PDPL compliance and employee training: what Gulf organisations are getting wrong

The overlap nobody is managing

Most organisations treat cybersecurity and data protection as separate problems. Compliance handles PDPL, IT handles security, HR handles onboarding, and nobody handles the gap in between. That gap is where the liability sits.

Consider what happens when an employee forwards a document with customer records to their personal email to work from home. That single action is simultaneously a PDPL violation (unauthorised data transfer, potential cross-border issue), a cybersecurity incident (data leaving the corporate environment without controls), and an HR failure (was this person trained? Is there a policy?). Under Saudi PDPL, Oman PDPL, and UAE cybercrime law, the organisation is liable whether or not the employee acted with intent.

Shadow AI compounds the problem. 80% of organisations are concerned about sensitive data leaking through generative AI tools but 60% have no strategy to address it. When an employee in Dubai pastes customer records into an unapproved AI tool to draft a report, that’s a potential cross-border transfer under UAE PDPL, an unauthorised disclosure under Saudi PDPL, and a consent violation under Oman’s framework. IBM’s 2025 Cost of Data Breach Report found that shadow AI was a factor in 20% of breaches studied, adding an average of $670,000 to breach costs compared to organisations with low or no shadow AI exposure.

The training implication is direct. An employee who knows the data classification policy but not the cybersecurity protocols is still a risk. An IT administrator who can configure access controls but doesn’t know what counts as personal data under Omani law is still a liability.