Insights · Data protection

2 min read ·

Saudi Arabia, the UAE and Egypt all have personal data protection laws, and each limits how personal data may be transferred outside the country. If an outside vendor or an AI tool touches your customer data, these are the questions to ask. This is a practical checklist, not legal advice.

Book a free 20-minute call (opens in a new tab)Message me on WhatsApp (opens in a new tab)
01

  • Saudi Arabia: the Personal Data Protection Law, overseen by SDAIA, in force since September 2023
  • United Arab Emirates: Federal Decree-Law No. 45 of 2021 on personal data protection
  • Egypt: Law No. 151 of 2020 on personal data protection
  • Free zones such as DIFC and ADGM have their own data protection rules
02

  • Where exactly will our data be stored and processed, country by country?
  • Will any personal data be sent to an AI model or another outside service, and which one?
  • Can the work be done on our own infrastructure or on anonymised data instead?
  • Will you sign a data processing agreement and an NDA before access?
  • How is our data deleted when the work ends?
03

Keep personal data inside your own systems, give vendors the minimum access for the minimum time, and remove or mask personal details before anything goes to an outside AI service.

04

Often yes, if personal data stays in your systems or is anonymised, and the right agreements are signed. Check the specific rules for your sector with your legal adviser.

If staff paste personal data into an outside AI tool, that data is being sent to that provider. That is why a usage policy matters.

It can. A vendor seeing personal data, even briefly or read-only, is usually treated as processing it, so agreements and access limits still matter. Confirm the specifics with your legal adviser.

At least: which data the vendor may touch and why, where it is stored, who else can see it, how long it is kept, and what happens to it when the work ends.

Updated: