Approval before public or hybrid cloud and material outsourcing	Medium and high immediately	Cloud in the Kingdom; abroad with explicit approval
QCB (Qatar)	Approval before any cloud contract	Banks: critical within 1 hour	Personal and financial data only in Qatar; exceptions only with QCB approval
CBB (Bahrain)	Outsourcing to a third party abroad: approval, application 30 days ahead; cloud data services: notice within 5 business days after signing	Call within an hour, first part of the report within 2 hours	No hard localisation for cloud; records must be accessible from within Bahrain
CBK (Kuwait)	Approval a month before a cloud contract touching sensitive data	High within 1 hour, medium within 4 hours	CORF sets no Kuwait-only storage rule; the cloud policy must cover data residency requirements and the application states where data are stored
CBO (Oman)	The cloud (BM 1185) and cyber resilience (BM 1194) circulars could not be located	No data	Open banking: data leaves only with CBO approval and customer consent
CBE (Egypt)	The cybersecurity framework is not published	Through EG-FinCIRT, deadlines not published	No data

SAMA. The 2017 Cyber Security Framework is mandatory for banks, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure, with maturity level 3 as the minimum. Public and hybrid cloud services may be used only after approval, in principle only in the Kingdom, and the contract with the provider grants audit rights and forbids secondary use of data. Banks get written no-objection for material outsourcing, and for any outsourcing abroad they must justify why it cannot be done in the country. New: a circular of 27 August 2026 on quantum risks requires an inventory of all cryptographic assets, including third-party dependencies, by the end of 2026, and a quantum risk assessment by the end of Q1 2027.

QCB. The cloud regulation has applied since 15 April 2024 to all organisations supervised by Qatar’s central bank: personal and financial data are processed only in Qatar, approval is needed before any cloud contract, and the register of contracts is disclosed every year. Banks report critical incidents within an hour and run at least two penetration tests a year.

CBB. Bahrain is softer than its neighbours: for banks, outsourcing to a third party abroad needs approval with an application 30 days ahead, while cloud data services only need a notice within five business days of signing. Its incident and testing rules for banks match the strictest in the region: a call to the central bank within an hour, the first part of the report within two hours, penetration tests at least twice a year.

CBK. Since 3 December 2025 the Cyber and Operational Resilience Framework has applied to all supervised organisations, with no transition period. A cloud contract for a service that touches sensitive data must be approved at least a month before signing, and the provider must hold a cloud certification and a SOC 2 Type II report or equivalent. High-severity incidents are reported within an hour, medium within four.

Oman and Egypt. Egypt’s central bank has not published its cybersecurity framework, and the texts of the Omani central bank’s key circulars could not be located, so the picture is incomplete. What is known: Egypt’s central bank licensing rules for payment operators and providers (June 2025) also apply to those serving Egyptian residents from abroad; the one-year window for existing providers to apply ran out in June 2026.

E-invoicing

Country	Status	Model	Next dates
Saudi Arabia	Mandatory since 04.12.2021	Clearance for B2B and B2G, B2C reported within 24 hours, Fatoora platform	Wave 25 integrates by 01.02.2027
Egypt	Mandatory for all taxpayers since 15.12.2022	Central validation of every document on the ETA platform	B2C e-receipts roll out in phases
Oman	Decision No. 189 of 2026	Five-corner Peppol model through accredited providers	01.04.2027 and 01.10.2027
Qatar	Draft law approved by the cabinet on 06.05.2026	Not announced	Not announced
Bahrain	Voluntary	Free format	No mandate announced
Kuwait	No VAT	Not applicable	None

Saudi Arabia. Resident taxpayers are obliged; non-residents do not have to issue e-invoices. Once a company is onboarded to the second phase, standard invoices for business and government go through clearance: the tax authority ZATCA validates the invoice and applies a cryptographic stamp before it reaches the buyer. Simplified invoices for consumers are reported to ZATCA within 24 hours. The format is XML on UBL 2.1, and a QR code is mandatory. Before onboarding the first phase applies: no set format, no clearance, and a QR code only on simplified invoices. The second phase onboards companies in waves by revenue: wave 25, taxable revenue above SAR 187,500 in any year from 2022 to 2025, integrates by 1 February 2027, and as of late September 2026 no further waves have been announced. ZATCA’s guideline says a resident’s computer or server holding the records must be in the Kingdom, although the VAT Implementing Regulations as amended in 2021 only require access to the server through an access point in the Kingdom.

Egypt. Since 15 December 2022 e-invoicing has been mandatory for all taxpayers. Every document is validated on the ETA tax platform and signed with an electronic seal. Since 1 April 2023, VAT deduction and expense recognition have accepted only e-invoices, and a company without e-invoicing is barred from import and export. For consumers, e-receipts are being introduced in parallel.

Oman. Tax Authority Decision No. 189 of 2026 was published on 9 August; I summarise it according to an unofficial publication of the text on Qanoon.om. From 1 April 2027 e-invoicing is mandatory for VAT payers with supplies above OMR 5 million a year, from 1 October 2027 for the rest. The model is the same as in the UAE: Peppol, accredited providers, data in parallel to the tax authority. B2B is transmitted in real time, B2C within 24 hours, and PDF or paper does not count as an electronic tax invoice.

Kuwait. There is no VAT, but Decree-Law No. 10 of 2026 on digital commerce, according to an unofficial publication of the text (the official gazette is available only after registration), will oblige online sellers to send the buyer an electronic invoice in Arabic. It is a commercial rule, not a tax one, and the law counts companies buying online as consumers too. It takes effect only a month after its executive regulation is published, which is expected by spring 2027.

Electronic signatures

Saudi Arabia is the strictest. Under the 2024 regulation a signature or seal is valid only if it is linked to a certificate from the national centre NIC or a provider licensed by the DGA, and only if all six conditions of the regulation are met. A trust service provider keeps its head office, all systems and servers in the Kingdom and, without the DGA’s prior written consent, serves only inside the country, under a five-year licence. Individuals have been able to sign through the IBRAM platform since February 2025. Foreign certificates are recognised by the DGA, but I found no published list of recognised bodies.

Qatar. The 2010 law recognises a signature created abroad if its reliability is no lower than required. Since 2019 the electronic form is unavailable only for family and personal status documents and negotiable commercial instruments. Which body licenses providers today could not be confirmed from primary sources.

Bahrain. The 2018 law has no list of excluded transactions: only an express prohibition in another law rules out the electronic form. A secure signature with a certificate from an accredited provider carries presumptions of authorship and integrity. By law a foreign provider with no presence in Bahrain can be accredited, but only for services covered by a TRA regulation; I found neither such a regulation nor a list of accredited providers.

Oman. A new Electronic Transactions Law has been in force since 14 April 2025: three types of signature and ministry licensing of trust services. There is no executive regulation, so licensing and recognition of foreign certificates do not work yet. The law expressly allows contracts concluded by automated agents.

Kuwait. On 2 November 2025, Decree-Law No. 148 removed the list of exclusions from the Electronic Transactions Law, and Decree-Law No. 147, according to press reports and legal commentary (the official gazette is subscription-only), allowed appearing before a notary by video. The law leaves the licensing of certificate providers to a body the state is to designate, and there is no list of licensees.

Egypt. Provided the law’s conditions are met (the signature is linked only to the signer, under the signer’s sole control, and any change can be detected), in civil, commercial and administrative dealings a signature has the same evidential force as a handwritten one. Certificates are issued by ITIDA licensees, and Egypt is the only country in the region that publishes them as a list: per ITIDA’s page as of June 2026, four companies plus GOV-CA for government bodies. The same electronic seal signs e-invoices for the tax authority.

Calendar

• 07.09.2026: amendments to Oman’s data protection law came into force.
• Around 01–02.11.2026: Egypt’s transition year ends; under the PDPC’s guidance, processing without its licence is a violation after that.
• 31.12.2026: financial institutions supervised by SAMA complete the cryptography inventory.
• 01.02.2027: wave 25 of e-invoicing in Saudi Arabia.
• 31.03.2027: quantum risk assessment for SAMA-supervised institutions.
• 01.04.2027 and 01.10.2027: e-invoicing in Oman for large and remaining VAT payers.
• No date announced: Qatar’s e-invoicing law, Bahrain’s critical infrastructure list, the executive regulation of Oman’s Electronic Transactions Law, new NCA rules on incidents and licensing in Saudi Arabia.

Where a tech company should start

1. Check Egypt first. If you process data of people in Egypt, the PDPC licence question is urgent: the transition year runs to around 1–2 November 2026.
2. Settle storage for Saudi Arabia. Cloud for SAMA-supervised financial institutions (abroad only with SAMA’s explicit approval), residents’ servers holding tax records under ZATCA’s guideline and, for government bodies and critical infrastructure, contractors’ monitoring centres with remote access must be in the Kingdom; for general data storage, look at the NDMO’s requirements now.
3. Find out whether the NCA has sent you its controls. Private companies without critical infrastructure receive NCNICC from the NCA, with 26 or 65 controls.
4. For Qatar, treat the NIA standard as yours. It formally applies to any organisation in the country, and critical incidents are reported within two hours.
5. For financial customers, budget time for approvals. In Saudi Arabia, Qatar and Kuwait cloud contracts are approved by the regulator in advance (in Kuwait a month ahead if the service touches sensitive data); in Bahrain, a notice to the central bank within five business days of signing is enough for cloud data services.
6. Put e-invoicing in the plan. It is already mandatory in Saudi Arabia and Egypt, and mandatory in Oman from 2027.

What I do not do

• I do not give legal opinions. The map shows documents and articles; how they apply to a specific company is for a lawyer in that country to judge.
• I do not pass off press releases as law. Where the primary source is closed and a fact is known from the press, the text says so.
• I do not promise the map will not age. Many decisions in the region are still in progress; reread it before you decide anything.

Frequently asked questions

Do data have to be stored in Saudi Arabia?

The data protection law has no direct requirement, and the NCA’s Essential Cybersecurity Controls removed the requirement to keep information in the Kingdom and handed it to the NDMO at SDAIA. Mandatory in-country storage remains in specific areas: cloud for SAMA-supervised financial institutions (abroad only with SAMA’s explicit approval), residents’ tax records (under ZATCA’s guideline), remote security monitoring centres of government bodies and critical infrastructure.

How quickly must a personal data breach be reported?

In Saudi Arabia, Bahrain, Oman and Egypt within 72 hours. In Qatar the law sets no deadline; 72 hours appear in the regulator’s guidance. In Kuwait, telecom and internet companies have 24 hours.

What changes in Egypt from November 2026?

The transition year after the data protection law’s executive regulation came into force runs to around 1–2 November 2026. According to the PDPC’s guidance, processing without its licence after that date is a violation.

Where is e-invoicing already mandatory?

In Saudi Arabia since December 2021 and in Egypt for all taxpayers since December 2022. In Oman from 1 April 2027 for large VAT payers and from 1 October 2027 for the rest. Qatar has only a draft law, and in Bahrain e-invoicing is voluntary.

Do Qatar’s cybersecurity requirements apply to private companies?

Formally, yes. By its own text the national NIA standard version 2.1 applies to all organisations in Qatar, and its baseline controls are mandatory for assets above classification level zero, although the document calls itself primarily a guidance resource. Any organisation reports critical incidents to the NCSA within two hours.

Are foreign electronic signatures recognised?

The laws of all six countries provide for recognition, but working mechanisms are published almost nowhere. In Qatar a signature created abroad is valid if it is no less reliable; in Saudi Arabia foreign certificates are recognised by the DGA, but there is no list of recognised bodies.

Sources

• Saudi Personal Data Protection Law, Bureau of Experts portal, and its implementing regulation, SDAIA.
• NCA ECC-2:2024 and NCA registration and licensing.
• SAMA Cyber Security Framework, SAMA Rulebook.
• ZATCA E-invoicing Regulation and wave 25 criteria.
• Saudi Electronic Transactions Law.
• Qatar Law No. 13 of 2016, Al Meezan, and the QCB Cloud Computing Regulation.
• Bahrain Law No. 30 of 2018 and the regulator’s orders and CBB Rulebook, OM module.
• Oman Personal Data Protection Law, MTCIT; unofficial publications of Royal Decree No. 68 of 2026 on Qanoon.om and its English translation on Decree.om; Decision No. 189 of 2026 on e-invoicing, Qanoon.om (unofficial publication).
• CITRA Data Privacy Protection Regulation, version 2.5 (Arabic only), Kuwait Law No. 20 of 2014 on Electronic Transactions (Arabic) and CBK Cyber and Operational Resilience Framework.
• PDPC guidelines on licences and permits, digital signature in Egypt, ITIDA, and e-invoicing, ETA.

Need a consultation?

If you are entering the Gulf or Egypt, book a call. We will work out which regimes apply to your company and your customers and which of them should shape the architecture and the choice of cloud region. The UAE is covered in detail in the first article of the series.