Markets · GCC six
Six states. Six standalone regimes.
No GCC-wide instrument, no adequacy mechanism, no mutual recognition of certificates. Each country page carries the register, the authority, who may sign the audit, and an honest note where the work must be done by someone local.
Country registers
All six registers are published. Each page carries the instruments, the authority, who is allowed to sign the audit, and an honest note where we are not the right supplier.
United Arab Emirates
Five overlapping registers — federal, Dubai, Abu Dhabi, DIFC and ADGM — and health data that cannot leave the country.
Saudi Arabia
The most developed control stack in the Gulf, and the tightest rules about who may deliver services into it.
Qatar
The clearest audit regime in the region, and the most prescriptive AI rule in the GCC.
Bahrain
A statutory register of accredited data protection officers, and the only Gulf rule requiring the external penetration tester to be rotated every two years.
Oman
The strongest DPO mandate in the Gulf, enforceable since February 2026 — and no national private-sector cyber control set, whatever vendor material says.
Kuwait
A banking framework with mandated independent assessors, no general data protection law, and a data classification policy that was repealed.
Why there is no single Gulf assessment
Bahrain maintains a transfer whitelist that includes Gulf states, but Saudi Arabia, the UAE, Qatar and Oman each run separate transfer regimes, and no certificate issued under one is recognised by another. A group operating in three Gulf states complies three times. The direction of travel is shared even though the instruments are not — data localisation for government and financial data, maturity models rather than pass or fail, licensed assessor ecosystems, and a steady shift from voluntary frameworks to licensing-linked mandates.
Not sure which of these binds you?
That is usually the first and most valuable half-day of any engagement — establishing what you owe, and stopping the work you do not.