Data protection regimes across the region — the UAE and Saudi personal data protection laws among them — arrived with a burst of activity: policies drafted, notices published, a lawful basis assigned, a responsible person named. Then the project closed. The obligations, which are almost entirely about ongoing conduct rather than documentation, did not.
The Gap Between Notice and Practice
Most privacy findings are not failures of drafting. They are the ordinary consequences of an organization continuing to operate: a new marketing tool that collects more than the notice describes, a support process that exports customer records to a spreadsheet, a supplier changed without anyone checking where the data now sits, a retention rule that was written down and never implemented anywhere.
None of these are dramatic. All of them are the difference between a policy and a practice, and it is practice that is examined when a subject makes a request, a supplier is breached, or a regulator asks how a specific record came to be held.
What Has to Keep Running
A record of processing that is maintained: updated when systems, suppliers and purposes change, rather than compiled once and archived.
Assessments before, not after: a route by which a new system or supplier is assessed for privacy impact while the decision can still be influenced.
Retention that is enforced somewhere: a retention schedule with no mechanism behind it is an intention. Regulators tend to ask what deletes the data, not what the policy says about it.
Rights requests as a rehearsed process: the first subject request should not be the first time anyone tries to locate every copy of a person's data.
Cross-border transfers reviewed: residency and transfer positions change when a supplier changes a region, and nobody is obliged to tell you.
Breach routes tested: notification obligations are time-bound, and the clock does not wait for an internal debate about who decides.
“Privacy is one of the few governance domains where the evidence a regulator wants is a description of ordinary behaviour, not of a project.”
Where It Usually Sits
Privacy governance often lands with legal, which owns the obligation but not the systems, or with security, which owns the systems but reads the obligation as a security control. Both are workable; neither is automatic. What matters is that someone holds the standing responsibility for the practice rather than the paperwork, and that they have enough authority to stop a launch when the answer is not yet.
