A single page listing every dated technology-compliance obligation across the GCC, with the regulator’s own source next to each one. It exists because most of what circulates on this subject is vendor marketing with invented dates attached, and because a date you can verify is worth more than a date you have to trust.
Last verified: 20 August 2026. Every entry below was checked against the issuing authority’s own website on that date. Where a date is circulating but does not appear on the regulator’s site, it is listed separately as unconfirmed rather than quietly included. If you find something out of date, tell me and I will correct it.
E-invoicing: confirmed deadlines
These dates appear on the tax authority’s own website. Saudi Arabia is the only GCC country where e-invoicing is already mandatory; the UAE is the only other one with binding published dates.
| Date | Country | Who | What becomes mandatory |
|---|---|---|---|
| 30 Oct 2026 | UAE | Revenue ≥ AED 50m | Accredited Service Provider must be appointed. Extended from 31 July 2026. |
| 1 Jan 2027 | UAE | Revenue ≥ AED 50m | Phase 1 go-live — issue, exchange and report e-invoices through an ASP. |
| 1 Feb 2027 | Saudi Arabia | VAT revenue above SAR 187,500 in 2022, 2023, 2024 or 2025 | Fatoora Wave 25 — integrate your e-invoicing solution with the ZATCA platform. |
| 31 Mar 2027 | UAE | Revenue < AED 50m, and government entities | ASP appointment deadline. |
| 1 Jul 2027 | UAE | Revenue < AED 50m | Phase 2 go-live. |
| 1 Oct 2027 | UAE | Government entities | Phase 3 go-live. |
Saudi Arabia’s Phase 2 has been rolling out wave by wave since 2023. Wave 24, covering everyone above SAR 375,000, closed on 30 June 2026 — so if your revenue is above that threshold and you are not integrated, you are already late rather than approaching a deadline.
E-invoicing: announced but not confirmed
These are circulating in advisory notes and vendor material. They may well be correct. They are not on the authority’s own site as of the verification date, so I would not plan a budget cycle around them without checking directly.
| Reported date | Country | Claim | Status |
|---|---|---|---|
| 1 Apr 2027 | Oman | Mandatory e-invoicing for annual supplies above OMR 5m, per Chairman’s Decision 189/2026 | Not on the Oman Tax Authority site, which still shows an earlier February 2027 phase |
| 1 Oct 2027 | Oman | All remaining VAT-registered persons | Same — reported, not published by the authority |
| 1 Jan 2027 | Qatar | Phased start for large taxpayers | A draft law was approved by the Council of Ministers in May 2026. It is a draft. No date, threshold or model has been published |
Bahrain and Kuwait have no e-invoicing mandate and no announced date at all. Bahrain’s National Bureau for Revenue has tendered for a platform; that is procurement, not a deadline. Kuwait has no VAT and no instrument. Any Bahraini or Kuwaiti e-invoicing date you are shown in a proposal was invented by the person showing it to you.
Data protection: where each country stands
Unlike e-invoicing, these are mostly already in force. The question is not when they start but whether you are complying with one you did not know applied to you.
| Country | Instrument | In force | Regulator | Prison in the penalties? |
|---|---|---|---|---|
| Bahrain | Law No. 30 of 2018 (PDPL) | 1 Aug 2019 | Personal Data Protection Authority, currently exercised through the Ministry of Justice | Yes — up to one year, plus fines of BHD 1,000–20,000 |
| Saudi Arabia | PDPL, Royal Decree M/19, as amended | 14 Sep 2023; enforcement from 14 Sep 2024 | SDAIA | Yes — up to 2 years for disclosing sensitive data with intent to harm or profit |
| Oman | Royal Decree 6/2022, with Executive Regulation 34/2024 | Feb 2023; grace period ended Feb 2026 | MTCIT | No — fines only, up to OMR 500,000 for unlawful transfer abroad |
| UAE | Federal Decree-Law 45 of 2021 | 2 Jan 2022 | UAE Data Office | No — and the executive regulations that define the penalties have still not been issued |
| Qatar | Law No. 13 of 2016 (PDPPL) | 2016, with a six-month adjustment period | National Cyber Security Agency | No — fines to QAR 5m. The QFC has its own separate regime |
| Kuwait | CITRA Decision 26 of 2024, Data Privacy Protection Regulation | 2024, replacing the 2021 regulation | CITRA | Not under the regulation — imprisonment arises under the cybercrime and e-transactions laws |
Two things in that table catch people out. The first is Bahrain and Saudi Arabia carrying criminal liability: in most of the world a data protection breach is a fine, and here it is not only a fine. The second is the UAE, where the law has been in force since January 2022 but the executive regulations defining the penalties have never been issued — which does not mean the obligations are optional, only that the consequences are not yet defined. When those regulations land, controllers get six months.
Cross-border transfer, at a glance
- Bahrain is the strictest on paper: transfers abroad require an adequacy listing or written authorisation.
- Saudi Arabia requires an adequacy assessment or listed safeguards, plus a risk assessment.
- Oman requires explicit consent and equivalent protection, and sensitive data needs Cyber Defence Centre approval before it leaves.
- UAE allows transfers to adequate jurisdictions or under contractual safeguards; sector rules for banking and health are stricter.
- Qatar runs the other way — the law forbids restricting cross-border flow except where processing itself breaches the law.
- Kuwait has no general prohibition, but the most sensitive government and institutional data must stay in country.
If any of that changes where your systems should live, the decision is cheapest before you launch and most expensive after you sign a regulated customer. I set out the arithmetic in where Gulf businesses should host.
How to use this
- Find your entities. Obligations follow where you are registered and where your customers are, not where your office is.
- Check the threshold, not the country. Most e-invoicing waves are revenue-banded, and the band that matters may be a prior year’s revenue rather than this year’s.
- Work backwards from the date. An e-invoicing go-live is an integration project with a service provider in the middle of it. The appointment deadlines exist because the work behind them takes months.
- Verify anything you are quoted. Every claim on this page links to the regulator. If a supplier cannot do the same for theirs, treat the date as marketing.
This page is a reference, not legal advice — I am a technology consultant, not a lawyer, and the authoritative text is always the one the regulator publishes. For the technology decisions underneath these dates, see how I work on digital transformation and the UAE’s 2027 deadlines in detail.
Sources
- Saudi Arabia — ZATCA, Wave 25 criteria and SDAIA, Personal Data Protection Law
- UAE — Ministry of Finance, amended e-invoicing timelines and Federal Decree-Law 45 of 2021
- Bahrain — Personal Data Protection Authority
- Oman — Oman Tax Authority, e-invoicing and MTCIT, personal data protection
- Qatar — General Tax Authority news
- Kuwait — CITRA regulations register