BRUSSELS: New European privacy regulations that went into effect on Friday will force companies to be more attentive to how they handle customer data, while bringing consumers both new ways to control their data and tougher enforcement of existing privacy rights.
The European Union General Data Protection Regulation (GDPR) replaces the bloc’s patchwork of rules dating back to 1995 and heralds an era where breaking privacy laws can fetch fines of up to 4 percent of global revenue or €20 million ($23.48 million), whichever is higher, as opposed to a few hundred thousand euros.
Many privacy advocates around the world have hailed the new law as a model for personal data protection in the Internet era and called on other countries to follow the European model.
Critics, though, say the new rules are overly burdensome, especially for small businesses, while advertisers and publishers worry it will make it harder for them to find customers.
The GDPR clarifies and strengthens existing individual privacy rights, such as the right to have one’s data erased and the right to ask a company for a copy of one’s data.
But it also includes entirely new mandates, such as the right to transfer one’s data from one service provider to another and the right to restrict companies from using personal data.
“If you compare the GDPR with the data protection directive you can really compare it with a piece of software upgrading from 1.0 to 2.0,” said Patrick Van Eecke, partner at law firm DLA Piper.
“It’s a gradual and not a revolutionary kind of thing ... However for many companies it was a huge wakeup call because they never did their homework. They never took the data protection directive seriously.”
Activists are already planning to leverage the right to access one’s data to turn the tables on large Internet platforms whose business model relies on processing people’s personal information.
That means companies are having to put in place processes for dealing with such requests and educating their workforce because any non-compliance could lead to stiff sanctions.
Studies suggest that many companies are not ready for the new rules.
The International Association of Privacy Professionals found that only 40 percent of companies affected by the GDPR expected to be fully compliant by yesterday’s deadline.
It is unclear how many provisions of GDPR will be interpreted and enforced. A patchwork of European regulatory authorities, many of whom say they are under-funded, will oversee the new law, with a central body to resolve conflicts.
One key provision of GDPR, the right to data portability, is causing particular confusion.
Lawyers and experts say it is not clear how far the right for individuals to move their data from one service provider to another will stretch.
“I think the data portability rights are pretty significant and are going to take a while for people to figure out what the bounds of them are and how to go about complying with them,” said David Hoffman, Director of Security Policy and Global Privacy Officer at Intel.
For example, music streaming services like Spotify create playlists for users based on their music preferences. While a user seeking to exercise the data portability right would be able to move playlists he or she created, the situation becomes fuzzy if the playlists are created by the streaming service using algorithms.
EU data protection authorities said individuals should be able to transfer data provided by them but not “derived data” created by the service provider such as algorithmic results.
Tanguy Van Overstraeten of Linklaters said the data portability right could raise issues of intellectual property.
“It’s not obvious that you can necessarily migrate the data from your system to somebody else’s system,” he said.
On the business side, companies are rushing to renegotiate contracts with suppliers and service providers because GDPR increases their liability if something goes wrong.
Under the current rules it is generally the company that determines the purposes of data collection that is directly liable for any breaches.
GDPR changes that, and data processors which only process or store the data on behalf of their clients, for example cloud computing providers, will be directly liable for sanctions and could face lawsuits from individuals, and that needs to be reflected in contracts.
Companies can have hundreds, thousands or tens of thousands of agreements which need to be revisited to ensure they comply with GDPR.
“After 20 years of data protection legislation in place, it’s only now with the GDPR they (companies) start to think about ‘what’s my role in the whole story? Am I a data controller or data processor?’” Van Eecke said.
EU privacy law heralds new era in online data protection
EU privacy law heralds new era in online data protection
- Extensive new privacy regulations halied by privacy advocates worldwide
- But critics say rules create a burden for small businesses, with advertisers and publishers impacted
GCC offering investors ‘safe’ PPP deals; Saudi pipeline nears 300: FII
RIYADH: Global investors can find a “safe harbor” in the Gulf Cooperation Council as the bloc’s public-private partnerships pipeline offers “compelling” opportunities, according to a new report.
The latest document from the Future Investment Initiative Institute highlights how economies in the region are currently driving the next wave of PPP growth.
It cites findings from Partnerships Bulletin, which ranks Saudi Arabia as second in the global emerging markets pipeline for PPP projects up to July 2025, and also places Dubai in the top 10.
While that analysis claims the Kingdom has 98 PPP projects either formally published or announced, FII says Saudi Arabia has a further 200 currently awaiting approval.
The findings align with the goals outlined in the Kingdom’s National Privatization Strategy, launched in January, which aims to raise satisfaction levels with public services across 18 target sectors, create tens of thousands of specialized jobs, and exceed 220 PPP contracts by 2030.
The strategy also aims to increase private sector capital investments to more than SR240 billion ($63.99 billion) by 2030.
The FII report says that around 90 percent of FDI into Saudi Arabia now flows into non-oil sectors, from advanced manufacturing and tourism to green energy and digital infrastructure.
“That shift reflects deliberate policy choices to open markets, standardize regulatory frameworks and use public capital to de-risk new value chains,” says the document, adding: “The result is a kind of safe harbor in an otherwise low-growth, high-uncertainty world.”
It continues: “While global FDI has stagnated or declined in many regions, the GCC’s pipeline of planned infrastructure and industrial projects now exceeds $2.5 trillion, according to Boston Consulting Group data, with PPPs playing a central role in structuring and financing them. For global investors searching for yield, diversification and inflation-linked income, this represents a compelling proposition.”
Commenting on the FII Institute report, Sally Menassa, partner at international management consulting firm Arthur D. Little, said PPPs are a strategic necessity for delivering infrastructure at speed and scale, and described Saudi Arabia’s pipeline as a “powerful execution and financing tool.”
She added: “The Kingdom’s PPP momentum must remain focused on impact, value creation and execution excellence. PPPs should not be viewed merely as a funding mechanism, but as a structural tool to enhance infrastructure performance, attract investment and support sustainable economic growth in line with Vision 2030.”
Menassa said that Saudi Arabia’s National Privitization Strategy marks a shift from a project-by-project approach to institutionalization of efforts and value creation.
“By clarifying sector priorities, strengthening project selection criteria, and formalizing governance and investor pathways, the Strategy reduces uncertainty. This clarity enhances investor confidence and improves pipeline quality,” said the Arthur D. Little official.
She added: “PPP and privatization efforts in Saudi Arabia are not about divestment or the state shifting execution to the private sector, it is really about becoming more productive as a nation. It enhances efficiency, raises service standards, mobilizes private and SME participation, and attracts capital.”
Menassa further said that the strategy could help the Kingdom achieve stronger fiscal sustainability and higher private sector GDP contribution, both of which are critical components to accelerate the Kingdom’s economic transformation under Vision 2030.
Vijay Valecha, chief investment officer at Century Financial, believes input from the private sector across all stages, from design to construction and operations, improves the efficiency of project delivery and long-term operations in Saudi Arabia.
“Tighter governance through centralized management at the National Center for Privatization and PPP and a more streamlined process, including template contracts, a clearer regulatory environment, and a transparent pipeline, is likely to improve delivery speed,” said Valecha.
He added: “This means faster delivery of big projects like Red Sea resorts or Neom, with private firms handling operations to drive innovation. Ultimately, the strategy supercharges diversification by making the private sector the main engine of growth, aligning perfectly with Saudi Arabia’s push for a vibrant, non-oil economy.”
The FII Institute added that the global flow of FDI is increasingly concentrated in the Gulf Cooperation Council region, driven by ambitious national transformation agendas and deep pools of sovereign wealth.
Tony Hallside, CEO of STP Partners, outlined several factors that are boosting the PPP landscape in the region, which include large infrastructure demand from Vision-level programs and urbanization.
“Government frameworks that standardise PPP procurement are making projects bankable. Strong regional capital pools and sovereign support will mitigate risk and attract global players. In the GCC, Saudi Arabia’s pipeline itself is one of the largest in the Middle East, indicating strong investor interest,” added Hallside.
Underscoring the role of growing PPP in Saudi Arabia, the FII report said: “A decade ago, the Kingdom’s solar capacity was negligible, despite its vast solar resource. Through early anchor investments, long-term power purchase agreements and support for national champions, the state seeded a competitive renewables market that now attracts global players on purely commercial terms.”
Valecha said that clearer PPP laws, standardised contracts and dedicated PPP units have reduced execution risks and made projects more bankable for global infrastructure funds and developers in the GCC region.
He added that rapid urbanization, a young and growing population, rising data center power demand and energy transition projects create predictable, long-duration cash flows in the region.
“This combination of policy support, fiscal necessity and structural growth is why the GCC is emerging as one of the fastest-growing PPP markets globally,” said Valecha.
Key Saudi PPP projects
Yanbu 4 Independent Water Project - supplying water to Medina and Makkah
Location Yanbu, Red Sea coast
Companies involved: Engie, Mowah, Nesma, Saudi Water Partnership Co.
Cost: $826.5 million
Expected delivery date: Operational as of 2024
Hadda Independent Sewage Treatment Plant
Location: Makkah Province
Companies involved: Metito Utilities, Etihad Water and Electricity, SkyBridge Limited Co., Saudi Water Partnership Co.
Expected delivery date: 2028
As Sufun Solar PV Independent Power Project
Location: Hail region
Companies involved: TotalEnergies, Aljomaih Energy & Water, Saudi Power Procurement Co.
Expected delivery date: Expected to connect to the grid in 2027
Construction of greenfield international airports
Location: Taif, Abha, Qassim, and Hail
Companies involved: Currently in the planning stage; investors are being sought
One-Stop Station Project
Location: Intercity road network across the Kingdom
Companies involved: Saudi Arabia’s Roads General Authority and National Center for Privatization & Public-Private Partnership announced a full list of qualified bidders in February.
King Salman Park
Location: Riyadh
Companies involved: King Salman Park Foundation, Ajdan Real Estate, Sedco Capital
Cost: $1 billion
Project: Madinah-3, Buraydah-2, and Tabuk-2 Independent Sewage Treatment Plants
Location: Madinah, Buraydah, and Tabuk
Companies involved: Acciona Agua, Tawzea, Tamasuk, Saudi Water Partnership Co.
Cost: $627 million combined
Riyadh Metro Line 2 Extension
Location: Riyadh
Companies involved: Royal Commission for Riyadh City, Arriyadh New Mobility Consortium, led by Webuild. Riyadh Metro Transit Consultants (JV between US Parsons and France’s Egis and Systra) as project management and construction supervision consultant.
Cost: Up to $900 million
Expected delivery date: 2032
The crucial role of emerging markets
According to the FII Institute report, the ability to deliver resilient infrastructure, expand digital connectivity and accelerate the energy transition will increasingly depend on the strength and legitimacy of PPPs, as fiscal space tightens and investment needs rise.
FII estimates a $5 trillion global infrastructure financing gap by 2040. It also points to significant regional shortfalls, including an estimated $3.7 trillion gap in the US and an annual $130 billion to $170 billion gap across Africa. In this context, PPPs are moving from a transactional procurement route to a central model for financing and delivery.
The report highlighted that emerging markets, including Saudi Arabia, are currently driving the next wave of PPP growth, with spending across low-and middle-income countries reaching $100.7 billion in 2024, up 16 percent year on year, according to figures from the World Bank.
Moreover, emerging markets now represent around 61 percent of global PPP activity by gross domestic product share.
According to Partnerships Bulletin’s findings up to July 31 2025, the Philippines leads the emerging-market pipeline with 230 projects, followed by Saudi Arabia with 98, Kyrgyzstan with 80, Bangladesh with 71, and Peru with 54 projects.
Greece has 42 projects in the pipeline, followed by Dubai at 28, Kenya at 25, Colombia at 24, and Pakistan at 14.
PPP: An engine of growth
When capital was cheap, PPPs were often treated as an optional extra – a way to shift specific projects off the public balance sheet, or to import private-sector efficiency into construction and operations, the FII report said.
However, now, nations consider PPPs as a central hub of their economic strategy, as they enable the state to stretch every dollar of public investment using private capital, while retaining strategic control over what gets built, where and to what standard.
“The real differentiator is complexity. When a project presents significant financial uncertainty or unpredictable demand, or if there’s a high level of climate exposure or technological risk, a PPP can give leaders the tools to manage those issues without slowing things down,” said Bob Willen, global managing partner and chairman of Kearney, said in the FII report.
Erik Ringvold, chief business development officer at Regional Voluntary Carbon Market Co., was quoted in the report as saying that carbon markets will benefit through PPPs, as deepened public-private partnerships could help achieve progress toward national emissions targets, while simultaneously creating economic opportunity and catalyzing new green industries.
“Saudi Arabia has made large strides toward an emissions compliance system, with an operational carbon standard in place, and an emissions trading system announced to be launched over the coming few years,” said Ringvold.
He added: “At VCM, we see a clear future carbon vision for Saudi Arabia. One ecosystem. One marketplace. One iconic collaboration – with the PPP model at the heart of its success.”
PPPs for investors and citizens
For investors, infrastructure-backed PPPs offer long-duration, often inflation-linked cash flows at a time when public markets are volatile and dominated by a narrow set of mega-cap technology stocks.
For citizens, well-designed PPPs can mean better services, more resilient infrastructure and faster progress toward climate and development goals, without unsustainable tax rises or austerity.
FII, however, cautioned that public consent is becoming decisive. Across seven countries, only 23 percent of citizens agree that PPPs “equally benefit everyone”, compared with 41 percent of business and government leaders.
Hallside said that public consent hinges on transparency, accountability, and visible service outcomes.
He added that governments should publish clear procurement frameworks, communicate cost-benefit and performance expectations in plain language, and measure user satisfaction and service quality over time — “reinforcing that PPPs deliver tangible improvements in infrastructure and services.”
Menassa echoed similar views and said that communication with the public is not sufficient, but the performance and execution phase holds the key to PPP projects.
“Winning public opinion for PPPs is rather a marathon not a race. It starts with building awareness and trust by providing transparency and demonstrating value for money, ensuring affordability and service quality of public services is maintained through strong regulatory oversight, and ensuring competitive, transparent procurement processes,” added Menassa.
According to the Arthur D. Little official, the public must see tangible improvements in service reliability, efficiency and accountability, and acceptance will follow.
“The world can’t afford to delay the infrastructure and energy transition investments that will determine prosperity – and planetary stability – for decades to come. Nor can it fund them through public budgets alone. Financing the future is, by definition, a joint endeavour,” added the FII report.
