Compliance Consulting in
the Middle East

Yes. Tranquility Cybersecurity (TCSA) serves the UAE and Saudi Arabia as part of a client base across India, USA, UK, Australia and UAE. Our consultants have prepared ADIB (Abu Dhabi Islamic Bank), Mashreq Bank, and AMEX for ISO 22301 in the Middle East, and have delivered PDPL compliance for SRG Group. Engagements run remote-first from our India offices, with on-site delivery in the Gulf for workshops, exercises and audit weeks.

Increasingly, yes. The Central Bank of the UAE’s business-continuity and outsourcing rules require banks to ensure their critical vendors maintain robust continuity arrangements, and banks have operationalised this by writing ISO 22301-aligned BCMS requirements into supplier contracts — with the first contract-deadline wave landing in December 2025. If your bank client has issued such a clause, you typically need a working BCMS (BIA, RTO/RPO, tested continuity plans) and, in many cases, certification by an accredited body. TCSA builds the BCMS and prepares you for that audit.

The architecture is familiar — lawful bases, data-subject rights, records of processing, breach notification — so existing GDPR work is reusable. The key differences: the PDPL is enforced by SDAIA and has been fully enforceable since 14 September 2024; administrative fines run up to SAR 5 million per violation (doubled on repeat), with criminal exposure for unlawful disclosure of sensitive data; breach notification to SDAIA is due within 72 hours; and cross-border transfer rules follow SDAIA’s own regulations rather than EU adequacy mechanics. We map your GDPR or ISO 27701 programme onto PDPL obligations instead of starting from zero.

Yes. While engagements are remote-first, our consultants travel to the UAE and Saudi Arabia for the parts of the work that benefit from being in the room — kickoff and scoping workshops, business impact analysis sessions, continuity and incident exercises, internal audits and certification-audit weeks. On-site visits are planned into the engagement schedule and quoted upfront.

Engagements are custom-scoped to your size, regulator deadlines, and existing maturity — whether that is ISO 22301 BCMS readiness, PDPL readiness, or SAMA CSF + BCM readiness. We provide a fixed, all-inclusive quote agreed in writing after a short scoping call — no hourly billing, no scope creep — billed in INR or USD. Certification-body and CPA fees are always separate and quoted transparently.

Engagements today run in English — policies, reports, working sessions and audit-facing documents — which is the working language of Gulf compliance, vendor-risk and audit teams. Where a regulator or counterparty requires Arabic-language artefacts, we coordinate translation as part of the engagement plan. An Arabic version of this page is on the way.