Key Global and Regional Data Privacy Regulations

Data privacy regulations globally aim to address the customer concerns towards transparent and fair processing of personal data. Although various regulations have their respective territorial applicability provisions, yet lawful, fair and transparent processing is the one of the fundamental processing principles which most of the regulations speak about.

In this article we touch upon some of the prominent data privacy regulations globally including the geographies where ValueMentor has its foothold.

EU GENERAL DATA PROTECTION REGULATION (EU GDPR)

Since the time it came into force in May 2018, GDPR has been the benchmark for data protection practices. GDPR includes the principle of processing personal data, lawful basis of processing, speaks about conditions of consent, responsibilities of controller and processor and rights of data subject, among other things

 

• • Applicability: It applies to establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. Beyond the EU establishments, the EU GDPR covers companies outside of the EU that offer goods or services to EU Data Subjects (“an identified or identifiable person to whom the ‘personal data’ relates”), even if for free, or that monitor the Data Subjects’ behavior within the EU.

 

• • Penalty: Potential fines under the GDPR can reach €20m or 4% of global turnover – whichever is greater.

Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021 (DPR 2021)

Abu Dhabi Global Market (ADGM), enacted Data Protection Regulations 2021 on 11 February 2021. When preparing the DPR 2021, the ADGM carried out an international benchmarking study of international standards and best practice and concluded that the EU’s GDPR is the leading international standard and represents best practice for robust data protection legislation. The DPR 2021 are closely based on the GDPR, adapted to meet the needs of the ADGM.

 

• • Applicability: The DPR 2021 applies to “the processing of personal data in the context of the activities of an establishment of a controller or a processor in ADGM, regardless of whether the processing takes place in ADGM or not.” The location and nationality of the data subjects whose data is being processed is not relevant to the question of whether the DPR 2021 apply to any processing activity.

 

• • Penalty: Controller or processor can attract monetary penalties of up to $28,000,000 for intentionally or negligent contravention of the provision of DPR 2021 

Personal Data Protection Law, Federal Decree Law No. 45 of 2021 (UAE PDPL)

UAE PDPL constitutes an integrated framework to ensure the confidentiality of information and protect the privacy of individuals in the UAE. It provides a proper governance for data management and protection and defines the rights and duties of all parties concerned.

The law defines the controls for the processing of personal data and the general obligations of companies that have personal data to secure it and maintain its confidentiality and privacy. It prohibits the processing of personal data without the consent of its owner, except for some cases in which the processing is necessary to protect a public interest or to carry out any of the legal procedures and rights.

 

• • Applicability: The provisions of this Decree Law shall apply to the Processing of Personal Data, whether totally or partially, through automatically operated electronic systems or other means, by:

 

1. 1. any Data Subject who resides or has a place of business in the State (UAE)
   2. any Controller or Processor located in the State who carries out the activities of Processing Personal Data of Data Subjects inside or outside the State
   3. any Controller or Processor located outside the State who carries out the activities of Processing Personal Data of Data Subjects inside the State.
      
      

• • Penalty: Administrative penalties are not out yet.

India Digital Personal Data Protection Act, 2023 (DPDP Act, 2023)

The DPDP Act, 2023 was enacted on 11 August 2023. The Act regulates the governance of personal data collected by organisations and aims to protect individuals’ privacy by empowering them with rights over how their data is processed.

 

• • Applicability: The Act applies to the processing of digital personal data in two scenarios:

1. 1. Within Indian territory – where personal data is collected in:
      • Digital form, or
      • Non-digital form and subsequently digitised.
   2. Outside Indian territory – where processing relates to offering goods or services to data principals located within India.

 

• • Penalty: The Indian Data Protection Board has the power to issue penalties of up to INR 250 crore for non-compliance.

 

KSA PDPL (Saudi Arabia Personal Data Protection Law)

The Kingdom of Saudi Arabia has enacted the Personal Data Protection Law (“PDPL”) on 14 September 2023. PDPL aims to ensure the confidentiality of information and protect the privacy of individuals.

 

• Applicability: The KSA PDPL provides that it shall be applicable to the processing of personal data by companies or public entities, where the processing:

1. Takes place in the Kingdom of Saudi Arabia; or
2. Relates to the personal data of residents of the Kingdom by companies located outside the Kingdom.

 

• Penalty: For violations of other provisions of the PDPL, penalties are limited to a warning notice or a fine not exceeding SAR 5 million.

 

Conclusion

Data privacy regulation is no longer a single-market concern. From GDPR to ADGM’s DPR 2021, UAE PDPL, India’s DPDP Act, and  KSA PDPL, regulators across regions have converged on similar core principles lawful processing, transparency, and accountability even as applicability and penalty structures differ. For organizations operating across the EU, UAE, India, and KSA, this means compliance can’t be approached in silos. A unified data protection strategy, anchored in proven frameworks like GDPR, helps businesses meet overlapping requirements efficiently while avoiding the steep penalties each law carries. Partnering with experienced GDPR compliance services providers like ValueMentor ensures your organization stays ahead of evolving regulatory expectations across every jurisdiction you operate in.

 

FAQs

1. What are GDPR compliance services?
GDPR compliance services are advisory and implementation services that help organizations align their data processing practices with the EU General Data Protection Regulation, covering gap assessments, policy creation, DPO support, and audits.

 

2. Does GDPR apply to companies outside the EU?
Yes. GDPR applies to any organization outside the EU that offers goods or services to EU data subjects or monitors their behavior, regardless of where the processing occurs.

 

3. What is the maximum penalty for GDPR non-compliance?
Fines can reach €20 million or 4% of global annual turnover, whichever is higher.

 

4. How is ADGM’s DPR 2021 different from GDPR?
DPR 2021 is closely modeled on GDPR but tailored for entities operating within the Abu Dhabi Global Market, with penalties of up to $28,000,000.

 

5. Is UAE PDPL the same as GDPR?
No. UAE PDPL is a separate federal law (Decree Law No. 45 of 2021) with its own scope, though it shares core principles like consent and lawful processing with GDPR.

 

6. Who needs to comply with India’s DPDP Act, 2023?
Any entity processing digital personal data within India, or outside India if the processing relates to offering goods or services to individuals in India.

 

7. What penalties apply under India’s DPDP Act?
The Data Protection Board of India can levy penalties of up to INR 250 crore for violations.

 

8. What does Saudi Arabia’s PDPL require?
It requires companies processing personal data of KSA residents — whether located in the Kingdom or abroad – to ensure confidentiality and lawful processing, with fines up to SAR 5 million for violations.

 

9. Why do organizations need GDPR compliance services if they already comply with local laws?
Because many regional laws are modeled on GDPR, leveraging GDPR compliance services often satisfies the strictest requirements first, simplifying alignment with other regional frameworks.

 

10. How can ValueMentor help with multi-region data privacy compliance?
ValueMentor offers GDPR compliance services alongside support for ADGM DPR 2021, UAE PDPL, India’s DPDP Act, and Saudi PDPL, helping organizations build a single compliance framework across all operating regions.