Regional Updates

What tends to get less attention is what happens to your data as a result.

Because once personal data is accessed, supported, or processed from another country, you are no longer dealing with one legal framework. You are dealing with several at the same time, whether organisations fully recognise this or not. 

Most organisations do not actively decide to move data internationally. It does not usually happen as a clear, intentional step. It happens because of how things are set up. A system is hosted in one country, support sits somewhere else, and access is shared across teams in different regions. Each of those decisions makes sense on its own. But when you step back and look at it properly, personal data is already moving across borders.

Understanding Your Regulatory Obligations Across the GCC

Across the UAE, Bahrain, Saudi Arabia, and internationally, the position is broadly consistent. You can transfer or access personal data across borders, but you remain responsible for it. Whether operating under the UAE's Federal PDPL, Bahrain's Personal Data Protection Law, or Saudi Arabia's PDPL, the underlying obligation is the same: organisations must be able to demonstrate that personal data is adequately protected, regardless of where it is processed or accessed.

That responsibility does not stop at the point of transfer- it follows the data.

In practice, that means being able to explain where your data is, who can access it, and how it is protected. Not just in theory, but in reality- and without needing to piece the answer together when someone asks.

This is where things often become less clear.

Where the Data Protection Gaps & Risks Usually Appear: Four Common Scenarios

Most organisations do have the right components in place. There are policies, contracts, security controls, and some level of data mapping. On paper, everything appears aligned. But when you look more closely at how systems and teams actually operate, those components do not always reflect what is happening day to day.

1. Take a fairly typical example. A system is described internally as being “hosted locally”. That may well be true. But the supplier supporting it is based elsewhere, access is available across different offices, and backups may sit in another region entirely. At that point, the data is no longer just local- it just sounds like it is.
2. Or a new platform is introduced. It improves efficiency, solves a problem, and quickly becomes part of how the business operates. But it may also involve third-party access, processing outside the country, or changes in how personal data is used. If no one steps back and looks at that properly, the position shifts- quietly, but significantly.
3. Marketing is often where this becomes most visible. A tool is introduced to improve targeting or engagement, and it delivers results. But behind the scenes, personal data may now be processed in different jurisdictions or shared with additional parties. If consent wording, privacy notices, and data sharing arrangements do not keep up, the organisation can end up saying one thing while doing another- without meaning to.
4. Access is another area that tends to be underestimated. A system might be described as “local”, but if it is accessed from another country, that is still cross-border use of personal data. From a regulatory perspective, access matters just as much as transfer, which means controls need to reflect that.

This is where different parts of the organisation start to connect.

Data mapping needs to show not just where systems are, but how data moves and who can access it. Data sharing arrangements need to reflect how suppliers operate, not just what is written in a contract. Legal bases need to remain valid in practice, not just on paper. Privacy notices need to reflect what is happening, not what was originally intended.

When these areas are not aligned, the issue is not always obvious. It tends to show up gradually in small inconsistencies that build over time.

At some point, something usually brings it into focus. It might be a data subject request asking where information is held or transferred. It might be a supplier issue, an internal review, or a potential data breach. Whatever the trigger, the expectation is straightforward: the organisation can explain what is happening, clearly and consistently. 

Five Key Questions for BCCD Members: Assessing Your Organisation’s Data Privacy Risks

A short internal sense-check can often highlight where things stand. For example:

• Do we understand where our data is accessed from, not just where it is stored?
• Do we know how it moves between systems, suppliers, and regions?
• Are our safeguards aligned with how data is actually handled?
• Do our policies and privacy notices reflect current operations?
• Is accountability clear across the organisation? 

If the answers are consistent, things are likely in a good place. If they vary depending on who you ask, there is probably something sitting underneath that has not been fully understood.

None of this is about adding complications or slowing the business down. It is about making sure what you already have reflects reality. 

A DPO's Directive for Organisations Operating Across the GCC

In practice, that often means revisiting a few key areas:

• Data mapping should capture movement, not just storage
• Data sharing arrangements should reflect actual cross-border processing
• Safeguards should align with where data is accessed and used
• Policies and procedures should reflect current operations
• Teams should understand when something needs to be escalated 

These are not new requirements. They are existing ones- just applied properly to how organisations now operate across jurisdictions.

Cross-border data is not the issue. It is part of how modern organisations function.

The issue is losing sight of it.

Because once that happens, you are no longer managing risk. You are relying on assumption. And that is usually the point where someone else starts asking questions- ideally not the regulator!

Written by

Lynsey Hanson | Global Data Protection Officer | TenIntelligence