Across the Middle East, Africa and India, governments have introduced cyber security and data protection rules at a rapid pace. For organisations operating in more than one country, keeping track of what applies, and proving compliance, can feel overwhelming. This guide gives a high-level overview of the main frameworks and a practical way to approach them.
This article is for general information only and is not legal advice. Always confirm your specific obligations with your legal and compliance advisers.
United Arab Emirates
- UAE Information Assurance (IA) Standards, originally issued by NESA, set security controls for government entities and critical sectors.
- Dubai Information Security Regulation (ISR), issued by the Dubai Electronic Security Center, applies to Dubai government entities and many of their suppliers.
- UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) sets rules for processing personal data, alongside separate regimes in the DIFC and ADGM free zones.
- Sector regulators, such as the Central Bank of the UAE, also set specific cyber and outsourcing requirements for regulated firms.
Saudi Arabia
- NCA Essential Cybersecurity Controls (ECC) from the National Cybersecurity Authority set baseline controls for government and critical national infrastructure, with additional frameworks for cloud and critical systems.
- SAMA Cyber Security Framework applies to banks, insurers and other financial institutions regulated by the Saudi Central Bank.
- Personal Data Protection Law (PDPL), overseen by SDAIA, governs the collection, use and cross-border transfer of personal data.
Elsewhere in the region
- Qatar: the Personal Data Privacy Protection Law and national information assurance standards.
- South Africa: the Protection of Personal Information Act (POPIA).
- Kenya: the Data Protection Act, 2019, enforced by the Office of the Data Protection Commissioner.
- India: the Digital Personal Data Protection Act, 2023, and CERT-In incident reporting directions.
Common themes
Although the details differ, most of these frameworks ask for the same core capabilities:
- A documented information security governance structure with clear accountability.
- Risk assessments and an up-to-date asset and data inventory.
- Access control, MFA and privileged access management.
- Vulnerability management, secure configuration and patching.
- Logging, monitoring and timely incident detection and reporting.
- Business continuity, backup and disaster recovery.
- Third-party and supplier risk management.
- Lawful processing, consent, data subject rights and controls on cross-border transfers for personal data.
A practical approach: build once, comply many times
Rather than running a separate project for every regulation, build one control framework, often based on ISO/IEC 27001 or the NIST Cybersecurity Framework, and map each regulation’s requirements to it. This lets you:
- Run a single gap assessment that covers all relevant regulations.
- Prioritise the controls that satisfy the most requirements.
- Collect evidence once and reuse it for multiple audits.
- Adapt quickly when new rules or updates are published.
Don’t forget the technology
Policies alone will not pass an audit. Regulators increasingly expect evidence that controls work in practice: monitoring that detects incidents, data loss prevention that protects personal data, and logs that show who accessed what. Choosing tools that produce audit-ready reports saves significant effort later.
How A1 Technology can help
Our cyber security consulting team runs gap assessments and readiness programmes against regional and international frameworks, and our data security solutions help you put the technical controls in place. Contact us to discuss your compliance roadmap.
