regimes typically only focus on the legal basis for data collection and some rights of data subjects but fail to offer a comprehensive framework that differentiates personal from nonpersonal data, provides rules on transfer of data, or sets out conditions for conservation or destruction of personal data. UAE does not have a framework for privacy protection, but Dubai has adopted a full-fletched framework under the context of the Dubai International Financial Centre (DIFC) Authority that applies to business conducted in the special economic zone -thus having a geographical limitation to the scope of the regulation. Despite not having a comprehensive framework on data governance, provisions on personal privacy can be found in other countries in the region dispersed in sectoral or other specific regulations. For instance, in Egypt, the criminal code imposes a punishment for the unlawful collection of images or recordings of individuals in private places, and the Banking Law requires confidentiality for information regarding clients and accounts (CipherCloud 2017). These discrete provisions can be essential in their own context but should ideally be integrated in a broader framework that balances the different priorities of data privacy protection.

|**Table 12: Reg**|**ulation on da**<br>**Sensitive**<br>**data**|**tagoverna**<br>**Legal bas**|**nce in MENA**<br>**es for data col**|**lection and**|**processing**|**Data**<br>**subject’s**<br>**rights**<br>|**Cross-b**<br>**tra**|**order data**<br>**nsfers**|
|---|---|---|---|---|---|---|---|---|
||Special<br>treatment|Consent|Performance<br>of a contract|Legal<br>obligation|Legitimate<br>interests|Access/<br>deletion|Rules on<br>transfers|No data<br>localization|
|**Algeria**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Bahrain**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Iran, Islamic**<br>**Rep.**|**●**|**●**||||**●**||**●**|
|**Israel**|**●**|**●**||||**●**|**●**|**●**|
|**Kuwait**||**●**||||**●**||**●**|
|**Lebanon**|**●**|||||**●**||**●**|
|**Morocco**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Oman**||**●**||**●**||**●**|**●**|**●**|
|**Qatar**|**●**|**●**||**●**|**●**|**●**||**●**|
|**Saudi Arabia**||**●**||**●**||||**●**|
|**Tunisia**|**●**|**●**|**●**|||**●**|**●**|**●**|
|**United Arab**<br>**Emirates**||**●**|||||**●**|**●**|

All the existing comprehensive regulatory frameworks for data governance in MENA feature most of the crucial provisions, including special treatment of sensitive data and data subjects’ rights with regard to their personal data (Table 12). The Islamic Republic of Iran and Israel failed to introduce alternatives to consent as legal bases for data collection and processing. All these regulations, except for those introduced by the Islamic Republic of Iran and Qatar, feature clear rules on cross-border data transfers. As seen in the other countries studied, none of these regulations include data localization requirements but this does not mean that such requirements are absent from sector-specific regulations.

# C. Cybersecurity

While less visible to the individual consumers, cybersecurity regulation is an essential component for promoting trust in digital markets. Cybersecurity refers to the measures that can be implemented to protect personal data from unauthorized access and corruption. Major data breaches, like that which Yahoo witnessed in 2013—affecting 3 billion user accounts— not only 22