The Extraterritoriality of the GDPR and Its Effect on GCC Businesses

This article considers the extraterritoriality of the General Data Protection Regulation (gdpr) and its effect on Gulf Cooperation Council (gcc) businesses. Given the robust economic ties to the European Union (EU), many gcc businesses fall under the scope of the gdpr. This article argues that the territorial gateways through which the gdpr applies are much wider than might be thought and so may capture many gcc businesses, and that while the personal data protection laws in the gcc countries have been influenced to varying degrees by the gdpr, there are significant disparities, especially regarding their approach to data protection. This suggests that the level of data protection in the gcc countries is not equivalent to that offered by the gdpr. The article is divided into six sections, covering the EU’s data protection laws, framework evolution, gdpr’s impact on gcc businesses, and gcc’s data protection framework.