How much data protection your first version needs in the Gulf

A first version does not need bank-grade security, but Gulf data laws now expect a few privacy basics from launch. Here is what to build now, what can wait and what to ask a team.

On 7 September 2026, amendments to Oman's Personal Data Protection Law came into force, the biggest change since the law was passed in 2022. The law now reaches anyone processing the personal data of people in Oman, even when the processing happens abroad, and it adds rules for decisions made by software, including AI. If you are scoping a first version for Gulf users, privacy can no longer wait until after launch.

That does not mean your MVP (minimum viable product, the smallest version you can put in front of real users) needs the security programme of a bank. It needs a short list of basics, built in from the first week.

What changed in Oman, and what already applies elsewhere

Oman's law has been fully enforceable since 5 February 2026, when its transition period ended. The September amendments, made by Royal Decree 68/2026, widened its reach beyond Oman's borders and replaced a prior-notification rule with a framework for automated decisions: users can object to a decision made by automated processing, and a person has to review it. Breaking those rules carries fines of OMR 5,000 to 10,000.

Saudi Arabia's PDPL has applied to most companies since 14 September 2024. Fines reach SAR 5 million, breaches must be reported to SDAIA, the regulator, within 72 hours, as in Oman, and most companies must register on SDAIA's National Data Governance Platform. The UAE has a federal law from 2021, while the DIFC and ADGM free zones run their own regimes. If you launch in more than one country, build to the strictest rule.

What a first version needs from day one

We would not cut any of these from a first version that collects personal data in the Gulf. None is expensive when planned early.

• A data map: one page listing every piece of personal data you collect, why you need it, where it is stored and who can see it.
• Less data. If a field does not serve a feature in this version, drop it. Data you never collect cannot leak.
• Clear consent and a privacy notice in Arabic and English, shown where the data is collected, with a way to contact whoever handles privacy.
• Logins done properly: passwords stored in a scrambled form that cannot be reversed, two-step login for admin accounts, and staff access limited to what each role needs.
• Encryption, meaning data is unreadable without a key, in transit and in storage.
• A way to find, export and delete one user's data on request. Oman gives you 45 days to answer a written request.
• A written breach plan: who decides, who calls the lawyer, and how you report within 72 hours.
• Hosting chosen on purpose. Moving data out of Oman comes with conditions, including the user's explicit consent, and Saudi rules limit transfers too. Decide where data lives before the build, not after.

The cheapest privacy feature is the field you never ask for.

What can wait until you have traction

Plenty can. A formal certification such as ISO 27001, a paid penetration test (an outside firm trying to break into your app), a full-time data protection officer and a round-the-clock security team are reasonable later, once you have paying users or larger customers asking for them. Saudi Arabia does require a data protection officer in specific cases, such as when processing sensitive data is your core activity, so check.

One thing cannot wait. If your product uses AI to make decisions about people, such as approving an application or scoring a customer, the human review path is no longer optional in Oman. Build a simple way for a user to flag a decision and for a person to look at it. Leave it out and you are exposed to fines of OMR 5,000 to 10,000.

What this does to your budget, timeline and risk

Planned from the start, most of this list adds days rather than weeks, plus a short legal review of your privacy notice. Added after launch, the same work means touching every screen that collects data, migrating stored records and sometimes moving hosting, while users already depend on the product.

A breach you cannot report on time, or a large customer's security questionnaire you cannot answer, can stall a launch or a sale for months. At Excodia Labs we write the data map in the first week of a project, before any screen is designed, because it changes what we build and where we host it.

Questions to ask any team before you sign

• Which personal data will the product collect, and can we see the data map?
• Where will the data be hosted, and does that work for each country we launch in?
• How will you store passwords and protect admin accounts?
• How would we export or delete one user's data, and how long would it take?
• If there is a breach on a Friday night, who finds out, and how?
• Who owns the cloud accounts and the encryption keys after handover?

A good team answers these in plain words. Vague answers here usually mean vague work later.

This week, list every field your first version will ask users for and cross out the ones no feature needs. Then send the six questions above to the teams you are talking to, and ask a lawyer in your main market to read your privacy notice before launch.