Start a project
Start a project Book a call
Compliance

Security review for a Gulf business website: what it covers and which data laws apply

A plain guide to scans, penetration tests and security reviews, what a good report contains, and what official pages say about personal data security in the UAE, Saudi Arabia, Qatar, Bahrain and Oman.

ESTASOFT
11 min read
Teal cover with a white shield and a check mark, with the title Security review for your website
On this page
    On this page

      You run a website that takes orders, enquiries or logins, and someone says you need a "security review". Three suppliers quote three different things: a scan, a penetration test, a review. You also wonder which data law applies if customers in several Gulf countries fill in your forms.

      This article explains the three terms in plain words, lists what a good review looks at and what a report should contain, then summarises the personal data laws of the UAE, Saudi Arabia, Qatar, Bahrain and Oman as the official pages showed them on 4 November 2026. It ends with questions to ask a supplier. It does not cover Kuwait, Iraq or the Kurdistan Region, so ask a local adviser there.

      Scan, penetration test or review: three different jobs

      Suppliers use these words loosely. These are plain working descriptions, not a standard, so ask any supplier to define theirs in writing.

      • Scan. A tool checks your site for known weaknesses and produces a list. It is quick and repeatable. It cannot judge what matters to your business, and some items may not be real problems.
      • Penetration test. A person tries to break in, within limits you agree in writing. It goes deep on chosen targets, such as a login or a checkout. It shows what an attacker could do, but only for what was in scope.
      • Security review. A person looks at how the site is set up and run: who has access, what is updated, how it is configured and what leaves the site. A review may include a scan and some testing. It usually covers more ground than a test and goes less deep on any one target.

      None of the three proves a site is secure. Each shows the state of the site on the day it was checked. Our article on the OWASP Top 10 explains the common categories of web flaw that scans and tests look for.

      What a security review covers

      A review should walk through these areas. Ask for each one by name when you compare quotes. Our own security review page describes the service we offer.

      • Access. Who has an admin account? Are former staff, agencies and freelancers removed? Is two-step sign-in on? Are passwords or keys shared in chat or email?
      • Updates. Are the platform, themes, plugins, apps and libraries current? Is anything no longer supported by its maker? For WordPress, our WordPress security checklist goes into detail.
      • Configuration. Is the whole site served over HTTPS? Are admin pages, test sites and old copies reachable from the internet? Do error pages reveal details? Are default accounts still active?
      • Forms and uploads. What happens to what visitors type into contact, login and upload forms? Where do submissions go, and who can read them?
      • Payments. Do customers type card details on your page or on the payment provider's page? Where are payment keys stored, and who can see them? Who can issue refunds?
      • Backups. Do backups exist, where is the copy kept, and has anyone restored one as a test? See the 3-2-1 backup rule.
      • Logging and alerts. Does anyone get told about failed logins or settings changes? How long are logs kept? Logs can hold personal data.
      • Third-party scripts. Chat widgets, analytics, advertising tags, fonts and booking tools each run code on your pages. Who installed each, who owns the account, and is it still needed?

      A good review also asks what personal data the site collects, where it is stored and who can reach it. That feeds the legal questions below.

      What a useful report contains

      • The scope: which addresses and systems were checked, which were left out, and the dates of the work.
      • The method in plain words, including which tools were used and what a person checked by hand.
      • A one-page summary for the owner, then the detail for whoever fixes things.
      • For each finding: what it is, where it is, the evidence, why it matters to your business, a rating with the scale explained, and how to fix it.
      • What was found to be in order, so you know what not to touch.
      • A fix order, so the work starts with what matters most.

      Be wary of a raw tool export with no explanation, and of a certificate that says "secure" with no list of what was checked.

      Which personal data laws apply to a Gulf website

      Each country below is described from the page named in the Sources list, read on 4 November 2026. For Oman the only English text we could open is an unofficial translation. Laws and guidance change, and some regulations were not open to us, so treat this as a map for questions, not as the rules.

      • UAE. The UAE government portal (page updated 4 December 2025) names Federal Decree Law No. 45 of 2021 on the protection of personal data, in force from 2 January 2022. It says the law covers processing done fully or partly by electronic systems, inside or outside the UAE, and that companies holding personal data must secure it and keep it confidential. The page lists no measures and no breach notice. The Dubai International Financial Centre (DIFC) has its own law, DIFC Law No. 5 of 2020, which the same portal page also lists. The consolidated text we opened, dated March 2022 and possibly amended since, asks controllers and processors to keep security appropriate to the risk (Article 14). It says a controller must tell the Commissioner, "as soon as practicable in the circumstances", of a breach that compromises a person's confidentiality, security or privacy (Article 41). Ask which regime applies to your company, including whether a free zone has its own rules.
      • Saudi Arabia. The national platform page says the Personal Data Protection Law was issued by Royal Decree M/19 dated 09/02/1443 AH (16 September 2021) and amended by Royal Decree M/148 dated 05/09/1444 AH (27 March 2023). It also lists an Implementing Regulation and says the law reaches entities outside the Kingdom that handle data about people in it. The Saudi Data and AI Authority (SDAIA) guide, version 1.0 of December 2023, describes technical and organisational measures, with examples such as encryption, access controls, policies and training. On breaches it says reporting is required in the cases set by the Implementing Regulations. Its examples say the competent authority should be told promptly when a breach may harm the data or the person, or conflict with their rights or interests, and affected people told when it may damage their data or those rights. We could not open the regulation text. According to the law firm Clyde & Co (8 October 2026), the current rule is notice to SDAIA within 72 hours where harm is likely, and SDAIA opened a consultation on 6 October 2026, due to close on 5 November 2026, on a draft that would drop the harm test. That is a law firm's report on a draft, not the official text. Ask your adviser for the current breach rule.
      • Qatar. A Ministry of Transport and Communications item dated 31 January 2021 names the Personal Data Privacy Protection Law, Law No. 13 of 2016, and says Article 8 requires controllers to take appropriate administrative, technical and financial precautions. It does not mention breach notice. We could not open any Qatari text on breach notices, so ask the competent authority or an adviser whether and when you must report a breach.
      • Bahrain. The Personal Data Protection Authority's page presents Law No. 30 of 2018, promulgated on 12 July 2018. In the law text, Article 8 requires technical and organisational measures against accidental or unauthorised destruction, loss, alteration, disclosure and access. They must fit the data and the risk and be recorded. If you use a processor, you need a written contract that requires equivalent security duties. Article 8 also says the Authority's Board issues resolutions on the conditions for these measures. We did not find a general breach notice article in the text, so ask whether any Board resolution adds one.
      • Oman. The decree.om site, a private database of English translations and not a government site, shows Royal Decree 6/2022, issued 9 February 2022, in a consolidated text that it says runs up to Royal Decree 68/2026. In that unofficial translation, Article 13 asks controllers to put controls in place, including technical and procedural measures. Article 19 says a controller must tell the Ministry and the affected person about a breach that leads to unlawful destruction, alteration, disclosure, access or processing, following procedures set by the regulation. Ask your adviser for the official Arabic text, the current regulation and any deadline.

      In every country above, the text we read expects the controller to take security measures, described in slightly different words. A review is one way to check and record those measures. It does not on its own show that you comply with any law.

      Questions to ask before you hire a reviewer

      1. Is this a scan, a penetration test, a review, or a mix? What exactly is in and out of scope?
      2. Do you need written permission from my host or platform before you test, and will you ask for it?
      3. Will you touch the live site? When, and how do you avoid disturbing orders in a sale or busy season?
      4. When will you be reachable, given our own weekend?
      5. Where will you store my data and the report, who can read them, and when will you delete them?
      6. What happens if you find an active attack or exposed personal data? Who do you call, and in what order?
      7. Will you check both language versions, every form and the checkout?
      8. Will the report show the rating scale, the evidence and a fix order?
      9. Is a recheck included, and who fixes the findings? Is that you or someone else?
      10. Which countries' data laws do you expect me to check, and which will you leave to my adviser?

      What to have ready

      List everyone with admin access, your hosting and domain details, and your plugins, apps and outside scripts. Add a note on what personal data you collect, where it is stored and for how long. Our guide on hosting regions and data location helps with the "where". If your store connects to couriers or payment gateways, list who owns each credential, as in our integration checklist.

      Next steps

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      When the report arrives, fix the high-rated items first and book the recheck before the supplier leaves. ESTASOFT can help with a security review: send a short brief on the contact page. For cookie and consent questions on a store, see our article on privacy and cookies on a Shopify store.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.