When an employee pastes personal data into an AI tool hosted abroad, or an agent calls a foreign model, data protection law treats it as a transfer abroad. What that requires depends on which of seven regimes applies. Egypt asks for a license or permit from its regulator. Saudi Arabia asks for a written risk assessment in defined cases. Türkiye asks you to notify a signed standard contract within five business days. The Dubai International Financial Centre (DIFC) asks for a register of AI systems that shows where third parties are located. The UAE federal law leaves its transfer and breach detail to regulations, and Qatar's statute limits a controller's freedom to restrict data flows.
Two common claims are wrong. We found no AI Act in force in any of these seven regimes as of October 2026. And there is no uniform "Gulf transfer ban": we found no binding Gulf-wide data protection or AI instrument as of October 2026, and according to Reed Smith each Gulf state has its own independent data protection law. The rules differ regime by regime.
Last verified: 13 October 2026, against official texts for the UAE (archived copies of the federal legislation portal), the DIFC, Saudi Arabia and Türkiye, and the Official Gazette scan of Egypt's Law No. 151 of 2020. Qatar's law was read in the unofficial English translation on its regulator's site, and the Abu Dhabi Global Market (ADGM) rules through guidance only. Egypt's Executive Regulations were not opened; statements about them come from attributed law-firm notes.
What does each regime require?
| Regime | Law | Regulator | Transfer rule and the evidence it requires | Automated-decision rule | Breach notification | AI-specific instrument and status |
|---|---|---|---|---|---|---|
| UAE federal | Federal Decree by Law No. (45) of 2021; in force 2 January 2022 | UAE Data Office; Artificial Intelligence and Data Authority approved 14 June 2026 | Arts. 22 and 23: destination with data protection legislation, or a contract, explicit consent or listed necessity. Conditions left to Executive Regulations | Art. 18: right to object, with human review on request | No hours in the law; left to Executive Regulations | AI Charter, issued 10 June 2024; policy, not legislation |
| DIFC | DIFC Law No. 5 of 2020; Data Protection Regulations in force 1 September 2023 | Commissioner of Data Protection | Arts. 26 and 27: adequate jurisdiction, safeguards or a derogation. AI register lists third-party locations and export safeguards | Art. 38: right to object and require manual review | "as soon as practicable in the circumstances"; no hours | Regulation 10, binding; amendments proposed June 2026, not enacted |
| ADGM | Data Protection Regulations 2021 | Office of Data Protection | Adequacy decision, or safeguards such as ADGM standard clauses, or derogations | Not verified; left out | 72 hours where feasible | None found |
| Saudi Arabia | Personal Data Protection Law, Royal Decree No. (M/19), as amended; Implementing Regulation | Saudi Data and AI Authority (SDAIA) | Transfer regulation, Version 0.2, August 2024: clauses, binding common rules or accreditation certificate. Risk assessment in two defined cases | Tell people if decisions are solely automated; explicit consent for such decisions | 72 hours to SDAIA | AI Ethics Principles and generative AI guidelines, May 2025; guidance |
| Qatar | Law No. (13) of 2016 | National Cyber Security Agency (NCSA) | Art. 15: controller may not limit cross-border flow, with two exceptions | Not in the statute; covered in regulator guidance | Statute: no period. Guidance: 72 hours | Qatar Central Bank AI Guideline, in force 4 September 2024 |
| Egypt | Law No. 151 of 2020 | Personal Data Protection Center | Art. 14: equivalent protection and a license or permit from the Center | None found in the pages we read | 72 hours to the Center | National AI Strategy and a 2023 charter of guiding principles |
| Türkiye | Law No. 6698 (KVKK), as amended by Law No. 7499 | Personal Data Protection Board and Authority | Art. 9: adequacy decision, or a safeguard such as the standard contract, notified within five business days | Art. 11(1)(g): right to object | Statute: as soon as possible. Board decision: 72 hours | Three regulator publications; guidance |
Read the fourth column as a list of documents a regulator can ask to see.
Egypt: do you need a license to send data abroad?
Yes, on the face of the statute. Article 14 of Law No. 151 of 2020 prohibits transferring, storing or sharing personal data to a foreign state unless two conditions are met: the destination offers a level of protection no lower than the law's, and the Personal Data Protection Center has issued a license or permit. A processor outside Egypt must appoint a representative inside the country (Article 5(12)), which matters when that processor is an AI vendor.
The timing rule is primary. Article 6 of the issuing law gives those subject to it one year from the date the Executive Regulations are issued to regularize their position. The end date is not. According to CMS, the regulations were issued on 1 November 2025 but not made public until 25 December 2025, so CMS plans for 1 November 2026 while noting doubt over whether the Center might count the year to the end of 2026. Clyde & Co gives 31 October 2026. By our own count that is 18 or 19 days after 13 October 2026. Confirm the date with Egyptian counsel.
CMS also reports that a transfer application must set out the destination country, storage locations, security measures, data categories and volumes, and retention periods. Each is a question for your AI vendor.
Article 3(6) of the issuing law excludes personal data held by the Central Bank of Egypt and the entities it supervises, other than money-transfer and exchange companies.
Saudi Arabia: when is a written risk assessment required?
Not for every transfer. Article 7(1) of SDAIA's Regulation on Personal Data Transfer outside the Kingdom (Version 0.2, August 2024) names two cases. The controller "shall conduct a risk assessment before transferring or disclosing personal data to a party outside the Kingdom" where the transfer relies on an Article 4 safeguard (standard contractual clauses, binding common rules or a certificate of accreditation), and where sensitive data moves abroad "on a continuous or widespread basis".
Article 7(2) sets six elements: purpose and legal basis; a description of the transfer and its geographical scope; the safeguards and their adequacy; data minimization measures; the potential effects and their likelihood; and the controls that prevent or reduce the risks. SDAIA's February 2025 guideline helps with format but "is not legally binding".
Article 24(1) of the Implementing Regulation requires notice to SDAIA "within a delay not exceeding (72) hours of becoming aware of the incident" where it may harm the data or the person.
The Saudi Press Agency, as carried by Okaz and Riyadh Daily in January 2026, reported that the violation committees issued 48 decisions during the past year. Separately, according to Clyde & Co and Tamimi, a consultation on amending the Implementing Regulation opened on 6 October 2026 and closes on 5 November 2026.
Türkiye: what changed on 1 June 2024?
The transfer regime. Law No. 7499 rewrote Article 9 of Law No. 6698, known as the KVKK, with effect from 1 June 2024. Data may go abroad on an adequacy decision of the Board or, failing that, under an appropriate safeguard such as a standard contract published by the Board. Otherwise only occasional transfers under listed exceptions are allowed.
The standard contract carries a clock. Article 9(5) requires the controller or processor to notify it to the Authority within five business days of signature. Article 18(1)(d) sets the fine for missing that notice at TRY 50,000 to TRY 1,000,000. Those are the statutory figures; they are revalued each year and we did not check the 2026 amounts.
The regulator published a generative AI guide on 24 November 2025. Two documents followed in 2026, both dated February 2026 on the cover:
- "İş Yerlerinde Üretken Yapay Zekâ Araçlarının Kullanımı" (Use of Generative AI Tools in Workplaces), published on 5 March 2026. It defines shadow AI as staff use of generative AI tools outside the employer's knowledge, approval or control, and recommends a clear corporate policy, anonymized inputs, network-level limits on external platforms and role-based access.
- "Etken Yapay Zekâ (Agentic AI)", published on 12 March 2026. It outlines data protection points to consider across the life of agentic systems; we did not read its recommendations in detail and attribute no specific control to it.
Both are advisory. Neither changes Article 9.
UAE federal: why are there no breach hours yet?
Because the federal law hands the detail to Executive Regulations. Article 9 says a breach is notified within the period those regulations set. Article 23(2) says they "set forth the controls and stipulations" for transfers. Article 29 allows six months from their issue to regularize.
Have they been issued? According to Tamimi, in a note edited on 1 September 2026, "at the time of writing, Executive Regulations have not yet been issued", and we found none as of October 2026.
On 14 June 2026 the Prime Minister approved the Artificial Intelligence and Data Authority, which brings together the functions of the UAE Data Office, the AI Office and the Digital Government Sector of the telecoms regulator. The announcement names no decree, and we could not confirm the legal instrument or the Authority's enforcement powers as of October 2026.
DIFC and ADGM: what does Regulation 10 ask for?
A register, first of all. Regulation 10 of the DIFC's Data Protection Regulations has been binding since 1 September 2023 and covers personal data processed through autonomous and semi-autonomous systems. It requires a clear notice at first use of the system, evidence of compliance on request, and a register. That register must show whether the system is used solely to make automated decisions, and "where Third Parties or Regulatory Authorities engaged in Processing Personal Data used in the Systems are located and appropriate safeguards for exporting the Personal Data thereto". High-risk processing is barred unless certification requirements exist and are met and an Autonomous Systems Officer is appointed.
Consultation Paper No. 3 of June 2026 proposes changes to Regulation 10 and a new Regulation 11; comments closed on 18 July 2026. Of its drafts the paper says: "You should not act on them until they are formally enacted."
ADGM has its own regulations. Its transfer guidance allows an adequacy decision or safeguards such as its standard contractual clauses, and its breach guidance sets notice to the Commissioner "without undue delay, and within 72 hours of discovering the breach where feasible". We found no ADGM guidance on AI.
Qatar: is the 72-hour rule in the law?
No. Article 14 of Law No. (13) of 2016 requires notice of a breach and sets no period. The 72 hours comes from an NCSA guideline, which says controllers "should" report "without delay and within 72 hours of becoming aware". On transfers, Article 15 in NCSA's unofficial translation forbids a controller from "taking any decision or measure that may limit the Cross-Border Data Flow" unless the processing breaches the law or may cause serious damage.
Financial firms face more: the Qatar Central Bank AI Guideline, in force since 4 September 2024, applies to all entities the central bank regulates. Approval is needed in two cases: before launching a new AI system as a Provider or materially modifying one, and before signing any high-risk AI purchase, licensing or outsourcing agreement. It is not a blanket approval for every tool. The entity also discloses an AI register to the central bank annually, and section 12.3 says it should assess the outsourcing provider, "including the location of the data when it is processed, stored, and transmitted".
The Qatar Financial Centre has its own Data Protection Regulations 2021 and Data Protection Office. We did not read its transfer or breach rules.
What should you do now?
- Inventory which AI tools receive personal data, and where each is hosted. Include tools nobody approved.
- Map each flow to a transfer mechanism. A license or permit in Egypt; an Article 4 safeguard in Saudi Arabia; a standard contract or other Article 9 route in Türkiye; Article 26 or 27 in the DIFC.
- Keep the paper on file. The Saudi risk assessment, the Egyptian license, the Turkish notification with its date, the DIFC register.
- Set the breach clock per regime. 72 hours in Saudi Arabia and Egypt, by Board decision in Türkiye and by guidance in Qatar; 72 hours where feasible in ADGM; no stated hours in the DIFC or under UAE federal law.
The first two steps need answers from the vendor. Our AI vendor security questionnaire is useful here because every transfer rule in the table turns on where the vendor processes the data and what it does with it.
Where does software help, and where does it stop?
It cannot obtain a license, sign a standard contract or write a risk assessment. Those are legal acts.
It can show which transfers exist and stop the ones you have not papered. AccuroAI discovers 1,400+ AI tools, approved or not. It applies 40+ data classifiers to prompts and redacts or blocks personal data in line, so a flow with no mechanism behind it can be stopped before the data leaves. It enforces at the point of use and does not use TLS interception. Each event is logged against a user and a tool, as our note on the AI agent audit log describes. The log shows what went where, not that a transfer was lawful.
Frequently asked questions
Is this the same as the GDPR transfer rules?
The DIFC, ADGM and Türkiye use a similar ladder of adequacy, safeguards and exceptions. Egypt's license requirement and Qatar's Article 15 do not fit that pattern. For the EU position see our GDPR and enterprise AI guide, and for a third model our note on India's DPDP Act.
Is a Gulf-wide AI or data law coming?
We found no binding one as of October 2026. Plan regime by regime.
This is not legal advice. Ask local counsel in each regime how these rules apply to your transfers; the AI compliance hub links our other country notes.
Sources
- UAE: law page and AI Charter
- DIFC: Data Protection Law
- Saudi Arabia: Personal Data Protection Law; AI Ethics Principles
- Qatar: NCSA; Individuals' Rights guideline
- Egypt: ministry AI page
- Türkiye: breach notification page; generative AI guide
- Gulf-wide: Reed Smith snapshot. Other documents are linked where cited.