Retired devices are one of the most overlooked sources of data breaches. A sold laptop, a returned lease phone or a decommissioned server can carry years of personal data. Every GCC state now has a data protection law that expects personal data to be protected until it is securely disposed of.
This guide is general information, not legal advice. Your legal or compliance team should confirm which rules apply to your organisation.
The laws at a glance
| Country | Main law | Regulator |
|---|---|---|
| UAE (federal) | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data | UAE Data Office |
| UAE: DIFC | DIFC Data Protection Law No. 5 of 2020 | DIFC Commissioner of Data Protection |
| UAE: ADGM | ADGM Data Protection Regulations 2021 | ADGM Office of Data Protection |
| Saudi Arabia | Personal Data Protection Law (Royal Decree M/19, amended 2023), enforceable since September 2024 | Saudi Data and AI Authority (SDAIA) |
| Qatar | Law No. 13 of 2016 on Personal Data Privacy Protection | National Data Privacy Office |
| Bahrain | Law No. 30 of 2018 on Personal Data Protection | Personal Data Protection Authority |
| Oman | Royal Decree No. 6 of 2022, Personal Data Protection Law (in force February 2023) | Ministry of Transport, Communications and Information Technology |
| Kuwait | Data Privacy Protection Regulation | Communication and Information Technology Regulatory Authority (CITRA) |
What these laws mean for IT disposal
- Security until the end. The laws require appropriate technical measures to protect personal data. That obligation does not end when a device is switched off for the last time.
- Destruction when data is no longer needed. Several laws, including Saudi Arabia’s PDPL, require personal data to be destroyed when its purpose ends. Retiring a device is exactly that moment.
- Processors and service providers. If an ITAD provider handles your devices, it is handling your data. Contracts should cover security, chain of custody and destruction standards.
- Breach exposure. Data recovered from a disposed device can count as a personal data breach, with notification duties and penalties.
Sector rules on top
Banks, insurers, healthcare providers, telecom operators and government entities often face extra rules from their own regulators, such as central bank requirements or national cybersecurity controls. In Saudi Arabia, the National Cybersecurity Authority’s Essential Cybersecurity Controls apply to many entities and include secure disposal of information assets.
A practical compliance checklist
- Include IT disposal in your data protection and information security policies. See our IT asset disposal policy outline.
- Use a provider that destroys data to a recognised standard such as NIST SP 800-88.
- Require serial-level certificates of destruction.
- Use on-site destruction where data must not leave your premises.
- Keep records with your asset register.
Need this done for you?
Gulf Asset Services buys used IT across the GCC and destroys the data on every device, with a certificate per serial number.
Get a quote in 24 hours