Which rules apply
A short applicability note: the data protection regime you are under, any registration or notification duty with your regulator, and the sector rules that may follow as you grow.
DIFCADGMUAE PDPLSaudi PDPL
Startups · Readiness
The data protection and security baseline every Gulf startup is asked for, in two to three weeks
Customers, investors and sandbox applications all ask the same questions: which law you are under, how you protect personal data, and how you use AI. The Launch Pack answers them for the regime you are actually in, for one fixed fee.
Built for founders, not for compliance teams
You set up in DIFC, ADGM, a mainland emirate or Riyadh, and the licence came quickly. The data protection and security basics did not come with it. Then a customer, an investor or a sandbox application asks for them, usually all in the same month.
The Launch Pack gives a young company the baseline it is expected to have, written for the regime it actually sits in: DIFC's Data Protection Law, ADGM's Data Protection Regulations, the UAE federal law, or Saudi Arabia's PDPL. Short, usable documents, not a binder nobody reads.
What you receive
Delivered in two to three weeks, in editable formats, branded as your own.
Privacy and cookie notices
In plain English and Arabic, matched to what your product actually collects. Saudi Arabia is moving towards notices in the language customarily used with your users.
EN / AR
Records and agreements
A record of processing, a customer-facing data processing agreement, and a checklist for the suppliers who handle your data.
RoPADPA
Security baseline
Twelve controls a small company can run: identity and MFA, devices, backups, access reviews, logging, supplier risk and secure development basics.
12 controls
Incident and breach plan
A one-page incident plan with the breach notification clocks for your regime, so the first hour is not spent searching.
72-hour clocks
AI use policy
How your team may use AI tools with company and customer data, and, if you build AI, a short statement of how your AI features are governed.
Staff AI useAI features
What it costs
One fixed fee, paid in full before we start. Most startups need Essential.
Launch Pack: Essential
One data protection regimeUp to 50 staff
Everything above, for a company without AI features in its product, and a 60-minute handover session.
From AED 9,500≈ USD 2,587. Excludes VAT and other taxes.
Launch Pack: Plus
Up to two regimesAI featuresCustomer trust page
Adds a second regime (for example DIFC and Saudi Arabia), AI feature governance, and the copy for a security and privacy page on your website that answers the first questions buyers ask.
From AED 14,500≈ USD 3,948. Excludes VAT and other taxes.
Outside the pack
Legal advice and entity licensing, which need counsel or your setup agent. Penetration testing and certification. Sector licensing, such as fintech or health, which we scope separately. If you need ongoing help after the pack, our fractional CISO and DPO service picks up where it ends.
The firewall
This is readiness work. Because we write these documents with you, we will not later assess them or issue an AI Trust Passport that relies on them. If you expect to need an independent opinion soon, tell us at the start and we will scope the work so that remains possible.
Questions
We are pre-revenue. Is this too early?
Usually not. The cheapest time to set these basics is before your first enterprise customer or institutional investor asks for them. If it is genuinely too early, we will say so on the scoping call.
Can you work with our free zone setup agent?
Yes. We do not replace them; they handle your licence and we handle the data protection and security baseline that the licence does not cover.
Are your accelerator members eligible for different pricing?
We offer member pricing through startup hubs and accelerators that partner with us. Tell us which programme you are in.
Tell us where you are licensed and what you are building
Twenty minutes is enough to confirm the regime, the tier and the fee.