This dissertation of Radwan Eskhita examines the influence of the EU’s General Data Protection Regulation beyond European borders, focusing specifically on the Gulf region. Through comparative legal analysis, it investigates how the UAE, Bahrain, and Qatar have responded to the GDPR, exploring whether these states are aligning with European standards or developing hybrid models based on their distinct economic interests and regulatory environments. The research employs a multifaceted theoretical framework that extends beyond the well-known ‘Brussels Effect’ theory. While Bradford’s concept explains how the EU exports its regulations through market mechanisms, the dissertation incorporates complementary theoretical perspectives from public choice theory and regulatory capture. This broader framework enables more understanding of how domestic interests and power dynamics shape regulatory outcomes in the Gulf states, where economic considerations and relationships with dominant market players significantly influence policy decisions. Methodologically, the dissertation combines doctrinal analysis with empirical research. The first component establishes a detailed comparative matrix of GDPR components against Gulf frameworks, systematically identifying convergences and divergences in legal definitions, enforcement mechanisms, and cross-border data transfer provisions. The empirical component draws on qualitative insights from interviews with policymakers, legal experts, and institutional stakeholders, revealing the practical dimensions of regulatory implementation and negotiation. The findings reveal a complex picture of selective adoption rather than wholesale transplantation of EU norms. While certain GDPR principles have been incorporated into Gulf frameworks, particularly in sectors dependent on international data flows, significant adaptations reflect local priorities and constraints. The dissertation identifies how regulatory capture dynamics have influenced these adaptations, with powerful economic actors shaping implementation to protect their interests. Similarly, public choice considerations expose how political and bureaucratic self-interest has guided certain aspects of regulatory design. The analysis of extraterritoriality proves particularly revealing, as Article 3(2) of the GDPR has prompted legal reforms abroad while testing the limits of cross-jurisdictional enforcement. The dissertation examines how Gulf regulators navigate this tension, balancing compliance with international standards against sovereignty concerns and regional alliances. This research aims to contribute to our understanding of global data governance by demonstrating how legal norms travel across different jurisdictions and regulatory cultures. It shows that rather than simple diffusion, regulatory adoption involves complex processes of translation, negotiation, and strategic adaptation. The work bridges international law, technology regulation, and comparative legal studies, offering insights into how regions with distinctive legal traditions and political economies engage with emerging global data protection standards. Therefore, Eskhita’s work is particularly relevant to scholars and practitioners interested in how data protection norms travel, adapt, or resist harmonization in regions with differing legal cultures and political economies.
Eskhita promoted on April 25th, 2025, at Erasmus Law School. Supervisors: prof. dr. Evert Stamhuis and prof. dr. Klaus Heine.
Radwan Eskhita
From Brussels to the Gulf: Investigating the Impact of the GDPR in UAE, Bahrain, and Qatar