Short answer
Saudi Arabia’s Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024 and is overseen by SDAIA. The UAE has a federal data protection law (Federal Decree-Law No. 45 of 2021), while free zones such as DIFC and ADGM have their own rules. For an app this means: collect only the data you need, tell users why in a clear privacy notice, get consent where required, protect the data, and decide with your lawyer where it is stored and whether it may leave the country.
Saudi Arabia: the PDPL
The PDPL came into force on 14 September 2023, and after a one-year grace period it became fully enforceable on 14 September 2024. SDAIA (the Saudi Data and AI Authority) supervises it and has issued implementing regulations and separate rules on transferring data outside the Kingdom. In October 2026 SDAIA opened a public consultation on amendments, including a proposed requirement to store personal data in Saudi Arabia. Check the final text before you choose where to host.
UAE: federal law and free zones
Most UAE businesses fall under Federal Decree-Law No. 45 of 2021 on the protection of personal data. Companies in the DIFC and ADGM financial free zones follow their own data protection laws instead. Health data has additional federal rules. Your lawyer should confirm which regime applies to your company.
What this means for the app itself
- Collect less. Every field in a form should have a reason. Less data means less risk.
- Explain clearly. A privacy notice in Arabic and English that says what you collect, why, and who you share it with.
- Ask when needed. Consent screens for things like marketing messages or location, recorded with a date.
- Let users act. Ways to see, correct and delete their data, including deleting the account.
- Protect it. Encryption, strong logins for staff, access by role, and logs of who viewed what.
- Know where it goes. A list of every outside service that receives data: hosting, analytics, payments, SMS, AI providers.
Decisions to make before building
Agree with your legal team where data is hosted, whether any of it may leave the country, how long it is kept, and who in your company owns these decisions. These choices affect the cloud region, the AI provider and the analytics tools, so they are much cheaper to make at the start than to change later.
Qatar, Kuwait, Bahrain and Oman
Qatar, Bahrain and Oman each have their own personal data protection law, and Kuwait has data rules for specific sectors. The same habits apply: collect less, explain clearly, protect the data, and let a local lawyer confirm the details.
Common questions
Does my app have to store data inside Saudi Arabia?
Transfers outside the Kingdom are allowed under conditions set in SDAIA’s regulations, and in October 2026 SDAIA consulted on amendments that would add a stronger local storage requirement. Check the current rules with your lawyer before choosing hosting.
Is a privacy policy enough?
No. The policy has to match what the app really does, and the app has to support it: consent screens, deleting accounts, limiting who can see data, and keeping records.
Is health or financial data treated differently?
Yes. Sensitive and sector data, such as health records or payment data, usually has extra rules from the sector regulator. Name the sector early so it is planned into the design.
Can HTH tell me if I am compliant?
No. We are engineers, not lawyers. We build the features your legal team asks for and document how data flows through the system.
Further reading
Sources checked on 21 October 2026. This is planning advice, not results from a client project.