Ref 5a

Gulf (GCC) Personal Data Protection Notice — PDPL

This notice applies to personal data of individuals in the Gulf Cooperation Council states. "PDPL" is not one law: Saudi Arabia, the UAE, Bahrain, Qatar and Oman each have their own statute and regulator, and the UAE additionally has separate regimes inside the DIFC and ADGM financial free zones. India’s DPDPA is a different law again and is covered in its own document.

Purpose

Explain how voice AI data belonging to individuals in the GCC is handled under the Gulf PDPL regimes, and where it is processed.

Scope

Saudi Arabia — Personal Data Protection Law (Royal Decree M/19, as amended), regulated by SDAIA.
United Arab Emirates — Federal Decree-Law No. 45 of 2021, with the DIFC and ADGM operating separate GDPR-style regimes for entities established there.
Bahrain (Law No. 30 of 2018), Qatar (Law No. 13 of 2016) and Oman (Royal Decree No. 6/2022). Kuwait has no comprehensive statute; the CITRA data privacy regulation applies instead.
Voice AI processing for GCC-based customers: call audio, transcripts, call metadata, and any personal data inside assistant configuration.

Published Commitments

Processing of GCC personal data rests on the data subject’s consent or another basis the relevant statute permits, and is limited to the purpose stated when it was collected.
Cross-border transfer is the material issue for voice AI. Our production infrastructure runs in India (AWS Asia Pacific, Mumbai), so serving a GCC customer transfers personal data outside their jurisdiction. That transfer must rest on a lawful mechanism under the applicable statute, agreed per customer before deployment — the Saudi PDPL in particular constrains transfers outside the Kingdom.
Where a customer requires in-region processing or data residency, that is a deployment decision to be agreed in the contract rather than something this notice can assume.
Individuals may request access, correction, and destruction of their personal data, and may withdraw consent. Requests reach us at hello@induslabs.io and are routed to the Grievance Officer named in the Privacy Policy.
Personal data breaches affecting GCC data subjects are escalated internally on discovery, and notified to the relevant regulator and affected individuals within the deadline that regulator sets — SDAIA operates a 72-hour expectation.
Where we act as a processor for a customer, the customer remains responsible for the notices and consents its own end-users require.