Wadira: Find your way through Saudi data & privacy law.
Home › Guide › How the tiers work: ranking legal instruments
Every framework in Wadira arranges its instruments on the same six-rung ladder. The ladder is a hierarchy of norms: each tier records who issued an instrument and by what authority, not how important it is in daily compliance work. The same six ranks describe almost any legal system; each jurisdiction supplies its own names for them.
Two principles govern reading it. Within a ladder, rank is precedence: the higher rank prevails, so a regulation inconsistent with its parent law is invalid. And rank is not bindingness: a tier-4 control set can bind harder than anything above it (Saudi Arabia's ECC), or not at all (China's GB/T 35273 standard is formally voluntary). Each instrument's Binding / Guidance status answers "must I comply?"; its tier answers "where does this sit in the legal order?"; the applicability matrix answers "does it apply to me?".
| 0 · Foundational | 1 · Primary law | 2 · Executive | 3 · Delegated | 4 · Technical rules | 5 · Guidance | |
|---|---|---|---|---|---|---|
| Saudi Arabia | Sharia; Basic Law | PDPL (M/19, amended M/148) | Council of Ministers resolutions | Implementing Regulation | NCA ECC | SDAIA guidelines |
| UK | Uncodified constitution | DPA 2018; UK GDPR | Orders in Council (rare) | Statutory instruments | ICO statutory codes; FCA rules | ICO guidance |
| US · federal | Constitution | HIPAA, GLBA, COPPA | Executive orders | Agency rules (CFR) | NIST FIPS | NIST frameworks; FTC guidance |
| France | Constitution, with the EU shelf above | Loi Informatique et Libertés | Ordonnances; décrets | Arrêtés | CNIL model regulations | CNIL recommendations |
| UAE · federal (DIFC and ADGM run their own ladders, below) | Constitution | PDPL, Decree-Law 45/2021 | Cabinet decisions | Data Office instruments | Central Bank rules | Regulator guidance |
| Canada · federal (Quebec, Alberta and BC run their own) | Constitution Acts; Charter | PIPEDA | Orders in Council | Breach Regulations | (thin) | OPC guidance |
| Singapore | Constitution | PDPA 2012 | (mostly empty) | PDP Regulations 2021 | CSA codes; MAS notices | PDPC guidelines |
| Thailand | Constitution (2017) | PDPA (2019) | Royal decrees | Ministerial regulations | PDPC notifications | PDPC guidelines |
| China | Constitution | PIPL; DSL; CSL | State Council regulations | CAC measures | GB/T standards (voluntary) | TC260 guides |
Empty cells are information, not gaps: Singapore and the UK barely use rank 2, and Kuwait has no primary data-protection statute at all, so its regulator's rules do the heavy lifting.
The ladder describes a regime, not a country. The UAE holds three: the federal stack in the table, plus DIFC and ADGM, common-law free zones whose own laws (DIFC Law 5/2020; ADGM DP Regulations 2021) are rank 1 of their own short ladders. The zone laws fit nowhere on the federal ladder, because the carve-out (Constitution Art. 121 and Federal Law 8/2004, themselves federal instruments) means the stacks never compete. Canada is the same shape: PIPEDA's federal ladder beside provincial ladders where a province has its own statute. The US runs federal and state stacks the same way. France instead adds a shelf above rank 1: the GDPR applies directly and prevails over national law.
When two stacks could govern the same processing, a relation rule with its own citable basis decides:
| Relation | Where | Basis |
|---|---|---|
| Territorial carve-out | UAE free zones | Constitution Art. 121; Federal Law 8/2004 |
| Allocation + equivalence | Canada | Substantially-similar designations; paramountcy as backstop |
| Preemption | US | Supremacy Clause; most federal privacy laws set floors, so stricter state law usually stands |
| Direct effect | EU over member states | The EU treaties |
Sector overlays (SAMA on banks; MAS in Singapore) are not a precedence question: they apply cumulatively on top of the general law.
Court judgments and regulator enforcement apply the norms on the ladder; they hold no rank on it. They form a second column with its own hierarchy, ranked by the deciding body. In Saudi Arabia, PDPL penalties come from SDAIA's violation-review committees (PDPL Art. 36) and bind the parties only; the published judicial principles of the Supreme Court are the nearest analogue to precedent. In common-law systems the column carries real binding force: a UK Court of Appeal ruling fixes an instrument's interpretation for every lower court. Saudi enforcement practice is tracked in Updates; a structured decisions register is planned as the atlas's second axis.
Why are Council of Ministers resolutions tier 2 rather than tier 1?
In the Saudi hierarchy they sit below Royal Decrees, the Kingdom's legislative acts, and above anything a single regulator can issue. The Council creates the regulators (SDAIA's charter is Resolution 292); no instrument a regulator issues can outrank the act that established it.
Does a higher tier mean an instrument matters more?
No. Tier records rank in the legal order, not operational weight. The ECC (tier 4) drives more day-to-day compliance work than any tier-2 instrument; check each instrument's Binding / Guidance status for whether it imposes duties.
What decides a conflict between two instruments?
On the same ladder: the higher rank prevails; at equal rank, the later instrument beats the earlier and the specific beats the general (the PDPL itself defers to the Credit Information Law for credit data, Art. 24). Between ladders there is no shared ranking, so the relation rule in the table above decides.
In a federation, which wins: federal or state law?
There is no tier comparison to make; a state statute is rank 1 of its own ladder. The relation rule answers instead. In the US, the Supremacy Clause lets valid federal law displace conflicting state law, but most federal privacy statutes set floors rather than ceilings, so stricter state laws such as the CCPA stand on top of them. Germany's Basic Law states the flat version (federal law breaks state law); Canada's paramountcy bites only on genuine operational conflict.
Does the UAE need one ladder or three?
Three. DIFC and ADGM make law under their own authority, so each is its own hierarchy of norms with its own courts, which publish binding precedent. A merged ladder would either falsely subordinate the zone laws to the federal PDPL or falsely rank them as federal legislation. Readers are routed by establishment: a DIFC firm reads the DIFC ladder plus the federal law that still reaches the zone (criminal law does; civil and commercial law does not).
Why doesn't Wadira put court decisions in a tier?
Saudi Arabia has no binding precedent: judgments bind the parties, not future courts, so decisions apply the law rather than create it. Even in common-law systems, where a Court of Appeal ruling genuinely binds every lower court, decisions form a parallel body ranked by court, standing alongside the ladder rather than inside it. That is how practitioner tools model them too.
In the UK's "Orders in Council", what is the Council?
The Privy Council (the King-in-Council), the sovereign's formal advisory body, not the Cabinet. Prerogative Orders are a residue of executive law-making with no parent Act; statutory Orders are in substance dressed-up statutory instruments.
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-08-13