Most requested laws and regulator requirements
GCC regulations
Cybersecurity, data protection, AML and financial-sector requirements across the UAE, Saudi Arabia, Qatar, Bahrain and Oman.
- UAE PDPL UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) Law or regulation The UAE’s federal data protection law for organisations processing personal data in or from the UAE.
- KSA PDPL Saudi Arabia Personal Data Protection Law Law or regulation Saudi Arabia’s data protection law, fully enforceable since September 2024 and supervised by SDAIA.
- NCA ECC Saudi National Cybersecurity Authority Essential Cybersecurity Controls Law or regulation Mandatory baseline cybersecurity controls for Saudi government entities and critical infrastructure operators.
- SAMA CSF Saudi Central Bank Cyber Security Framework Law or regulation The cyber security framework for banks, insurers and finance companies regulated by the Saudi Central Bank.
- UAE IA Standard UAE Information Assurance Regulation (TDRA) Law or regulation The UAE’s national information assurance controls for government entities and critical sectors.
- CST Cloud Class A, B, C CST Cloud Computing Regulatory Framework and cloud provider registration Law or regulation Registration and classification of cloud service providers in Saudi Arabia, from Qualifying to Class C, which decides the data and sectors you can serve.
- Dubai ISR Dubai Information Security Regulation (Dubai Electronic Security Center) Law or regulation Dubai’s information security regulation for government entities and critical sectors in the emirate.
- ADHICS Abu Dhabi Healthcare Information and Cyber Security Standard (DoH) Law or regulation Mandatory information and cyber security standard for healthcare entities licensed by the Abu Dhabi Department of Health.
- CBUAE Requirements Central Bank of the UAE regulations for licensed financial institutions Law or regulation Outsourcing, business continuity, consumer protection and operational risk expectations for UAE-licensed financial institutions.
- NCA CSCC NCA Critical Systems Cybersecurity Controls Law or regulation Additional cybersecurity controls for critical systems inside national critical entities in Saudi Arabia, building on the ECC.
- UAE AML/CFT UAE anti-money laundering and counter-terrorist financing framework Law or regulation AML/CFT obligations for UAE financial institutions and designated non-financial businesses, including goAML reporting.
- DIFC & ADGM Data Protection DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021 Law or regulation GDPR-aligned data protection laws for firms in the UAE’s financial free zones.
- NCA TCC NCA Telework Cybersecurity Controls Law or regulation Saudi cybersecurity controls for remote and hybrid working, covering devices, connections, access and monitoring.
- NCA CCC NCA Cloud Cybersecurity Controls Law or regulation Saudi cloud cybersecurity controls for cloud service providers and organisations using cloud services.
- NCA DCC NCA Data Cybersecurity Controls Law or regulation Saudi controls for protecting data according to its classification throughout its life cycle.
- NCA OSMACC NCA Organisations’ Social Media Accounts Cybersecurity Controls Law or regulation Saudi controls for securing official organisational social media accounts against takeover, leaks and impersonation.
- NCA OTCC NCA Operational Technology Cybersecurity Controls Law or regulation Saudi cybersecurity controls for industrial control systems and operational technology.
- SAMA BCM Framework Saudi Central Bank Business Continuity Management Framework Law or regulation Business continuity requirements for banks, insurers and finance companies regulated by SAMA.
- SAMA Counter-Fraud Framework Saudi Central Bank Counter-Fraud Framework Law or regulation Fraud governance, prevention, detection and response requirements for SAMA-regulated institutions.
- KSA AML/CTF Saudi Arabia anti-money laundering and counter-terrorism financing laws Law or regulation AML/CTF obligations for Saudi financial institutions and designated non-financial businesses and professions.
- NDMO Data Standards NDMO Data Management and Personal Data Protection Standards (SDAIA) Law or regulation SDAIA’s national standards for data governance, classification, quality, sharing and personal data protection across 14 domains.
- SDAIA AI Ethics Principles Saudi Data & AI Authority AI Ethics Principles Guidance standard Saudi Arabia’s national principles for developing and using AI responsibly.
- Qatar NIA Qatar National Information Assurance Policy and Standard Law or regulation Qatar’s national information assurance framework for government and critical sectors.
- Qatar PDPPL Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016) Law or regulation Qatar’s data protection law, one of the first in the GCC.
- Bahrain PDPL Bahrain Personal Data Protection Law (Law No. 30 of 2018) Law or regulation Bahrain’s data protection law, supervised by the Personal Data Protection Authority.
- Oman PDPL Oman Personal Data Protection Law (Royal Decree 6/2022) Law or regulation Oman’s data protection law with its executive regulations.
- SAMA ITGF SAMA Information Technology Governance Framework Law or regulation The Saudi Central Bank’s framework for IT governance, IT risk and IT operations in regulated financial institutions.
- DESC CSP Standard Dubai Electronic Security Center Cloud Service Provider Security Standard Certifiable standard Mandatory security certification for cloud providers serving Dubai government and semi-government entities.
- UAE ICT Health Law UAE Federal Law No. 2 of 2019 on the use of ICT in health fields Law or regulation UAE federal rules for health data: confidentiality, retention, data location and the use of technology in healthcare.
- VARA Rulebooks Dubai Virtual Assets Regulatory Authority regulations and rulebooks Law or regulation Dubai’s licensing and conduct rules for virtual asset service providers, including technology, compliance and risk management rulebooks.
Other regions
Find out where you stand in one call
Tell us which standard or customer requirement you are facing. In a free 30-minute call we will outline the gaps, a realistic timeline and what it will take to be audit-ready.