A single privacy policy can serve India and the Gulf if it covers the strictest version of each clause. India's DPDP Act requires an itemised notice and a 90-day grievance process, Saudi Article 12 requires a policy before collection, Bahrain whitelists 83 countries for transfers and Oman needs a public DPO contact. This checklist lists the clauses a policy needs and which laws demand each one.
How to use this checklist
Each section below is a clause your policy should contain, with the laws that require it. Where a rule is unique to one country, add a short country section rather than weakening the main text. The DPDP duties apply from 13 May 2027. The GCC laws covered here are already in force, though onshore UAE fines are still to be set.
1. Who you are and what you collect
Identify the controller, describe the processing and list the purposes and recipients. Saudi PDPL Article 12 requires a privacy policy before collection, the DIFC law sets notice contents in Articles 29 and 30, and Oman and Qatar require notice before processing. For India, Section 5 and Rule 3 require an itemised list of personal data mapped to each purpose, a standalone plain-language notice and an option to read it in English or an Eighth Schedule language.
2. Lawful basis and consent
State the lawful basis for each purpose. DIFC Article 29 requires this, the UAE PDPL Articles 4 to 6 allow consent plus listed exceptions with no general legitimate interests, and Saudi Article 5 makes consent the default. Explain how to withdraw consent. India's Section 6(4) requires withdrawal to be as easy as giving consent, Bahrain's Resolution No. 48 of 2022 allows withdrawal at any time without cost, and Oman requires express, provable written consent.
3. Rights and how to use them
Every regime here gives rights of access and of correction and erasure. Most GCC regimes add objection, restriction and portability, and the DIFC, ADGM and UAE address automated decisions. India adds the right to nominate under Section 14. Give one route for all requests and state response times where the law sets them, such as one month for DIFC access requests and 30 days in Qatar's guidelines. In the table, Not listed means the right did not appear in the research behind this guide.
| Clause | India | UAE / DIFC / ADGM | Saudi | Qatar | Bahrain | Oman |
|---|---|---|---|---|---|---|
| Access and copy | Yes | Yes | Yes | Yes | Yes | Yes |
| Correction and erasure | Yes | Yes | Yes | Yes | Yes | Yes |
| Objection or restriction | Not listed | Yes | Not listed | Yes | Yes | Not listed |
| Portability | Not listed | Yes | Yes | Not listed | Not listed | Yes |
| Nomination | Yes (Section 14) | Not listed | Not listed | Not listed | Not listed | Not listed |
4. Retention and security
State how long each category is kept and that data is deleted or anonymised when no longer needed (Saudi Article 18, DIFC Article 22). For India, Rule 8 requires at least 48 hours' notice before erasure where it applies, at least one year of log retention, and a three-year limit for large e-commerce, social media and online gaming platforms. Describe security measures such as encryption, access control, logging and backups. DPDP Section 8(5) and Rule 6, Saudi Article 19 and Qatar Article 13 all require safeguards.
5. Breaches, transfers and vendors
Commit to notifying regulators and individuals within each deadline: 72 hours for the DPDP detailed report, SDAIA, ADGM, Qatar, Bahrain and Oman; immediately for onshore UAE; as soon as practicable for the DIFC. Disclose transfers and the basis for each: India's Section 16 restrictions, UAE Articles 22 and 23, DIFC Articles 26 and 27, Saudi Article 29, Bahrain's 83-country whitelist and Oman's explicit consent. State that processors act only under binding written contracts.
6. Special data, children, marketing and cookies
Identify any sensitive data and the safeguards applied, and confirm any regulator approvals in Qatar, Bahrain and Oman. For children, state that India requires verifiable parent consent for under 18s and bans tracking and targeted ads at children, and that Qatar and Oman require parental consent.
Say that marketing is sent only with prior consent and has an unsubscribe route. Explain cookies and how to refuse non-essential ones. No dedicated cookie law was verified in these countries, and Bahrain treats consent forced as a condition of browsing as invalid.
7. Contacts, grievances and regulator filings
Publish DPO or contact details: Rule 9 in India, mandatory DPO details in Oman, and DPO contacts where required in the UAE, DIFC, ADGM and Saudi Arabia. For India, describe the grievance process, the 90-day limit and the right to complain to the Data Protection Board. Confirm regulator registrations where relevant, such as the DIFC notification of processing, the ADGM annual notification and SDAIA's National Data Governance Platform.
Checking your draft
Read your policy against each numbered section and mark any clause that is missing or only partly covered. Then check that the product and back office actually do what the policy says. XDQ Labs built XDQ xAgents (https://xagents.xdqlabs.com) to make this check faster: it compares a published policy against India and GCC rules and lists missing clauses for a reviewer. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
Can one privacy policy cover India and the GCC?
Yes, if it meets the strictest version of each clause and adds short country sections for unique rules, such as India's nomination right, Bahrain's transfer whitelist and Oman's mandatory DPO details.
Is a privacy policy mandatory in Saudi Arabia?
Yes. Article 12 of the Saudi PDPL requires a privacy policy to be made available before personal data is collected. It should cover the controller, purposes, recipients, retention and data subject rights.
Do GCC countries have cookie laws?
No dedicated cookie law was verified in the countries covered here, and DLA Piper confirms none in Saudi Arabia, so general notice and consent rules apply. Bahrain treats consent required as a condition of browsing as invalid.
What must an Indian privacy policy include under DPDP?
An itemised notice of data and purposes, withdrawal, rights, grievance and Board complaint routes, and published DPO or contact details. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Digital Personal Data Protection Act, 2023 (India Code), India Code, Legislative Department, 2023
- Khaitan & Co ERGO: Digital Personal Data Protection Rules (15 November 2025), Khaitan & Co, 2025
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- CMS: ADGM Data Protection Regulations, what businesses need to know, CMS
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Squire Patton Boggs: Qatar's new Protection of Personal Data Privacy Law, Squire Patton Boggs, 2017
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
