Resources · Regulatory watch: Middle East and Africa
Compliance regulations Middle East 2026: where each GCC and African law stands today
One line per law on its current status, with dates only where the regulator’s own sources confirm them.
Where things stand
Most of these laws are already in force. The detail is still arriving.
The UAE, Saudi Arabia, Qatar, Bahrain, South Africa and Nigeria all have data protection laws in force, beside sector and emirate rules such as NCA ECC, SAMA CSF, DESC ISR and ADHICS. Some instruments are still unpublished, such as the UAE PDPL’s Executive Regulations.
The regulator or your customers’ auditors judge your programme; Sterling’s expert and experienced consultants build the controls and evidence with your team.
Regulations and schemes
Twelve regulations and where each stands
Start with the country where you operate.
- UAE PDPL Compliance Consulting (Federal Decree-Law 45 of 2021)In force since 2 January 2022; Executive Regulations not yet listed on the official portal.
- Saudi PDPL Compliance ConsultingIn force since 14 September 2023; the adjustment period ended 14 September 2024.
- NCA ECC Compliance Consulting (Saudi Arabia)ECC-2:2024 has replaced ECC-1:2018; the NCA has published no transition deadline.
- SAMA Cyber Security Framework Compliance ConsultingVersion 1.0 applies under SAMA circular No. 381000091275 to the sectors SAMA addresses.
- UAE Information Assurance Standard Compliance ConsultingApplies to the critical entities TDRA designates; confirm the version your designation applies.
- DESC ISR Compliance Consulting (Dubai)Issued by DESC on e-mail request; DESC’s CSP Security Standard cites ISR:2017 v.02.
- ADHICS Compliance Consulting (Abu Dhabi Healthcare)The 3 February 2019 DoH standard is the version EIAC lists.
- DIFC Data Protection Law Compliance and Requirements: DIFC Law No. 5In force since 1 June 2020; consolidated version dated July 2025.
- Qatar PDPPL Compliance and Requirements: A Programme That Holds UpLaw No. 13 of 2016 applies; the NCSA publishes guidelines for regulated entities.
- Bahrain PDPL Compliance and Requirements: Law No. 30 of 2018Operational since 1 August 2019; breaches reported to the Authority within 72 hours.
- POPIA Compliance and Requirements: South Africa’s Privacy LawMain provisions commenced 1 July 2020; the Information Regulator supervises.
- Nigeria Data Protection Act Compliance and Requirements: NDPA 2023Signed into law on 12 June 2023; the NDPC unveiled its GAID on 20 March 2025.
Status is as each page confirms at its last update; confirm yours with the regulator and your legal advisers. The full list for the region is in the menu.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions on Middle East and Africa compliance regulations
Each regulation page goes further.
Does a free zone company follow the UAE PDPL?
Not where the free zone has its own data protection law, as the DIFC and ADGM do. Confirm your position with your legal advisers.
Can we get certified to one of these laws?
Not to the data protection laws: none issues a certificate. ADHICS and Qatar NIA have their own assessment routes. ISO/IEC 27701 certification can evidence a programme but is not legal compliance.
We operate in several of these countries. Do we need separate programmes?
Usually one programme with country additions: records, security controls and breach handling carry across; lawful bases, transfers and registration differ by country.
Talk to a consultant
Tell us which regulations apply to you
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice