Resources · GCC compliance

The rules change at every border.
The platform does not.

A short guide to the frameworks cloud buyers in the UAE, Saudi Arabia and Bahrain most often answer to, what each is about, and what a platform can and cannot do for you. Orientation, not legal advice.

Bring your framework Sovereignty

UAESaudi ArabiaBahrain

Three separate white data halls on glass plinths, each with its own shield and document panel, linked by thin lines

Three terms

Residency, sovereignty, localisation.

They are often used as if they meant the same thing. They do not, and regulators write them differently.

Data residency

Where data is physically stored. Knowing that your data sits within UAE borders is a residency answer.

Data sovereignty

Whose laws govern the data, including who may access it and how. Data hosted and governed in Saudi Arabia under Saudi law is a sovereignty answer.

Data localisation

A requirement that certain categories of data stay within national borders. It is common for government, defence and financial data.

By country

The frameworks buyers most often answer to.

Names as published by each regulator. Which ones apply depends on your sector, your customers and where you operate.

United Arab Emirates

UAE PDPL: Federal Decree-Law No. 45 of 2021 on personal data protection
UAE Information Assurance Regulation: issued by TDRA, building on the NESA information assurance standards
DESC Information Security Regulation and CSP Security Standard: required of cloud providers serving Dubai government and semi-government entities
ADHICS: Abu Dhabi’s healthcare information and cyber security standard
DIFC Data Protection Law: for firms in the Dubai International Financial Centre

Saudi Arabia

PDPL: the Personal Data Protection Law, overseen by SDAIA
NCA ECC: the Essential Cybersecurity Controls, the national baseline
NCA CCC: the Cloud Cybersecurity Controls, for cloud providers and cloud users
SAMA Cyber Security Framework: for financial institutions, in addition to the NCA baseline

Bahrain

PDPL: Law No. 30 of 2018, in force since August 2019
CBB Rulebook: cyber security requirements for institutions licensed by the Central Bank of Bahrain

Elsewhere in the GCC

Qatar, Oman and Kuwait each have their own data-protection and sector rules
Ask us for the frameworks that apply to where you operate

By sector

What regulators tend to ask for.

Government

Residency, citizen data protection, national security controls and continuous monitoring.

Banking and financial services

Central-bank cyber frameworks, encryption, audit logging, identity management and disaster recovery.

Healthcare

Patient data protection, access control and audit trails.

Telecommunications

Critical infrastructure security, network segmentation and security monitoring.

Enterprises and ISVs

Customer data protection, multi-tenant security and support across the region.

Can and cannot

Evidence is ours to produce. Certification is yours to hold.

A platform cannot

Certify you: certification belongs to the operator and its assessor
Decide how your data is classified
Replace legal advice on which rules apply

Oasis Stack does

Host in the jurisdiction you choose, with residency rules per dataset
Enforce identity, encryption and policy on every service
Keep keys under your custody
Produce compliance evidence continuously with the Governance, Security & Compliance module, with controls mapped to NCA ECC and PDPL

Sources: NCA Cloud Cybersecurity Controls · DESC certifications · Bahrain Personal Data Protection Authority

Your framework

Bring the framework you answer to.

We map it to the platform’s controls, as additional scope, and show you the evidence each one produces.

Compliance Talk to us