NIS2, DORA and PDPL readiness: what the EU, UK, UAE and Saudi rules have in common
NIS2 and DORA (EU), the GDPR and UK GDPR, and the UAE and Saudi personal data protection laws have different scopes and regulators, but they ask for much of the same groundwork: know your systems, data and suppliers; assess risks; run basic security controls; detect and report incidents on time; manage critical suppliers; test continuity; and keep evidence. Building one control set mapped to every law that applies is far less work than separate projects. This is not legal advice.
If you operate in, or sell into, the EU, the UK, the UAE or Saudi Arabia, several security and data protection laws may apply to you at once. They have different scopes and different regulators, but they ask for much of the same groundwork. This post gives a plain overview of the main ones and the work they share.
This is a practical starting point, not legal advice. Whether a law applies to you depends on your sector, size and where you operate. Confirm specific obligations with qualified counsel.
The laws in brief
- NIS2 (EU Directive 2022/2555) sets cybersecurity and incident reporting requirements for medium and large organisations in a long list of sectors, such as energy, transport, health, digital infrastructure, manufacturing and some digital services. Each EU member state writes it into national law, so the details vary by country. Suppliers to organisations in scope often feel it through contracts even if they aren't in scope themselves.
- DORA (EU Regulation 2022/2554) is the Digital Operational Resilience Act for the financial sector: banks, insurers, investment firms, payment and e-money institutions and others. It covers ICT risk management, incident reporting, resilience testing and the management of technology suppliers. Critical technology suppliers to financial firms can come under direct oversight.
- GDPR and UK GDPR cover personal data in the EU and the UK, including the security of that data and reporting personal data breaches.
- UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) covers personal data processed in the UAE or about people there. The DIFC and ADGM free zones have their own data protection laws.
- Saudi Personal Data Protection Law covers personal data processed in Saudi Arabia or about residents there, with implementing regulations and rules on transfers outside the Kingdom.
Sector regulators in each market may add their own rules on top, for example for financial services or healthcare.
What they have in common
Read side by side, these laws keep asking for the same things:
- Know what you have. An inventory of systems, data, and the suppliers that touch them.
- Assess the risks and record the decisions you make about them.
- Basic security controls: access control, multi-factor authentication, patching, encryption, backups that have been tested, and logging.
- Incident handling. A way to detect incidents, decide quickly whether they must be reported, and report within the deadlines. The deadlines differ between laws and can be short.
- Supplier management. Knowing which suppliers are critical, what your contracts require of them, and what happens if one fails.
- Business continuity. Plans for keeping critical services running, and evidence they have been tested.
- Accountability. Named owners, management oversight, training, and records that show what was done.
A readiness plan in five steps
- Work out which laws apply. Map where you operate, which sectors you serve, whose personal data you hold and who your customers are. Get legal advice on the edge cases.
- Build one control set. Rather than separate projects per law, map the requirements onto one set of controls and note which law each control satisfies. Recognised frameworks such as ISO/IEC 27001 can provide the structure.
- Find the gaps. Compare what you do today with that control set. Incident reporting, supplier management and tested backups are common gaps.
- Fix in order of risk, starting with the controls that protect your most critical services and data.
- Keep evidence. Policies, logs, test results, training records and board minutes. Regulators and customers will ask for proof, not intentions.
A hypothetical example
A software company based in the UAE sells a payments-related product to banks in the EU and to retailers in Saudi Arabia. It is unlikely to be directly regulated under DORA, but its bank customers are, and their contracts pass DORA requirements down to it: incident notification, audit rights, exit plans. Its EU and Saudi customer data brings GDPR and the Saudi PDPL into play, and its home base brings the UAE PDPL.
One control set, mapped to all four, is far less work than four separate compliance projects.
Where to start
List the countries you operate in, the sectors you serve and the personal data you hold. That is enough to have a useful first conversation with counsel, and to see how much of the groundwork you already have.
Cybersecurity & compliance covers gap assessments and building that control set, and our compliance readiness package is a fixed-scope first step. For data protection specifically, see our data protection checklist.
Sources
Want help implementing this?
Book a free 30-minute call about your business. No obligation.