Markets

India and the Gulf, rule by rule.

Each market below is checked requirement by requirement, with key dates, breach deadlines, penalties and links to official sources.

IN17 requirements

India

The DPDP Act is a consent-centred law that applies to digital personal data and gives individuals rights to access, correction, erasure, grievance redressal and nomination. Most ob...

Read the summary →
AE19 requirements

United Arab Emirates (onshore)

The PDPL is the federal privacy law for onshore UAE and does not apply to government data, health data or banking and credit data covered by their own laws, or to the DIFC and ADGM...

Read the summary →
AE-DIFC20 requirements

Dubai International Financial Centre (DIFC)

The DIFC law is a GDPR-style regime for entities in the Dubai financial free zone, with lawful bases including legitimate interests, a full set of data subject rights and accountab...

Read the summary →
AE-ADGM19 requirements

Abu Dhabi Global Market (ADGM)

ADGM's regulations closely follow the GDPR and apply to entities established in or operating from the Abu Dhabi financial free zone. They require records of processing, DPIAs for h...

Read the summary →
SA18 requirements

Saudi Arabia

Saudi Arabia's PDPL applies to processing in the Kingdom and to processing of Saudi residents' data from abroad, with consent as the main lawful basis. It requires a privacy policy...

Read the summary →
QA16 requirements

Qatar

Qatar was the first GCC state with a standalone data protection law. It requires notice before processing, security measures, breach notification, and regulator approval for specia...

Read the summary →
BH16 requirements

Bahrain

Bahrain's PDPL covers processing of personal data in the Kingdom and backs key duties with criminal penalties. The 2022 resolutions add a 72-hour breach notification rule, a whitel...

Read the summary →
OM17 requirements

Oman

Oman's PDPL relies on express, provable consent as its basis for processing and requires a permit from MTCIT for sensitive data. Every controller must appoint a data protection off...

Read the summary →
SEBI-RA29 requirements

SEBI Research Analyst

A person who gives research reports or buy, sell or hold recommendations on securities for consideration must be registered with SEBI and enlisted with BSE as RAASB. The RA must di...

Read the summary →
SEBI-IA29 requirements

SEBI Investment Adviser

A person who gives investment advice on securities for consideration must be registered with SEBI and enlisted with BSE as IAASB, and acts in a fiduciary capacity towards clients. ...

Read the summary →