AI agent compliance in the GCC: UAE, Saudi Arabia, Qatar, Bahrain, Oman and Kuwait
Every GCC country now has a data protection law, and the UAE has three regimes of its own. AI agents that work across the region need one design that satisfies all of them. This guide lists the laws, what they mean for agents, and where your agents can run.
Which data protection laws apply to AI agents in the GCC?
The UAE PDPL, plus the DIFC and ADGM regimes for firms in those free zones; Saudi Arabia's PDPL, enforced by SDAIA since September 2024; Qatar's PDPPL; Bahrain's PDPL; Oman's PDPL; and CITRA's regulation in Kuwait. Central bank and cyber rules add sector requirements.
Updated October 2026
- United Arab Emirates
- Federal Decree-Law No. 45 of 2021 (PDPL); DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021
- Saudi Arabia
- Personal Data Protection Law (Royal Decree M/19), enforced by SDAIA since September 2024; NCA and SAMA cyber frameworks
- Qatar and Bahrain
- Qatar PDPPL (Law No. 13 of 2016); Bahrain PDPL (Law No. 30 of 2018)
- Oman and Kuwait
- Oman PDPL (Royal Decree 6/2022); Kuwait CITRA Data Privacy Protection Regulation
- In-region cloud
- UAE: Azure UAE North and Central, AWS UAE. Qatar: Azure Qatar Central, Google Cloud Doha. Saudi Arabia: Google Cloud Dammam, Oracle Jeddah. Bahrain: AWS Bahrain.
What the rules mean for AI agents
| Requirement | What it means for your AI agents |
|---|---|
| Data residency and transfers | Most GCC laws restrict transfers of personal data abroad. Host agents, vector stores and logs in-country or on-premises by default. |
| Lawful basis and purpose | Agents use personal data only for the purpose it was collected for, with consent or another lawful basis recorded. |
| Security safeguards | Each agent gets its own identity, least-privilege access, encryption, prompt-injection defences and full logging. |
| Autonomous systems | The DIFC has specific rules for personal data processed through autonomous and semi-autonomous systems. Document each agent's purpose and keep human oversight. |
| Sector rules | Map controls to CBUAE, SAMA, QCB, CBB, CBO and CBK requirements for licensed financial institutions. |
| Individual rights | Make personal data in agent memory, embeddings and logs findable, correctable and erasable. |
Nine things to have in place
- List the countries and free zones each agent operates in.
- Choose in-country hosting for every agent, store and log.
- Record the lawful basis for each agent's personal data.
- Give every agent its own identity and least-privilege access.
- Keep human approval on material actions.
- Test agents in Arabic and English against prompt injection.
- Log every agent action and tool call.
- Map controls to your central bank and cyber regulator.
- Name an owner for AI risk and review agents regularly.
From rules to agents in production
Governed agents
A four- to eight-week pilot with the controls in this guide built in.
Agentic AI development →Security and red teaming
Agent inventory, guardrails, prompt-injection testing and runtime protection.
AI security →Evidence and governance
Policies, logs and reports that answer regulators, auditors and boards.
AI governance →Frequently asked questions
Do UAE free zone companies follow the UAE PDPL?
Firms in the DIFC and ADGM follow their own data protection regimes instead. Many groups operate in more than one, so we design agents to the strictest applicable rule.
Can a Saudi company use AI hosted in the UAE?
The Saudi PDPL restricts transfers of personal data outside the Kingdom, so we default to in-Kingdom hosting for personal data and only use other regions after a transfer assessment.
Is there a GCC-wide AI law?
Not yet. Each country regulates through data protection, cyber security and sector rules, plus national AI ethics principles such as Saudi Arabia's. One well-governed design can satisfy all of them.
How do we prove control to regulators?
Keep an inventory of agents, their owners and their data; log every action; record approvals; and test regularly. That evidence answers most regulator and board questions.
Sources
- UAE Government: Data protection laws
- SDAIA: Personal Data Protection
- Usercentrics: Saudi Arabia's Personal Data Protection Law
- Saudi Central Bank (SAMA)
- OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)
This guide is general information, not legal advice. Check the official texts and take legal advice for your situation.
Talk to us about AI agent compliance in the GCC
Get a free consultation from our AI, data and security specialists. Honest advice, clear options and a reply within 6 hours.
Request a callback
Free consultation. Our team replies within 6 hours.