GRC Software in the UAE and Saudi Arabia: PDPL, DIFC, NCA and SAMA

Last updated: 19 October 2026

Quick answer: GRC software for the UAE and Saudi Arabia has to handle two different sets of rules at once. In the UAE that means the Federal PDPL, the separate DIFC and ADGM data protection regimes and cybersecurity standards such as the UAE IA Standards and ADHICS. In Saudi Arabia it means the PDPL supervised by SDAIA, the NCA Essential Cybersecurity Controls and, for financial institutions, the SAMA Cyber Security Framework. Look for a platform that maps one set of controls to all of these, manages cross-border transfers and keeps evidence for each regulator separately.

Most organisations in the Gulf answer to more than one regulator. A bank with a DIFC branch and a Riyadh subsidiary may deal with the DIFC Commissioner of Data Protection, the DFSA, SDAIA, SAMA and the NCA.

Spreadsheets can cope with one framework. They struggle when the same control has to be evidenced to several authorities, each with its own terminology and deadlines.

This guide sets out the main data protection and cybersecurity requirements in the UAE and Saudi Arabia, explains how cross-border transfer rules differ, lists what GRC software should support for GCC organisations, and gives a practical implementation roadmap.

Which regulations does GRC software need to cover in the UAE?

In the UAE you need to cover the Federal PDPL for mainland and most free-zone entities, the DIFC or ADGM data protection law if you are established in those financial free zones, and the cybersecurity and sector standards that apply to your activities.

Federal Decree-Law No. 45 of 2021 (UAE PDPL)

The Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the UAE’s general data protection law. It came into force on 2 January 2022, and the UAE Data Office, set up under Federal Decree-Law No. 44 of 2021, is the authority responsible for it.

It does not apply everywhere. Government data, personal data held by security and judicial authorities, and health and banking data that are covered by their own legislation are excluded, as are free zones with their own data protection laws, such as the DIFC and ADGM. Core obligations include:

• a lawful basis for processing, with consent as the default and a set of listed exceptions;
• data subject rights, including access, correction, erasure, restriction, objection and portability;
• records of processing activities, security measures and data protection impact assessments for high-risk processing;
• appointment of a data protection officer in defined circumstances;
• notification of personal data breaches to the Data Office, and to data subjects in some cases;
• conditions for transferring personal data outside the UAE.

Much of the detail, including penalties and some timelines, was left to executive regulations. Check the current position before you set internal deadlines. Our guide to managing the UAE Federal Data Protection Law across jurisdictions covers how it interacts with free-zone and sector rules.

DIFC Data Protection Law (DIFC Law No. 5 of 2020)

Entities established in the Dubai International Financial Centre follow DIFC Law No. 5 of 2020 and its Data Protection Regulations, supervised by the DIFC Commissioner of Data Protection. The law is closely modelled on the GDPR. Its main requirements are:

• data subject rights to access, rectification, erasure, portability and objection;
• notification of personal data breaches to the Commissioner as soon as practicable, and to affected data subjects where the risk is high;
• data protection impact assessments before high-risk processing;
• a data protection officer for entities that carry out high-risk processing on a systematic or regular basis;
• restrictions on transfers outside the DIFC unless the destination is adequate or appropriate safeguards are in place;
• notifications to the Commissioner and documented accountability measures.

DIFC financial firms are also supervised by the Dubai Financial Services Authority (DFSA).

ADGM Data Protection Regulations 2021

Entities in Abu Dhabi Global Market follow the ADGM Data Protection Regulations 2021, supervised by the ADGM Office of Data Protection. It is also GDPR-style, but if you have entities in both free zones, treat them as two separate regimes.

Cybersecurity standards: UAE IA Standards and Dubai ISR

The UAE Information Assurance (IA) Standards, originally published by the former National Electronic Security Authority (NESA) and still widely called “NESA”, set risk-based security controls for government entities and critical sectors. Dubai government entities and their suppliers may also be subject to the Information Security Regulation issued by the Dubai Electronic Security Center (DESC). Banks, telecoms operators and listed companies also face sector regulator expectations.

Healthcare: ADHICS and federal health data rules

Healthcare entities licensed by the Abu Dhabi Department of Health must comply with the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS). Version 2.0 updated the control set and the implementation expectations, and our ADHICS v2.0 compliance roadmap explains the steps. Across the UAE, Federal Law No. 2 of 2019 on the use of ICT in health fields generally requires health data to be stored and processed inside the country unless an exception applies. Dubai Health Authority licensees should also check DHA’s own policies.

Which regulations apply in Saudi Arabia?

Saudi organisations typically need to cover the Personal Data Protection Law, the National Cybersecurity Authority’s control frameworks and, in financial services, the SAMA Cyber Security Framework.

Personal Data Protection Law (PDPL) and SDAIA

The Saudi PDPL was issued by Royal Decree M/19 in 2021 and amended in 2023. It came into force on 14 September 2023, and controllers had a one-year grace period, until 14 September 2024, to comply. The Saudi Data and Artificial Intelligence Authority (SDAIA) supervises it, and the Implementing Regulations and a separate Regulation on Personal Data Transfer outside the Kingdom set out the detail.

Key obligations for controllers include:

• a lawful basis for processing, with privacy notices and data subject rights to be informed, access, correction and destruction;
• records of processing activities, kept for as long as the processing continues and for a period after it ends;
• impact assessments for high-risk processing and new products or services that involve personal data;
• a data protection officer in defined cases, such as public bodies processing at scale or controllers whose core activities involve sensitive data or regular monitoring;
• notification of personal data breaches to SDAIA within 72 hours of becoming aware where the breach may harm data subjects, and notification of data subjects without undue delay where harm is likely;
• registration on SDAIA’s national data governance platform for certain controllers.

Penalties include fines of up to SAR 5 million for general violations, which can be doubled for repeat offences, and criminal penalties for disclosing sensitive data with intent to cause harm. Our KSA PDPL compliance guide includes a full checklist, and PDPL compliance under SDAIA oversight covers what supervision looks like now that the grace period has ended. More information is available from SDAIA.

NCA Essential Cybersecurity Controls (ECC)

The National Cybersecurity Authority (NCA) issues the Essential Cybersecurity Controls, the baseline for government organisations, their companies and private-sector organisations that own, operate or host critical national infrastructure. The ECC is organised into domains covering governance, defence, resilience, third-party and cloud security, and industrial control systems. It was first published as ECC-1:2018 and has since been updated.

The NCA also publishes more specific frameworks that may apply on top of the ECC, including the Cloud Cybersecurity Controls, the Critical Systems Cybersecurity Controls, the Data Cybersecurity Controls and the Operational Technology Cybersecurity Controls.

SAMA Cyber Security Framework

The Saudi Central Bank (SAMA) issued its Cyber Security Framework in 2017 for its member organisations, including banks, insurers and finance companies. The framework has four domains:

1. Cyber security leadership and governance.
2. Cyber security risk management and compliance.
3. Cyber security operations and technology.
4. Third-party cyber security.

It uses a maturity model from level 0 to level 5, and member organisations are expected to reach at least level 3. That means controls must be defined, approved and consistently implemented, not just documented. SAMA has also published IT governance and business continuity frameworks.

How do UAE and Saudi requirements compare?

The two countries cover similar ground, but the authorities, deadlines and scope rules differ, so you cannot simply reuse one country’s evidence pack for the other.

For a side-by-side legal comparison, see our guide to KSA PDPL versus UAE data laws. If you also operate elsewhere in the Gulf, our guides to the Bahrain PDPL and the Qatar PDPPL cover those regimes.

How do cross-border data transfer rules differ?

Every regime discussed here restricts transfers abroad, but on different terms. You need a transfer record that shows which rule applies to each data flow.

• UAE Federal PDPL: transfers are allowed to countries with adequate protection. Otherwise they need a recognised basis, such as a contract with adequate safeguards, the data subject’s express consent or another listed exception.
• DIFC and ADGM: each has its own adequacy approach. Without adequacy you need appropriate safeguards, such as standard contractual clauses or binding corporate rules, or a specific derogation. A transfer from the DIFC to the UAE mainland counts as a transfer out of the DIFC.
• UAE health data: the federal ICT in health law generally requires local storage. Treat health data as a separate category with its own approval route.
• Saudi PDPL: the Transfer Regulation allows transfers based on adequacy, appropriate safeguards (including SDAIA’s standard contractual clauses, binding common rules or certification) or limited exceptions. In some cases you must carry out and document a transfer risk assessment.
• Saudi cybersecurity rules: NCA controls and government cloud policies set in-Kingdom hosting expectations for many government and critical infrastructure systems, separate from the PDPL.

In practice: most transfers happen through vendors, so link each vendor to the data it receives, where it processes it and the safeguard you rely on. Enactia’s vendor and third-party management module includes data transfer records, transfer impact assessments and an interactive data transfer map for this purpose.

What should GRC software support for GCC organisations?

Look for local framework content, the ability to run several jurisdictions in one place, and the core privacy and security workflows the laws require.

Local and international frameworks

• Ready-made control sets for the frameworks you actually face: UAE PDPL, DIFC, ADGM, UAE IA Standards, ADHICS, Saudi PDPL, NCA ECC and SAMA CSF. Ask vendors which of these are maintained in their catalogue and which you would have to build yourself.
• Cross-mapping to ISO 27001, NIST CSF and the GDPR, so one control and one piece of evidence can serve several frameworks.
• Support for maturity scoring, which the SAMA framework requires, as well as pass/fail compliance assessments.

Multi-jurisdiction and multi-entity structure

• Separate legal entities, regulators and applicable frameworks under one group view.
• Different breach notification clocks and authorities per entity, triggered from a single incident record.
• Data subject request handling that applies the right rules and response times for each jurisdiction.

Arabic and English

Many regulators publish in Arabic, with English translations that may be unofficial, and policies often need to be issued in both languages. Check whether the platform’s interface, policy documents, staff attestations and reports support Arabic, including right-to-left text, or whether you would manage Arabic versions as attached documents.

Core privacy and security workflows

• Records of processing activities linked to assets, systems and vendors.
• DPIA and transfer assessment workflows with approvals.
• An incident and data breach register with impact assessment and reporting templates.
• A central risk register with configurable scoring, owners and treatment plans.
• Policy lifecycle management, vendor due diligence, and audit and evidence management with a full audit trail.

Hosting and data residency

The GRC platform itself holds sensitive information, such as incident details and data subject requests. Ask where it is hosted and whether that fits the NCA, SAMA or health data rules that apply to you.

How do you choose between GRC platforms in the region?

Choose based on your regulatory footprint, the size of your team and how much configuration you can support.

• Enterprise suites such as SAP GRC, Archer or OneTrust tend to suit large organisations with dedicated administrators and complex enterprise risk or audit needs. Setup and licensing are usually heavier.
• Regionally focused vendors often have deep local framework content for one country or sector. Check how well they handle other jurisdictions and international standards if you operate across borders.
• Integrated privacy and security platforms combine data protection and cybersecurity GRC in one tool. They suit DPO and CISO teams who want to stop running two systems for the same vendors, assets and incidents.

Local implementation partners also play a large role in the Gulf, especially in public-sector and banking projects, so check that the platform suits how your advisors work.

Enactia sits in the third group. It is a cybersecurity and data protection GRC platform whose supported frameworks and regulations include SAMA, NESA, ADHICS, PDPL, the DIFC law and the UAE law alongside ISO 27001, ISO 27701 and NIST CSF. Its modules cover ROPA, DPIA, data subject requests, incident and data breach management, vendor management, policy, asset and enterprise risk management. It is available as a complete platform or as individual modules.

What does a GRC implementation roadmap look like?

A phased rollout works best: confirm scope, build a single control library, run the core workflows and then move to continuous monitoring.

1. Map your regulatory footprint. List every legal entity, where it is established (mainland, DIFC, ADGM, other free zone or Saudi Arabia), its sector regulators and the frameworks that apply. Record the reasoning, because scope decisions are often challenged in audits.
2. Inventory data, assets and vendors. Build your processing records, asset register and vendor list, and link them together. Flag sensitive and health data, and every flow that leaves a jurisdiction.
3. Build one control library. Load the relevant frameworks and map overlapping requirements to shared controls. For example, a single access control can serve NCA ECC, SAMA CSF, the UAE IA Standards and ISO 27001.
4. Run a baseline assessment. Assess each entity against its frameworks, score SAMA maturity where relevant and record gaps as risks with owners and deadlines.
5. Set up the time-critical workflows. Configure breach notification paths for each authority, including SDAIA’s 72-hour window, together with data subject request handling and DPIA triggers. Test them with a tabletop exercise.
6. Close gaps and approve policies. Publish bilingual policies where needed, collect staff acceptance and attach evidence to each control.
7. Bring in vendors. Send due diligence questionnaires, record transfer safeguards and schedule reassessments according to risk.
8. Monitor and report. Use dashboards for management and boards, run internal audits on a fixed schedule and track regulatory changes. GCC regulators update their frameworks regularly.

Common mistake: treating the framework with the nearest audit as a standalone project, then collecting the same evidence again for the next regulator. Build the shared control library first.

Frequently asked questions

Does the UAE Federal PDPL apply to companies in the DIFC?
Generally not to their processing within the DIFC. The Federal PDPL excludes free zones that have their own data protection legislation, which includes the DIFC and ADGM. A DIFC entity follows DIFC Law No. 5 of 2020, but a group with mainland UAE entities will also need to comply with the Federal PDPL for those entities.

Who must comply with the NCA Essential Cybersecurity Controls?
The ECC applies to government organisations in Saudi Arabia, including ministries, authorities and their companies, and to private-sector organisations that own, operate or host critical national infrastructure. Suppliers often adopt it because government clients require it.

What maturity level does the SAMA Cyber Security Framework require?
SAMA expects member organisations to reach at least maturity level 3, meaning controls are defined, approved and consistently implemented across the organisation. GRC software should let you record and evidence maturity per control, not just compliant or non-compliant.

How quickly must a data breach be reported in Saudi Arabia?
Under the PDPL Implementing Regulations, controllers must notify SDAIA within 72 hours of becoming aware of a personal data breach that may cause harm to data subjects. Affected data subjects must be informed without undue delay where the breach is likely to harm them. Sector regulators such as SAMA or the NCA may have their own incident reporting requirements.

Can one GRC platform cover both UAE and Saudi compliance?
Yes, if it supports several entities and frameworks with cross-mapping. Configure each legal entity with its own applicable laws and regulators, then map shared controls so that evidence collected once can support assessments under several frameworks. Confirm that the specific control sets you need are maintained by the vendor.

Building a GCC compliance programme that scales

Compliance in the UAE and Saudi Arabia means satisfying several authorities at once. Map your footprint, build one control library, configure the time-critical breach and request workflows for each regulator, and keep vendor and transfer records current. Enactia’s AI-powered GRC platform brings data protection and cybersecurity frameworks for the region together with ISO 27001 and international standards.

To discuss your UAE or Saudi compliance programme, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.