Compliance guides
Compliance, explained in plain language
Short guides to ZATCA e-invoicing, the Saudi PDPL, DESC, NIS 2 and DORA: what each rule requires, who it affects and how to get ready.
The guides
Start with the rule that affects you
Each card opens its guide below. Short, practical and free to read.
ZATCA e-invoicing (Fatoora), explained
What Phase 1 and Phase 2 mean, how clearance and reporting work, and how to get ready.
GuideSaudi PDPL: a plain-language guide
Who must comply, what rights people have over their data, and how to build compliance step by step.
OverviewDESC compliance for Dubai, at a glance
What the Dubai Electronic Security Center expects, and which organizations it affects.
GuideNIS 2 for organizations with EU ties
What the EU directive requires, the 24-hour and 72-hour reporting rules, and who can be affected outside the EU.
GuideDORA for financial entities and their ICT suppliers
The five areas of the EU's digital operational resilience rules, and how they reach suppliers.
ChecklistAre you ready? A six-step compliance checklist
A practical path that works for any of these frameworks, from scoping to evidence.
At a glance
Five frameworks, side by side
A quick comparison before you read the detail.
| Framework | Where | Regulator | Who it affects | Core idea |
|---|---|---|---|---|
| ZATCA e-invoicing | Saudi Arabia | ZATCA | Taxpayers in Saudi Arabia, in waves announced by ZATCA | Structured e-invoices, integrated with ZATCA's platform |
| Saudi PDPL | Saudi Arabia | SDAIA | Organizations processing personal data of individuals in Saudi Arabia | Lawful, transparent and secure handling of personal data |
| DESC | Dubai, UAE | Dubai Electronic Security Center (DESC) | Dubai Government entities and organizations that serve them | Information security requirements for Dubai |
| NIS 2 | European Union | National authorities in each EU member state | Medium and large organizations in covered sectors that operate in the EU | Cyber security risk management and incident reporting |
| DORA | European Union | European supervisory authorities and national regulators | EU financial entities and their ICT third-party providers | Digital operational resilience for finance |
The guides in detail
Pick a framework to see what it is, what to prepare and how we can help.
ZATCA e-invoicing
- Check which wave your business is in on ZATCA's website and note your integration deadline.
- Confirm that your ERP or invoicing software can produce compliant XML invoices with the cryptographic stamp, QR code and invoice hash chain.
- Plan onboarding: registering your solution units with ZATCA to obtain the required certificates.
- Decide how you will handle rejected invoices, credit and debit notes, and invoice archiving.
Saudi PDPL
- Map the personal data you hold: where it comes from, where it is stored and who receives it.
- Write a clear privacy notice and record the lawful basis for each purpose.
- Set up a way to answer access, correction and deletion requests.
- Review supplier contracts and any transfers of data outside Saudi Arabia.
- Prepare a breach response plan that says who decides, who informs the authority and when.
DESC
- Confirm whether you serve a Dubai Government entity and which DESC requirements your contracts reference.
- Run a gap assessment against the relevant DESC requirements.
- Document policies, risk assessments and evidence that controls work.
- Plan for assessments or certification where your customer requires them.
NIS 2
- Work out whether you operate in, or supply, the EU in a covered sector.
- Assess your risk management against the NIS 2 measures, including supplier security.
- Prepare an incident-reporting process that can meet the 24-hour and 72-hour deadlines.
- Make sure management understands and signs off on cyber security risk.
DORA
- Identify which financial entities you serve and what DORA passes down to you in contracts.
- Keep a register of your ICT services, suppliers and critical functions.
- Test your resilience, including incident response and recovery, and keep the evidence.
- Review contracts for the security, audit and exit terms DORA expects.
Readiness checklist
Six steps that work for any framework
Whichever rule you are working towards, the path is similar.
Find out which rules apply
List the countries you operate in, the sectors you serve and the customers whose contracts pass requirements down to you.
- Countries
- Sectors
- Contracts
Map your data and systems
Know what data you hold, where it lives, which systems touch it and which suppliers process it.
- Data map
- Systems
- Suppliers
Run a gap assessment
Compare what you do today with each requirement and rate the gaps by risk and effort.
- Gaps
- Risk rating
Fix the gaps
Put the missing controls, processes and technology in place, starting with the highest risks and the nearest deadlines.
- Controls
- Technology
Document, train and test
Write the policies, train your people and rehearse incident response so the process works under pressure.
- Policies
- Training
- Drills
Monitor and keep evidence
Review regularly, keep the records an auditor or regulator would ask for, and track rule changes.
- Reviews
- Evidence
- Updates
General information, not legal advice. These guides summarise public rules in plain language. Requirements, deadlines and official guidance change, so always confirm the current position with the relevant authority or your own legal advisers before you act.
Compliance questions
What is the difference between ZATCA Phase 1 and Phase 2?
Phase 1 (Generation), from 4 December 2021, requires invoices to be created and stored electronically in a structured format with a QR code. Phase 2 (Integration), from 1 January 2023 and rolled out in waves, connects your invoicing system to ZATCA's Fatoora platform, so standard invoices are cleared by ZATCA and simplified invoices are reported within 24 hours.
Does the Saudi PDPL apply to companies outside Saudi Arabia?
It covers the processing of personal data about individuals in the Kingdom, including by organizations located outside it. If you handle the personal data of people in Saudi Arabia, check how the PDPL applies to you.
Do NIS 2 and DORA apply to Saudi and GCC companies?
Not directly by default. They are EU rules. They can still reach a GCC organization that operates in the EU, or that supplies EU entities, either directly or through the contracts its customers require. Confirm your position with the relevant authority or a legal adviser.
Where should I start with compliance?
Start with a gap assessment. It shows which rules apply to you, where you stand today and what to fix first, so you can plan work around your deadlines instead of reacting to them.
Is this page legal advice?
No. These guides are general information in plain language. Rules, deadlines and guidance change, so always confirm current requirements with the relevant authority or your own advisers.
Can GoAgile help with compliance work?
Yes. Our Financial Solutions team delivers ZATCA e-invoicing, and our Cyber Security team supports PDPL, DESC, NIS 2 and DORA readiness. Use the contact form to tell us what you need.
Not sure where your business stands?
Tell us which rules you are working towards and we will recommend a practical first step, starting with a gap assessment if that is what you need.