Where a business is located, or where its servers sit, no longer settles which data protection law applies to it. Egypt, Saudi Arabia and the United Arab Emirates each provide for circumstances in which their laws reach activities beyond their borders. What differs, and differs materially, is the connection each one requires.
From a compliance perspective, that difference is where scope assessments most often go wrong. The three regimes are routinely treated as variations on a single theme. They are not.
This article examines the extraterritorial application of Egypt’s Personal Data Protection Law No. 151 of 2020 (the “Egyptian PDPL”), Saudi Arabia’s Personal Data Protection Law, issued pursuant to Royal Decree No. M/19 dated 09/02/1443 AH, as amended by Royal Decree No. M/148 dated 05/09/1444 AH (the “Saudi PDPL”), and the UAE’s Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the “UAE PDPL”). It considers the principal connecting factors under each framework and what they mean for controllers and processors operating across jurisdictions. The UAE discussion is limited to the federal regime and does not separately examine the DIFC or ADGM frameworks.
Egypt: An Offence-Based Rule of Jurisdiction
Article (1) of the law promulgating the Egyptian PDPL sets out its general subject matter: the protection of personal data relating to natural persons that is processed electronically, whether wholly or partly, by a holder, controller or processor.
The express provision on application beyond Egypt’s borders appears in Article (2) of the promulgating law. Notably, it is not framed as a general scope rule. It is framed by reference to the commission of offences under the accompanying PDPL.
Under that provision, the Egyptian PDPL applies to persons committing such offences in three circumstances:
- Egyptian offenders: where the offender is Egyptian, whether the offence is committed inside or outside Egypt.
- Non-Egyptian offenders residing in Egypt: where the offender is a non-Egyptian residing in Egypt.
- Non-Egyptian offenders outside Egypt: where the act is punishable in the state in which it occurred, under any legal characterisation, and the data concerned relates to Egyptians or foreigners residing in Egypt.
The Third Limb: Two Cumulative Conditions
The third category is where the analysis becomes demanding. In addition to the commission of an offence under the Egyptian PDPL, the provision imposes two cumulative conditions. First, the conduct must also be punishable in the state where it occurred. Second, the personal data concerned must relate to the specified categories of data subjects.
Double criminality, however, is not a requirement of identical treatment. The provision does not demand the same designation or classification of the offence under both legal systems. It is sufficient that the conduct constituting the offence under the Egyptian PDPL is also punishable where it occurred, whatever its legal characterisation.
The wording also appears to distinguish between the nationality and the residence of the affected data subjects. The provision refers to data relating to “Egyptians or foreigners residing within the Republic.” On a natural reading, the residence requirement attaches to foreign nationals rather than to both groups. The provision may therefore extend to offences involving the personal data of Egyptians residing abroad, provided its other conditions are satisfied. That interpretation remains subject to judicial clarification.
Egypt’s approach therefore differs from the processing-based connecting factors adopted under the Saudi and UAE PDPLs. Their express provisions on overseas parties focus, respectively, on data relating to individuals residing in Saudi Arabia and individuals inside the UAE. The Egyptian PDPL frames its reach instead by reference to offences and the specified connections of offenders and affected individuals to Egypt.
A Different Test from the GDPR
The contrast with the European Union’s General Data Protection Regulation (the “GDPR”) is instructive. Article 3(1) of the GDPR applies to processing in the context of the activities of an EU establishment, regardless of where the processing occurs. Article 3(2) extends to controllers or processors not established in the EU where the processing relates to offering goods or services to individuals in the EU, or to monitoring their behaviour insofar as it takes place there. Neither test replicates Egypt’s offence-based formulation, or the requirement, for non-Egyptian offenders abroad, that the conduct also be punishable where it occurred.
The practical consequence is clear. Egypt’s express provision must be examined through its offence-based conditions. It cannot be treated as interchangeable with a general processing-scope test. As the following sections show, other regimes may reach the same activities through entirely different connecting factors.
Saudi Arabia: Processing Within and Beyond the Kingdom
Article (2)(1) of the Saudi PDPL defines its scope by reference to processing within the Kingdom and processing undertaken by parties outside it. It covers the processing of personal data relating to individuals that takes place in the Kingdom by any means and expressly extends to processing by parties outside the Kingdom where the data relates to individuals residing in the Kingdom.
Under the extraterritorial limb, the express connection between the individual and the Kingdom is residence, not nationality. The provision does not distinguish between Saudi nationals and foreign nationals residing there. Conversely, Saudi nationality alone does not establish that this limb applies to processing relating to a Saudi national residing abroad.
A local establishment is not a prerequisite. An overseas party may fall within scope without any presence in the Kingdom. Article (33)(4) reinforces that position by expressly addressing mechanisms to monitor the compliance of controllers and processors outside the Kingdom when they process personal data relating to individuals residing there, together with procedures for enforcement outside the Kingdom. Territorial scope and the practical means of supervising an overseas party are, in other words, distinct questions.
The breadth of the provision is reinforced by the definition of processing, which covers manual and automated operations such as collecting, recording, storing, using, disclosing, transmitting and destroying personal data. An overseas service provider may therefore fall within scope even where its activities take place entirely outside the Kingdom. That scope remains subject to applicable exclusions, including the conditional exclusion for an individual’s processing for personal or family purposes under Article (2)(2).
Residence Is Not Presence
The Saudi approach is closer to that of the UAE in expressly covering overseas parties. The wording, however, differs. The Saudi provision refers to individuals “residing” in the Kingdom; the corresponding UAE provision refers to individuals “inside” the UAE. Residence and physical presence are not interchangeable connecting factors.
The distinction may matter where an individual travels or is temporarily abroad. It should not, however, be used to infer that the UAE PDPL ceases to apply whenever an individual leaves the country. Article (2)(1)(a) separately refers to data subjects residing in the UAE or having a place of business there. Each provision must be read within the wider scope of its own law.
The UAE: Three Categories of Connection
Article (2)(1) of the UAE PDPL addresses three categories of connection to the UAE:
- Data subjects: those residing in the UAE or having a place of business there.
- Controllers and processors in the UAE: those residing in the UAE that process personal data relating to individuals inside or outside the country.
- Controllers and processors abroad: those residing outside the UAE that process personal data relating to individuals inside the country.
The third category expressly captures overseas controllers and processors. The relevant connection is the processing of personal data relating to individuals inside the UAE. The provision does not make a local establishment a prerequisite, and its wording is not limited to UAE nationals. An overseas provider may therefore fall within scope even though it has no physical presence in the country.
Scope must also be read alongside the exclusions. These include:
- government data, governmental entities controlling or processing personal data, and personal data held by security and judicial authorities;
- personal health data and banking or credit data that are subject to legislation regulating their protection and processing; and
- companies and establishments in free zones with special personal data protection legislation.
A connection to the UAE is therefore only the starting point. It remains necessary to determine whether the processing falls within the federal regime or within an applicable exclusion.
Key Differences and Practical Implications
Extraterritorial application turns data protection compliance into a question of legal connections, not geography. Operating outside Egypt, Saudi Arabia or the UAE does not, of itself, place a controller or processor beyond the reach of the relevant law. On the express wording of these provisions, neither the location of a business, nor the situs of its servers, nor the absence of a local establishment is a reliable basis for assuming exclusion.
The three regimes should not be treated as equivalent:
- Egypt: an offence-based rule of jurisdiction. It turns on the nationality or residence of the offender and, for non-Egyptian offenders abroad, on the cumulative conditions of punishability in the place of commission and a prescribed connection between the data and Egypt.
- Saudi Arabia and the UAE: scope rules attached to processing. They extend to overseas parties by reference to individuals residing in the Kingdom and individuals inside the UAE respectively.
Residence, physical presence and nationality are distinct connecting factors. Conflating them is a recurrent source of error in scope assessments.
The Question Is Not Always “Which Law?”
It follows that the central question is not always which regime governs, but which requirements apply concurrently and whether they can be satisfied together. Overlapping jurisdiction does not, in itself, establish a conflict. The Egyptian third limb illustrates the point: because it requires that the conduct also be punishable where it occurred, a measure of parallel exposure is inherent in its design.
A true conflict arises only where compliance with one applicable requirement necessarily entails breach of another. Even then, it calls for analysis of the specific obligations and the lawful options available, not an assumption that the law of the business’s home jurisdiction prevails.
A Structured Methodology
Controllers and processors operating across these jurisdictions should adopt a structured and documented methodology. Each processing activity should be assessed against:
- the relevant law’s own connecting factors, material scope and exclusions;
- where the processing occurs and where the parties operate; and
- the nationality, residence or location of the affected individuals.
Particular attention should be paid to the exclusions that may displace the federal UAE regime, including free zones with their own data protection legislation, and to the practical distinction between territorial scope and the mechanisms by which an overseas party may in fact be supervised and held to account.
Where an actual conflict is identified and no applicable coordination mechanism resolves it, the appropriate course is to evaluate the specific requirements and any available exceptions, and to consider early engagement with the competent regulators before proceeding.
Closing Reflection
Ultimately, the reach of these laws is often underestimated. Location is where the analysis begins. It is rarely where it ends.
A jurisdiction-specific assessment, documented and kept under review as the regional frameworks and their implementing instruments develop, provides a materially stronger foundation for cross-border compliance than reliance on the location of a business, its infrastructure, or a single regional standard. In a region where data crosses borders as readily as capital, precision in scope assessment is no longer optional. It is essential.
