Our guide Is AI watching me? and FAQ 9 explain that most Gulf states now have data-protection laws. This page picks up where they stop. It covers what you can actually do when an AI system is part of a decision about you, and how to do it.

This is a plain-language summary for orientation, not legal advice. Laws and regulations change, so for anything important, check the current text or speak to an adviser.

The short answer

  • You can usually ask what an organisation holds about you, and why. Every GCC state with a general data-protection law lets you find out what personal data an organisation processes about you, and most also let you have it corrected.
  • Rights over automated decisions differ by country. The UAE and Bahrain laws explicitly let you object to, or ask for a person to reconsider, decisions made by automated systems, with exceptions. Qatar's regulator says a person should review automated decisions that may be discriminatory. In Saudi Arabia, where an organisation relies on your consent for decisions made solely by automated processing, that consent must be explicit, and you can withdraw it.
  • Deadlines are set in some countries, not all. Saudi Arabia: 30 days (extendable by 30). Bahrain: 15 working days for access. Oman: 45 days. Qatar: 30 calendar days, under the regulator's guidelines. The UAE federal law sets no deadline, and its Executive Regulations have not been issued.
  • If you get no answer, you can complain to a regulator. The regulators are SDAIA in Saudi Arabia, the Personal Data Protection Authority in Bahrain, the Ministry of Transport, Communications and Information Technology in Oman and the National Cyber Security Agency in Qatar. In the UAE, the law names the UAE Data Office, whose functions are to move to a new AI and Data Authority.
  • A proposal in Saudi Arabia would make silence count as a refusal. Under amendments SDAIA put out for consultation in October 2026, a request not answered within the 30-day deadline (or a permitted extension) would be treated as rejected, and you could then complain to SDAIA. This is a proposal, not yet law.

Where AI meets your data

AI systems run on data, and much of it is personal. Three everyday situations show where your rights come in:

  • A job application screened by software. Some employers use tools that rank CVs or score video interviews. You may want to know what data was used and whether a person looked at the result.
  • A loan or credit card application. Lenders use automated scoring. If you are turned down, you may want the reasons and a human review.
  • A chatbot conversation. What you type into a company's chatbot is usually stored. You may want a copy of it, or want it deleted.

In each case the same few rights apply: to be told, to see, to correct, sometimes to object, and to complain. How strong each right is depends on where you live, and who you are dealing with.

Country by country

Main lawAsk for your dataAutomated decisionsReply deadlineWhere to complain
UAE (federal)Federal Decree-Law 45 of 2021Yes, free: what data is processed, why, who receives it and any decisions made by automated processing (Art. 13). A machine-readable copy of data you provided, where processing is based on consent or a contract (Art. 14)Right to object, with exceptions; a person must be involved in reviewing an automated decision if you ask (Art. 18)Not set in the law; Executive Regulations not yet issuedUAE Data Office (Art. 24). A new AI and Data Authority, announced in June 2026, is to take over the Data Office's functions
Saudi ArabiaPersonal Data Protection LawYes, access and a copy (PDPL Art. 4; Regulation Arts. 5–6)No objection right in the law. Where an organisation relies on consent for decisions made solely by automated processing, consent must be explicit (Regulation Art. 11)30 days, extendable once by 30 days with notice (Regulation Art. 3)SDAIA, within 90 days (PDPL Art. 34; Regulation Art. 37)
BahrainLaw 30 of 2018Yes, free, with proof of identity (Art. 18)Right to ask for a decision that is not solely automated, where it assesses your work performance, finances, creditworthiness, reliability or conduct; free. Does not apply to decisions made in entering into or performing a contract with you, if safeguards such as hearing your view are in place (Art. 22)15 working days for access; 10 working days for correctionPersonal Data Protection Authority, including when the deadline passes with no reply (Arts. 18, 25)
OmanRoyal Decree 6/2022 and Executive Regulation (Ministerial Decision 34/2024)Yes, a copy, free, by written request (Law Art. 11; Regulation Art. 16)No specific provision in the law45 days (Regulation Art. 16)Ministry of Transport, Communications and Information Technology, within 30 days of learning of the violation (Law Art. 12; Regulation Art. 41)
QatarLaw 13 of 2016Yes, access and correction (NCSA guidelines)Regulator's guidelines: you may object to decisions made solely by automated processing that may be discriminatory, and the response should be human review30 calendar days for requests to exercise your rights (NCSA guidelines)National Cyber Security Agency, through its individual complaint form
KuwaitNo general law; CITRA Data Privacy Protection Regulation (as amended by Decision 26 of 2024)Only for customers of CITRA-licensed telecom and internet providersNo specific provision found—CITRA, for providers it licenses

Sources for each row are listed at the end of the page.

United Arab Emirates

The federal law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022 (UAE Legislation). It includes several rights that bear directly on AI:

  • What you can ask for. On request and free of charge, an organisation must tell you what types of your data it processes, why, which sectors or organisations it shares it with, the rules for how long it keeps it, and any "decisions made based on automated processing, including profiling" (Article 13). The law also lets you receive data you provided in a machine-readable form where the processing is based on your consent or a contract and is automated (Article 14).
  • Objecting to automated decisions. You may object to decisions resulting from automated processing, particularly those with legal effects or that harm you (Article 18). The law defines automated processing to include systems that work with only "limited human supervision", not just fully automatic ones (Article 1). There are exceptions: if the automated processing is agreed in your contract, is required by another law, or you consented to it in advance, you cannot object. Separately, the organisation must include a person in reviewing an automated decision if you ask (Article 18(4)); the text does not limit this to cases where you can object.
  • Correction, erasure, restriction and portability are covered in Articles 14 to 16, and a right to stop certain processing, such as direct marketing, in Article 17.

Two important limits. First, the law does not apply to government bodies, or to banking, credit and health data that have their own laws, or to companies in free zones with their own data-protection rules (Article 2), such as the DIFC and ADGM (Chambers, 2026). So if a bank uses AI to score your loan, the main rules come from the Central Bank instead. Its 2026 guidance says consumers of licensed financial institutions, including insurers, "should be able to request human review or explanation of AI generated decisions" (CBUAE Guidance Note, 11 Feb 2026). Complaints about banks and insurers can go to Sanadak, the financial and insurance ombudsman, which was established in 2023 under Central Bank regulations and began operating in March 2024 (Sanadak).

Second, the law's Executive Regulations have not been issued. The law said they would follow within six months (Article 28), and organisations get six months after that to comply, which the Cabinet can extend (Article 29). As of 24 October 2026 the official legislation portal lists none, and the Chambers Data Protection & Privacy 2026 guide (March 2026) says they "have yet to be issued" and that the Data Office "has not yet become fully operational" (Chambers, BSA Law, 2026). The law is in force, but much of the detail it leaves to those regulations is still missing.

Who to complain to. The law names the UAE Data Office (Article 24). On 14 June 2026 the UAE announced a new Artificial Intelligence and Data Authority that brings together functions previously held by three bodies, including the UAE Data Office (Dubai Media Office). The announcement did not describe how it will handle privacy complaints. Until that is clear, start with the organisation's data protection officer, whom the law lets you contact directly (Article 12), and use the sector regulator where there is one.

Saudi Arabia

The Personal Data Protection Law (PDPL) came into force on 14 September 2023, and the one-year grace period for organisations to comply ended on 14 September 2024. SDAIA is the regulator (SDAIA guide).

  • What you can ask for. You have the right to be told the legal basis and purpose for collecting your data, to access it, to get a copy "in a readable and clear format", to have it corrected or completed, and to ask for its destruction when it is no longer needed (PDPL Article 4) (SDAIA, PDPL English text).
  • Deadline. The organisation must act on your request within 30 days. It can extend this once by up to 30 more days, but only if it tells you in advance and gives reasons (Implementing Regulation Article 3) (SDAIA, Implementing Regulation).
  • Automated decisions. The PDPL does not contain a right to object to automated decisions. The Implementing Regulation takes a different route. Where processing relies on your consent, that consent must be explicit when "decisions are made solely based on automated Processing" (Article 11). Organisations can also rely on other legal grounds, such as a contract or a legitimate interest, which do not need your consent (PDPL Article 6). Organisations whose activities involve automated decisions must tell you whether decisions will be made solely by automated processing (Regulation Article 4). You can withdraw consent at any time (PDPL Article 5), and the organisation must then stop processing without undue delay (Regulation Article 12). Withdrawal does not undo processing already done, and does not affect processing based on another legal ground.
  • Complaints. You can complain to SDAIA (PDPL Article 34) within 90 days of the incident or of when you learned of it (Regulation Article 37). SDAIA's National Data Governance Platform has a complaints service (SDAIA platform).

A proposal to watch. On 6 October 2026 SDAIA opened a public consultation, running until 5 November 2026, on amendments to the Implementing Regulation. Under the draft, the 30-day deadline would stay, but a request not fulfilled in time would be deemed rejected, and you could then complain to SDAIA. The draft would also reframe the extra safeguards for automated processing so that they apply to automated decisions that affect your rights or interests, not only decisions made solely by machine (Clyde & Co, 8 Oct 2026; Al Tamimi & Co, 9 Oct 2026). These are proposals and may change before they are adopted.

Bahrain

Law No. 30 of 2018 has been in force since 1 August 2019 (HFW, Oct 2024). Of the laws on this page, it sets the shortest deadlines (LLOC English text):

  • Access. With proof of identity, and free of charge, the organisation must tell you within 15 working days whether it processes your data and, if so, what and why (Article 18).
  • Automated decisions. If a decision is based solely on automated processing and assesses your "performance at work, financial standing, credit-worthiness, reliability or conduct", you can ask for it to be processed in a way that is not solely automated. Reconsideration is obligatory and free (Article 22). In plain terms, this covers credit scoring and assessments of employees. There is an exception: the right does not apply where the decision is made in entering into or performing a contract with you, provided suitable safeguards, such as hearing your view, are in place.
  • Correction or erasure of inaccurate or unlawfully processed data: a reply within 10 working days, free (Article 23).
  • Complaints. You can complain to the Personal Data Protection Authority if your access request is refused or if the deadline passes with no reply (Article 18), and generally about any breach of the law (Article 25). The Authority's site is pdp.gov.bh.

Oman

The Personal Data Protection Law (Royal Decree 6/2022) took effect in February 2023, and its Executive Regulation (Ministerial Decision 34/2024) was issued on 28 January 2024 (Qanoon.om, law; Qanoon.om, regulation). Qanoon.om is an unofficial publisher of the official Arabic texts. The law does not apply to some processing, including by government bodies carrying out their legal functions and processing to perform a contract you are party to (Law Article 3).

  • What you can ask for. A copy of your data, correction, updating or blocking, transfer to another organisation, erasure, and withdrawal of consent (Law Article 11).
  • Deadline. Make the request in writing. It is free, and the organisation must decide within 45 days. You can ask it to pause processing your data until it decides (Regulation Article 16).
  • Automated decisions. The law's list of rights does not include a specific right about automated decisions.
  • Complaints. You can complain to the Ministry of Transport, Communications and Information Technology (Law Article 12). Use the Ministry's form within 30 days of learning of the violation. The organisation has 14 days to reply to the complaint, and the Ministry should decide within 60 days after that; no decision in that time counts as a rejection (Regulation Articles 41–43).

Qatar

Law No. 13 of 2016 is enforced by the National Cyber Security Agency (NCSA) (DLA Piper, Jan 2024). The NCSA's Individuals' Rights guidelines (version 2.0, September 2022) explain the rights, including access, correction, erasure, objection and withdrawal of consent, and say organisations must respond to requests to exercise these rights within 30 calendar days. Under the law's right to object (Article 5), the guidelines say you may object to decisions made solely by automated processing where the processing may be discriminatory, and that an appropriate response is human intervention: a competent person should review the decision and change it if appropriate (NCSA guidelines; summarised by The Peninsula, 18 Apr 2026). Complaints go to the NCSA's Personal Data Privacy Protection Department, through the complaint form on its website (Marhaba, 26 Aug 2026; NCSA). The Qatar Financial Centre has its own separate rules.

Kuwait

Kuwait does not have a general data-protection law. The main privacy rules are in CITRA's Data Privacy Protection Regulation, as amended by Decision 26 of 2024, which now applies only to CITRA-licensed telecom and internet providers. It lets their customers access and modify their data, withdraw consent and have their data deleted, and CITRA can investigate complaints against the providers it licenses (Chambers, 2026; DLA Piper, Feb 2025). Outside that sector, some data provisions sit in general laws such as the electronic transactions law (Law 20 of 2014), but there is no general right to see your data.

How to use your rights: four steps

  1. Find the right contact. Look in the organisation's privacy notice for a data protection officer or a privacy email address. The UAE law requires organisations to provide clear ways to contact them (Article 19), and Oman's regulation requires a privacy policy, displayed where you can see it, explaining how to exercise your rights (Regulation Article 21).
  2. Ask in writing, and keep a copy. Email is fine. Be specific: say what decision or service you mean, and give dates. Expect to prove who you are. Bahrain's law and Saudi Arabia's regulation both provide for identity checks.
  3. Note the deadline. Write down the date you sent the request. Use the table above to work out when a reply is due.
  4. If there is no reply, or you disagree, complain. Go to the regulator listed above. Include your original request, any reply and the dates. For banks and insurers in the UAE, raise the complaint with the firm first; Sanadak handles complaints the firm has not resolved.

A sample request

You can adapt this letter. Delete the parts that don't apply.

Subject: Personal data request – [your full name]

Dear Data Protection Officer,

I am writing under [the personal data protection law of your country, e.g. "UAE Federal Decree-Law No. 45 of 2021" / "the Saudi Personal Data Protection Law and its Implementing Regulation" / "Bahrain Law No. 30 of 2018" / "Oman Royal Decree 6/2022" / "Qatar Law No. 13 of 2016"] about [my job application for (role) submitted on (date) / my application for (product) on (date) / my conversations with your chatbot between (dates)].

Please:

  1. Confirm whether you process my personal data and send me a copy of it.
  2. Tell me the purposes of the processing, and who you have shared my data with.
  3. Tell me whether any decision about me was made using automated processing, including profiling, and if so, what the decision was.
  4. [If a decision was automated] Have a member of staff review the decision and tell me the outcome. [UAE: Article 18. Bahrain: Article 22.]
  5. [Optional] Correct the following inaccurate data: [details]. / Delete my chatbot conversation history.

I attach [a copy of my ID / other proof of identity]. Please reply within the period set by law. [Saudi Arabia: 30 days. Bahrain: 15 working days. Oman: 45 days. Qatar: 30 days under NCSA guidelines.]

Yours sincerely, [Name, contact details, date]

What to expect

Most organisations want to get this right, and many requests are answered without fuss. An organisation can sometimes refuse, for example where a request is repetitive or would expose other people's data, but it should tell you why. In Saudi Arabia, Bahrain and Oman the rules say a refusal must give reasons. A human review does not guarantee a different result. It does mean a person has looked at your case, which is the point.

Rights also work best alongside good habits. The everyday advice in FAQ 9 still applies: don't paste ID numbers, medical records or passwords into public AI tools.

Sources

Primary texts

Secondary sources