We provide PDPL training, including a new Certified KSA Data Protection Officer, or C-DPO.

The Saudi and the Gulf region needs more suitably qualified and experienced data protection professionals. It is not just about certifications – it is about learning how to do the job.

Our Training

Become a Certified KSA Data Protection Officer

We offer a unique certification blending classroom learning with hands-on mentorship, alongside shorter courses for flexible learning.

KSA Certified DPO

For privacy leaders and those aspiring to become DPOs

Learn More

Shorter Courses

PDPL Practitioner Certificate

Detailed advance course for those working in PDPL compliance

Learn More

PDPL Foundation Certificate

Basic introduction for IT, Risk, Security, Compliance, Legal & GRC Professionals

Learn More

THE VISIONARIES

Meet Our Leadership

Bilal Ghafoor

Managing Director

Bilal has 15 year’s of data protection experience and has lead global privacy programs for clients, including for some of the largest tech companies in KSA. He has trained hundreds of DPOs and is the designer of the KSA C-DPO course. The inclusion of mentoring in the course was inspired by him, replicating his own learning journey.

Certifications

View Profile on LinkedIn

Certifications

FIP

ISO 27701

CIPP/E

CIPM

Laura Palmariello

Senior Consultant

Laura has diverse experience in many industries, from energy to education and is our resident AI governance expert. She is known for practical advice.

Certifications

View Profile on LinkedIn

Certifications

FIP

AIGP

CIPP/E

What our clients say

Don’t just take our word for it. See what data protection professionals say about working with us.

Samer Jahar

Privacy & Data Protection Professional

Approaching the end of the PDPL course with GCC Data Protection Bilal Ghafoor FIP CIPP/E CIPM with the final session next week. Very informative and broken down well, so nothing felt overwhelming. What made it stand out was how it linked concepts to real world examples, and broke things down in plain English

REAd FULL REVIEW ON LINKEdIN

Doaa Aloufi

Senior Manager at Emirates NBD

I’m thrilled to share that I have officially been awarded the Advanced PDPL Practitioner Award! This journey has been an incredible deep dive into the world of data protection specifically for minors. A special thank you to the team for their guidance, and for the recognition of my final essay

REAd FULL REVIEW ON LINKEdIN

Umal Kazmi

data protection manager

I’m undertaking the penultimate class of Certified KSA DPO course and thoroughly enjoying it so far. Having been part of many other training courses, I think it’s the right level of detail to build solid understanding.

REAd FULL REVIEW ON LINKEdIN

Protecting your data across the globe

We have 20 years' experience in data protection and have led privacy programs globally, including some of the largest tech companies in KSA.

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)

UK & European Union

UK & European GDPR

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Saudi Arabia

The Personal Data Protection Law (issued pursuant to Royal Decree No. M/19 of 9/2/1443 H, as amended by Royal Decree No. M/148 dated 5/9/1444H) (“PDPL”)

Oman

Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022

Bahrain

Law No. 30 of 2018 with respect to Personal Data Protection (“PDPL”)

Kuwait

Kuwait Law No. 20 of 2014, on Electronic Transactions (the “E-Commerce Law”) and Kuwait Law No. 63 of 2015, on Combating Cyber Crimes the (“Cybercrime Law”)

DIFC and ADGM

DIFC Law No. 5 of 2020 on Data Protection Law (“DPL”)  ADGM Data Protection Regulations 2021

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (“PDPL”)

UK & European Union

UK & European GDPR

Qatar

Law No. (13) of 2016 Concerning Personal Data Protection (“the Data Protection Law”)