Your customer data is now regulated, not just risky — what MENA’s new privacy laws mean for the systems you run

For most of the last decade, "data privacy" was something a growing business in Egypt or the Gulf could file under "later." There was no local law with teeth, the regulator was theoretical, and the worst case felt like a reputational bruise. That era is over, and it did not end gradually. In 2020 only about 10 percent of the world’s population had its personal data covered by a modern privacy regulation; by the end of 2024 that figure had reached roughly 75 percent [1]. Privacy stopped being a Western edge case and became the default condition of doing business almost everywhere — including, finally and concretely, the markets Felukaa builds for.

The wave is not abstract anymore; it has dates. The UAE’s Personal Data Protection Law has been in force since the start of 2022 [4]. Saudi Arabia’s PDPL moved from a grace period into live enforcement in September 2024, and the regulator has already issued dozens of enforcement decisions with fines of up to five million riyals per violation [3]. And Egypt — which passed Law No. 151 of 2020 but left it dormant for years without executive regulations — issued those regulations in November 2025, starting a one-year clock that makes the law fully enforceable around October 2026 [2]. If you run a business that touches customer data in any of these markets, you are not waiting for a rule to arrive. You are inside a compliance countdown that has already started.

Here is the shift that matters for anyone who owns systems rather than reads statutes: privacy compliance is not a policy you write, it is a property your software has or does not have. Lawful consent, the right to be forgotten, knowing where every record physically lives, being able to export or delete one customer on request, notifying a breach inside a deadline — none of these can be bolted on with a cookie banner after the fact. They are decisions baked into how your CRM, your billing, and your customer database are built. This piece is the operator’s map of that shift: what the new MENA laws actually require of your systems, why "we’ll deal with it if someone complains" is the expensive path, and what it means to build privacy in rather than paint it on.

Start with the scale of the change, because it reframes everything that follows. Privacy regulation was not creeping forward — it jumped. Gartner’s widely cited forecast put the share of the global population covered by a modern privacy law at around 10 percent in 2020 and roughly 75 percent by the end of 2024 ^[1]. That is not a trend you can wait out; it is the new baseline. For a business in Egypt, the Gulf, or selling into the United States, the question is no longer "will there be a law" but "which laws already apply to me, and does my software satisfy them today." The honest answer for most operators running on a patchwork of spreadsheets, a global SaaS tool, and a WhatsApp thread is: nobody actually knows, which under the new regime is itself the problem.

Now the specifics, because the MENA laws are not vague aspirations — they impose concrete requirements on systems. Egypt’s framework, fully operational once the November 2025 executive regulations run their one-year grace to around October 2026, requires explicit, informed, specific consent before personal data is collected or processed, demands that consent requests be presented in Arabic and kept separate from general terms, and backs it with administrative and criminal penalties — fines that run from EGP 200,000 up to EGP 5,000,000 depending on the violation ^[2]. Saudi Arabia’s PDPL is already live: in its first year of enforcement the regulator issued dozens of decisions and can levy fines up to SAR 5,000,000 per violation, doubled for repeat offenders, for things as ordinary as processing data without a lawful basis or sending marketing messages without consent ^[3]. These are not edge cases — "we texted our customer list a promotion" is exactly the kind of everyday act now on the enforcement menu.

The requirement that quietly reshapes architecture is data residency and cross-border transfer. The UAE’s law restricts moving personal data outside the country to destinations with an adequate level of protection, or otherwise only under approved contractual safeguards or explicit consent, and certain regulated sectors must keep data onshore entirely ^[4]. This is where a lot of "we just use a cloud tool" stacks quietly break the law: if your customer records live on a server in another region with no lawful transfer basis, the convenience of that SaaS default has become a compliance liability. Knowing where every record physically sits — and being able to choose — is no longer an infrastructure detail. It is a legal one, and it is a question you can only answer cleanly if someone designed the system to answer it.

This is the core point for anyone who builds or buys software: compliance is a property of the system, not a document you attach to it. The new laws assume capabilities that have to exist in the data layer. Can you produce, on request, everything you hold about one customer (a subject-access request)? Can you delete that person entirely without orphaning records across five disconnected tools (the right to erasure)? Can you prove when and how consent was captured, and withdraw it as easily as it was given? Can you detect a breach and notify within a statutory window? Each of these is trivial in a system designed for it and nearly impossible in one that was not. A cookie banner satisfies none of them. This is why the disconnected-stack problem and the privacy problem are the same problem wearing different clothes: you cannot honour "delete me" across tools that do not agree on who the customer is.

Finally, the economics, because the case for building it in is not only legal — it is financial and commercial. Ponemon’s research across regulated organisations found non-compliance costs averaging about 14.8 million dollars a year against roughly 5.5 million for maintaining compliance — about 2.71 times more — once you count disruption, lost productivity, fines, and settlements ^[5]. And the upside is not just avoided penalties: customers now treat data handling as a buying criterion. In Cisco’s 2024 consumer survey, 75 percent of respondents said they would not buy from a company they do not trust with their data, and roughly half of those aged 25 to 34 had already switched providers over data practices ^[6]. For a Felukaa-built system, this is the argument in a sentence: privacy designed into the data model is cheaper than the fine, faster than the retrofit, and is itself a reason customers stay. Bolted on after a complaint, it is the most expensive line item nobody budgeted for.