# AI agent compliance in the GCC: UAE, Saudi Arabia, Qatar, Bahrain, Oman and Kuwait Every GCC country now has a data protection law, and the UAE has three regimes of its own. AI agents that work across the region need one design that satisfies all of them. This guide lists the laws, what they mean for agents, and where your agents can run. ## Key facts - **United Arab Emirates:** Federal Decree-Law No. 45 of 2021 (PDPL); DIFC Data Protection Law No. 5 of 2020; ADGM Data Protection Regulations 2021 - **Saudi Arabia:** Personal Data Protection Law (Royal Decree M/19), enforced by SDAIA since September 2024; NCA and SAMA cyber frameworks - **Qatar and Bahrain:** Qatar PDPPL (Law No. 13 of 2016); Bahrain PDPL (Law No. 30 of 2018) - **Oman and Kuwait:** Oman PDPL (Royal Decree 6/2022); Kuwait CITRA Data Privacy Protection Regulation - **In-region cloud:** UAE: Azure UAE North and Central, AWS UAE. Qatar: Azure Qatar Central, Google Cloud Doha. Saudi Arabia: Google Cloud Dammam, Oracle Jeddah. Bahrain: AWS Bahrain. ## What the rules mean for AI agents - **Data residency and transfers:** Most GCC laws restrict transfers of personal data abroad. Host agents, vector stores and logs in-country or on-premises by default. - **Lawful basis and purpose:** Agents use personal data only for the purpose it was collected for, with consent or another lawful basis recorded. - **Security safeguards:** Each agent gets its own identity, least-privilege access, encryption, prompt-injection defences and full logging. - **Autonomous systems:** The DIFC has specific rules for personal data processed through autonomous and semi-autonomous systems. Document each agent's purpose and keep human oversight. - **Sector rules:** Map controls to CBUAE, SAMA, QCB, CBB, CBO and CBK requirements for licensed financial institutions. - **Individual rights:** Make personal data in agent memory, embeddings and logs findable, correctable and erasable. ## Readiness checklist - List the countries and free zones each agent operates in. - Choose in-country hosting for every agent, store and log. - Record the lawful basis for each agent's personal data. - Give every agent its own identity and least-privilege access. - Keep human approval on material actions. - Test agents in Arabic and English against prompt injection. - Log every agent action and tool call. - Map controls to your central bank and cyber regulator. - Name an owner for AI risk and review agents regularly. ## FAQ ### Do UAE free zone companies follow the UAE PDPL? Firms in the DIFC and ADGM follow their own data protection regimes instead. Many groups operate in more than one, so we design agents to the strictest applicable rule. ### Can a Saudi company use AI hosted in the UAE? The Saudi PDPL restricts transfers of personal data outside the Kingdom, so we default to in-Kingdom hosting for personal data and only use other regions after a transfer assessment. ### Is there a GCC-wide AI law? Not yet. Each country regulates through data protection, cyber security and sector rules, plus national AI ethics principles such as Saudi Arabia's. One well-governed design can satisfy all of them. ### How do we prove control to regulators? Keep an inventory of agents, their owners and their data; log every action; record approvals; and test regularly. That evidence answers most regulator and board questions. ## Sources - [UAE Government: Data protection laws](https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws) - [SDAIA: Personal Data Protection](https://sdaia.gov.sa/en/Research/Pages/DataProtection.aspx) - [Usercentrics: Saudi Arabia's Personal Data Protection Law](https://usercentrics.com/knowledge-hub/saudi-arabia-personal-data-protection-law-pdpl/) - [Saudi Central Bank (SAMA)](https://www.sama.gov.sa/en-US/Pages/default.aspx) - [OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)](https://genai.owasp.org/llm-top-10/)