Skip to content

    DPO as a Service / GCC requirements

    DPO requirements across the GCC

    Data protection laws across the Gulf take different views on when a Data Protection Officer is required. Saudi Arabia, the UAE, the DIFC, ADGM and Oman set specific cases or a general duty, while Qatar and Bahrain leave the appointment largely optional. This guide compares them in one table.

    § 01Comparison

    DPO requirements by jurisdiction

    JurisdictionLawRegulatorWhen a DPO is mandatoryExternal DPOResidency
    Saudi ArabiaPersonal Data Protection Law (PDPL) and SDAIA DPO Rules (2024)Saudi Data and AI Authority (SDAIA)Public entities processing at large scale, core activities with regular and systematic monitoring, or core activities with sensitive dataYes, under a written agreementNot required by the rules
    UAE (federal)Federal Decree-Law No. 45 of 2021UAE Data OfficeHigh risk processing, systematic assessment of sensitive data including profiling, or large volumes of sensitive dataYesNo, the DPO may be inside or outside the UAE
    DIFCDIFC Data Protection Law No. 5 of 2020DIFC Commissioner of Data ProtectionDIFC Bodies, and systematic or regular High Risk Processing ActivitiesYes, including a group DPOYes, unless a group employee acting internationally
    ADGMADGM Data Protection Regulations 2021ADGM Office of Data ProtectionPublic authorities, large scale regular and systematic monitoring, or large scale special category dataYes, including a group DPONo specific requirement
    QatarLaw No. 13 of 2016 on Personal Data Privacy ProtectionNational Cyber Security AgencyNo general requirement in the law. The QFC has its own Data Protection Regulations 2021Not regulatedNot regulated
    BahrainLaw No. 30 of 2018 on Personal Data ProtectionPersonal Data Protection AuthorityOptional. A controller may appoint a data protection supervisor registered with the AuthorityYes, if registeredNot regulated
    OmanRoyal Decree No. 6/2022 and Executive Regulations (2024)Ministry of Transport, Communications and Information TechnologyThe Executive Regulations require controllers to appoint a DPONot specifiedNot specified
    § 02By jurisdiction

    Each regime in brief

    Saudi Arabia

    SDAIA's Rules for Appointing a Personal Data Protection Officer, issued in August 2024, set three mandatory cases and allow an external DPO under a written agreement. Contact details are filed through the National Data Governance Platform. DPO as a Service in Saudi Arabia

    UAE (federal)

    Article 10 of Federal Decree-Law No. 45 of 2021 requires a DPO for high risk processing and for significant processing of sensitive data. The law does not apply in the DIFC or ADGM. DPO as a Service in UAE

    DIFC

    Article 16 of DIFC Data Protection Law No. 5 of 2020 requires a DPO for DIFC Bodies and for systematic or regular High Risk Processing. The DPO must normally reside in the UAE, and an annual assessment goes to the Commissioner. DPO as a Service in DIFC

    ADGM

    The ADGM Data Protection Regulations 2021 follow the GDPR triggers: public authorities, large scale monitoring and large scale special category data. DPO as a Service in ADGM

    Qatar

    Law No. 13 of 2016 does not set a general DPO requirement, but organisations still need someone accountable for compliance. The Qatar Financial Centre has a separate regime.

    Bahrain

    Law No. 30 of 2018 lets controllers appoint a data protection supervisor, who must be registered with the Personal Data Protection Authority. Appointment is optional but brings practical benefits, including in notifications to the Authority.

    Oman

    Royal Decree No. 6/2022 and its Executive Regulations, issued in 2024, require controllers to appoint a data protection officer and set out the officer's tasks.

    § 03Questions

    Frequently asked questions

    Which GCC jurisdictions require a DPO?

    Saudi Arabia, the UAE federal law, the DIFC and ADGM require a DPO in defined cases, and Oman's Executive Regulations require controllers to appoint one. Qatar's law has no general requirement, and in Bahrain the appointment is optional.

    Can one DPO cover several GCC jurisdictions?

    Often, yes. Most regimes allow an external or group DPO, but the DIFC normally requires UAE residence, and each regime has its own filings. WLC can act across all of them.

    Do the DIFC and ADGM follow the UAE federal law?

    No. Both have their own data protection laws and regulators, and the federal law does not apply in them.

    § 04Get in touch

    Talk to our GCC DPO team

    Last reviewed: by Simon Leadbetter, Associate Partner, GCC