Indian companies moving into Dubai or Riyadh often carry DPDP and CERT-In processes with them, then find the Gulf rules work differently. Saudi Arabia's PDPL reaches Saudi residents' data processed from abroad and fines up to SAR 5 million, while Dubai splits into onshore PDPL and the DIFC's own law. This playbook explains what to set up in each market.
Step 1: work out which laws apply
Your Indian entity remains under the DPDP Act, with core duties from 13 May 2027, and under CERT-In's Directions, which already require 6-hour incident reporting and 180 days of logs in India. In Dubai, the answer depends on where you are licensed. An onshore company follows the UAE PDPL, Federal Decree-Law No. 45 of 2021. A DIFC company follows DIFC Law No. 5 of 2020. In Riyadh, the Saudi PDPL applies to processing in the Kingdom and to Saudi residents' data processed from abroad, so your Indian team may be in scope even before you open an office.
| Entity | Main law | Regulator |
|---|---|---|
| Indian company | DPDP Act 2023, DPDP Rules 2025; CERT-In Directions | Data Protection Board; CERT-In |
| Dubai mainland | UAE PDPL (Decree-Law No. 45 of 2021) | Data Office, moving to the Federal Authority for AI and Data |
| DIFC | DIFC Law No. 5 of 2020 | DIFC Commissioner of Data Protection |
| Riyadh | Saudi PDPL and Implementing Regulations | SDAIA; NCA for ECC |
Step 2: fix the lawful basis
India and onshore UAE both centre on consent. The UAE PDPL allows consent plus listed exceptions, with no general legitimate interests basis. Saudi Article 5 makes consent the default unless an exception applies. The DIFC is different: it allows legitimate interests among its lawful bases. If you set up in the DIFC, you can design some processing around legitimate interests, but document the basis for each purpose in the notice as Article 29 requires.
Step 3: register before you process
In the DIFC, file a notification of processing operations with the Commissioner and keep it current under Article 14(7). Failure to renew is reported as the most common DIFC fine. In Saudi Arabia, register on SDAIA's National Data Governance Platform where you are a public entity, mainly process personal data or process sensitive data. You will file breach reports through the same platform.
Step 4: one incident process, several clocks
Indian teams already work to CERT-In's 6-hour clock, which is the shortest in this set. Add the DPDP Rule 7 detailed report within 72 hours from May 2027, the UAE onshore duty to notify the Data Office immediately, the DIFC standard of as soon as practicable, and Saudi Arabia's 72 hours to SDAIA.
If you serve Saudi government bodies or critical infrastructure, ECC-2:2024 also applies: control 2-13-3 requires incident reports to the NCA and subcontrol 2-12-3-5 requires event logs kept for at least 12 months. CERT-In's 180-day log rule is shorter than the NCA's 12 months, so keep the longer period for systems that serve those clients.
Step 5: plan transfers between India and the Gulf
Moving data from Dubai mainland back to India needs an approved adequate country or an exception such as explicit consent or contract necessity under UAE PDPL Articles 22 and 23. From the DIFC, use adequacy, safeguards such as standard contractual clauses, or derogations under Articles 26 and 27. From Saudi Arabia, Article 29 and the Transfer Regulations allow adequacy or safeguards, with a risk assessment for safeguard-based or large sensitive transfers. In the other direction, India's Section 16 allows transfers unless the government restricts the destination.
Step 6: know the penalty exposure
Saudi Arabia's PDPL has been fully enforceable since 14 September 2024, with fines up to SAR 5 million, doubled for repeats. DIFC Schedule 2 fines are reported up to USD 100,000 per contravention, with serious contraventions uncapped. Onshore UAE fines are not yet set, since the Executive Regulations had not been issued as of mid 2026, and the Federal Authority for Artificial Intelligence and Data was announced on 14 June 2026. India's DPDP penalties reach ₹250 crore per instance from May 2027.
Step 7: the launch checklist
Before your first Gulf customer goes live, work through a short list that covers each market. Reuse what you built for DPDP where the rules match, and add country sections where they do not. XDQ Labs builds web apps, SaaS and AI agents for companies selling into India and the UAE. To check your localised policies, XDQ xAgents (https://xagents.xdqlabs.com) compares them with UAE, DIFC and Saudi rules and highlights gaps. This guide is general information, not legal advice. Confirm with a qualified lawyer.
- Map each entity to DPDP, UAE PDPL, DIFC or Saudi PDPL
- Record a lawful basis per purpose for each market
- File DIFC notification and register on SDAIA's platform where required
- Run one incident plan starting from CERT-In's 6-hour clock
- Document transfer routes between India, Dubai and Riyadh
- Check whether NCA ECC-2:2024 applies to your Saudi clients
Frequently asked questions
Does the Saudi PDPL apply to an Indian company with no Saudi office?
It can. The Saudi PDPL applies to processing of Saudi residents' personal data carried out from abroad, as well as processing inside the Kingdom. An Indian SaaS company serving Saudi users may need to comply.
Is DIFC data protection different from mainland Dubai?
Yes. Mainland Dubai companies follow the federal UAE PDPL, while DIFC companies follow DIFC Law No. 5 of 2020. The DIFC allows legitimate interests and requires a notification of processing with the Commissioner.
Which breach deadline should an Indian company expanding to the Gulf plan for?
Start from CERT-In's 6-hour reporting rule, which is the shortest. Then add the DPDP 72-hour detailed report from May 2027, the UAE onshore immediate notice, the DIFC as soon as practicable standard and Saudi Arabia's 72 hours.
Do Saudi cybersecurity controls apply to vendors?
NCA ECC-2:2024 applies to government agencies, their companies and critical infrastructure operators, and includes third-party and cloud controls. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- Nishith Desai Associates: CERT-In Directions of 28 April 2022, Nishith Desai Associates, 2022
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- Morgan Lewis: UAE establishes Federal Authority for Artificial Intelligence and Data (June 2026), Morgan Lewis, 2026
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- Baker McKenzie: DIFC regulators, enforcement priorities and penalties, Baker McKenzie
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- CMS: One year anniversary of the Saudi Personal Data Protection Law, CMS, 2024
- NCA Essential Cybersecurity Controls ECC-2:2024 (official), National Cybersecurity Authority (NCA), 2024
