Three Gulf states now run three different data protection regimes. Saudi Arabia’s regulator has already issued dozens of enforcement decisions. Bahrain has had a working statute since 2019, and the UAE has a federal law on the books but is still waiting on the executive regulations that will give it teeth. For any company operating across the region, the practical question is no longer whether these laws apply but how far apart they sit, and where compliance built for one falls short of another. This is a structured comparison of the personal data protection laws in Bahrain, UAE, and Saudi Arabia: what each one demands, where they converge on familiar GDPR principles, and the specific points where treating them as interchangeable will get you fined. The Three Laws at a Glance Bahrain moved first. Law No. 30 of 2018, the Personal Data Protection Law (PDPL), came into force on August 1, 2019, making it the first comprehensive standalone data protection statute in the Gulf Cooperation Council. It is supplemented by ten ministerial resolutions issued in 2022 that cover transfers, security measures, and notification procedures. The UAE followed with Federal Decree-Law No. 45 of 2021, effective January 2, 2022 — the