Cyber security and data protection regulation in Saudi Arabia and Qatar: an overview

Organisations expanding into the Gulf, or supplying services to government bodies, banks and critical infrastructure operators there, often meet national cyber security and data protection requirements that differ from the UK, EU and US frameworks they already know. In both Saudi Arabia and Qatar, the requirements that apply depend heavily on the type of entity: government bodies, operators of critical infrastructure, regulated financial institutions and other private organisations are treated differently.

This article summarises the principal instruments as published by the regulators, as at September 2026. It is a general overview rather than legal advice, and regulators update these documents, so the current version should always be checked at source.

Saudi Arabia: cyber security controls

The National Cybersecurity Authority (NCA) is the national cyber security reference in the Kingdom and publishes the Essential Cybersecurity Controls (ECC) [1]. The current version, ECC-2:2024, replaced ECC-1:2018 and is organised into four main domains: cybersecurity governance, cybersecurity defence, cybersecurity resilience, and third-party and cloud computing cybersecurity [1].

According to its scope statement, the ECC applies to government agencies in the Kingdom and their affiliated companies and entities, inside and outside the Kingdom, and to private sector entities owning, operating or hosting Critical National Infrastructure [1]. Other organisations are encouraged, but not required, to use the controls as good practice [1]. Within scope, applicability varies by control; for example, the cloud computing and hosting controls apply to entities using or planning to use such services. The NCA assesses compliance through means such as self-assessment, compliance reporting and field audit visits [1].

Financial institutions have a separate sector framework. The Saudi Central Bank (SAMA) issued its Cyber Security Framework in May 2017, and it applies to banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and to the financial market infrastructure [2]. It uses a maturity model with levels from zero to five, and SAMA states that member organisations should operate at maturity level 3 or higher [2].

Saudi Arabia: personal data protection

The Personal Data Protection Law (PDPL) was issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H [3]. It came into force in September 2023, with a one-year period before penalties were applied [5]. The Saudi Data and Artificial Intelligence Authority (SDAIA) publishes the Law, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom [4].

The PDPL applies to processing of personal data relating to individuals that takes place in the Kingdom, and also to processing of personal data relating to individuals residing in the Kingdom by any party outside it [3]. This means that organisations with no Saudi establishment can still be within scope. The Law leaves the identity of the competent authority to a resolution of the Council of Ministers, and it preserves the powers of the Saudi Central Bank in its own sector [3]. Organisations should confirm the current supervisory arrangements for their sector.

Qatar: cyber security and information assurance

The National Cyber Security Agency (NCSA) was established by Amiri Decree No. (1) of 2021 [6]. Its National Cyber Governance and Assurance Affairs function issues certificates of compliance with national information security standards and policies, and certificates for technology and information security service providers [6]. The National Information Security Compliance Framework (NISCF) complements Qatar's National Information Assurance Framework, and the NCSA accredits service providers to deliver the audits that some NISCF services require [6]. The NCSA also publishes the National Information Assurance Standard, which sets out national security requirements.

Whether an organisation must comply with the national standard, or obtain an NCSA certificate, depends on its status and on requirements set by its sector regulator or by the government bodies it works with. Organisations should confirm this with the relevant authority rather than assume it applies, or does not.

Financial institutions are subject to rules from Qatar Central Bank (QCB). QCB publishes a set of information security regulations, including a Technology Risks Regulation for banks, an Insurance Sector Cyber Security Regulation, an Information and Cyber Security Regulation for Payment Service Providers, Technology Risk Instructions for Financial Services Operators, a Cloud Computing Regulation and a Data Handling and Protection Regulation [7]. The Data Handling and Protection Regulation applies to all financial institutions supervised by QCB, subject to exemptions set out in the regulation, and requires institutions to report data breaches to QCB and to other authorised agencies, including the NCSA [8].

Qatar: personal data privacy

Law No. (13) of 2016 on Personal Data Privacy Protection (PDPPL) is Qatar's general data protection law. Under Amiri Decree No. (1) of 2021, the National Cyber Governance and Assurance Affairs within the NCSA is the competent department for administering and enforcing it, and it publishes guidelines for regulated entities on topics such as personal data breach notification [9]. QCB's own regulation also requires financial institutions to process personal data in line with the PDPPL [8].

A note on the United Arab Emirates

The UAE has a comparable structure. The UAE Information Assurance Regulation, version 1.1 of March 2020, obliges UAE government entities and other entities identified as critical to implement its controls, and recommends voluntary adoption by other entities [10]. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022, and the UAE Data Office acts as the federal data regulator [11]. Some free zones, such as the Dubai International Financial Centre, have their own data protection law [11].

Working out what applies

1. Establish the legal status of each entity involved, including whether it is a government body, a government-affiliated company, a Critical National Infrastructure operator or a regulated financial institution
2. Identify the regulators with jurisdiction, including any free zone authority
3. Determine whether personal data of individuals in each country is processed, and where the processing takes place
4. Obtain the current version of each applicable framework from the regulator and record the version used
5. Map existing controls, such as an ISO/IEC 27001 Information Security Management System (ISMS), against each framework to identify gaps, noting that national frameworks carry specific requirements an international certification may not address

Advisory support is available for organisations assessing which Gulf frameworks apply to them and planning the work to meet them.