TRW & Co · Technology & IP
Cloud and Outsourcing in the UAE
Cloud outsourcing in the UAE is shaped by sector rules more than by the contract. Health data must generally stay in the country, banks need Central Bank approval to send customer data abroad, and Dubai government bodies may only use certified providers. This guide explains the rules, the key contract terms and how to plan a compliant migration or outsourcing.
Key pointFor a UAE bank, confidential customer data may not leave the country without Central Bank approval and customer consent, so choosing a global cloud region is a regulatory decision, not just a procurement one.
At a glance
Health data stays local
The ICT Health Law, Federal Law No. 2 of 2019, requires health data to be held in the UAE unless a ministerial exemption and its conditions apply.
Bank outsourcing rules
The Central Bank's 2021 Outsourcing Regulation for Banks requires core data in the UAE and approval before customer data goes abroad.
Central Bank Law 2025
Federal Decree-Law No. 6 of 2025 extends regulation to technology platforms enabling financial services, with a transition that ran to September 2026.
Dubai government cloud
Dubai government and semi-government entities must use cloud providers certified under the Dubai Electronic Security Center's CSP Security Standard.
No automatic staff transfer
UAE law does not move employees to a new provider on outsourcing, so contracts, visas and end-of-service benefits must be handled expressly.
Swipe or scroll →
What cloud outsourcing in the UAE covers
Cloud outsourcing in the UAE means moving data, applications or whole business functions to third-party providers: public cloud platforms, software-as-a-service, managed IT and security services, and business process outsourcing such as finance, HR or customer service. Legally, it raises the same core questions whatever the technology: where the data sits, who can access it, what the regulator must be told, and how you get out if the relationship fails.
The answers in the UAE depend more on sector and location than on the contract. A retailer moving its e-commerce platform to a global cloud region faces light-touch rules. A bank, insurer, hospital or government entity faces data residency requirements, regulator notification or approval, and mandatory contract terms. A DIFC or ADGM firm faces its own regulator's outsourcing rulebook and its own data protection law on top.
The legal question usually arrives at one of four moments: a cloud migration business case, a vendor selection where the preferred provider hosts outside the UAE, a regulator inspection that asks for the outsourcing register, or an outage or breach at a provider that exposes gaps in the contract. Planning at the first moment avoids most of the pain at the others.
The legal and regulatory framework
There is no single cloud or outsourcing statute. Instead, obligations come from data protection law, sector-specific localisation rules, financial services regulation, government information security standards and general contract law.
Data protection and transfers
The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 governs onshore and most free zone processing. It requires controllers to use processors that give sufficient guarantees, to bind them by contract, and to transfer personal data abroad only to jurisdictions with adequate protection or under recognised safeguards and exceptions. The PDPL does not apply to health and banking data that are governed by their own legislation, nor to the DIFC and ADGM, which have their own data protection laws. Our page on cross-border data transfers covers transfer mechanisms in detail.
Health data
The ICT Health Law, Federal Law No. 2 of 2019, requires health data to be stored and processed inside the UAE unless an exception applies. A Ministry of Health and Prevention resolution issued in 2021 created a set of exemptions, for example for overseas treatment, laboratory testing, research using de-identified data and certain insurance processes, each with conditions such as patient consent, encryption and keeping a copy in the UAE. Abu Dhabi's Department of Health applies the rules strictly to its licensees. For health providers, this makes a UAE-region cloud the default.
Banks and other Central Bank licensees
The Central Bank's Outsourcing Regulation and Standards for Banks, issued in 2021 as Circular No. 14/2021, require banks to manage outsourcing risk through board-approved policies, due diligence and minimum contract terms, and to retain ownership of data shared with providers. Data needed for the bank's core activities must be kept in the UAE, and confidential customer data may not leave the country without Central Bank approval and customer consent. The Central Bank's announcement of the regulation summarises its aims.
The new Central Bank Law, Federal Decree-Law No. 6 of 2025, widened the regulatory perimeter to include platforms and technology that enable financial services even where they do not deal with customers directly. Its one-year transition period ran to mid-September 2026, subject to any extension. Technology providers serving the financial sector should check whether their own activity now needs a licence. Our financial services outsourcing page covers the regulated-firm view.
DIFC and ADGM firms
Firms regulated by the DFSA or the ADGM's FSRA are subject to outsourcing rules in their rulebooks, which require the firm to remain responsible for outsourced functions, to assess material outsourcing, to keep regulator access and audit rights in the contract, and to engage with the regulator on material arrangements. Their data protection obligations come from the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021, which have their own processor and transfer rules.
Government and critical entities
In Dubai, the Dubai Electronic Security Center sets the Information Security Regulation and a Cloud Service Provider Security Standard; government and semi-government entities must use cloud providers certified under it. Federal government entities and critical-infrastructure operators follow national information assurance standards and guidance from the UAE Cyber Security Council and TDRA. Suppliers to these bodies should expect UAE hosting and security certification to be conditions of the tender.
| Sector | Main rule | Data location | Regulator engagement |
|---|---|---|---|
| General commercial (onshore) | PDPL, Federal Decree-Law No. 45 of 2021 | Transfers abroad allowed with adequacy or safeguards | None for outsourcing as such |
| Healthcare | ICT Health Law, Federal Law No. 2 of 2019 | UAE by default; limited exemptions with conditions | Health authority licensing conditions |
| Banks (CBUAE) | Outsourcing Regulation for Banks 2021 | Core data in UAE; customer data abroad only with approval and consent | Central Bank approval for certain arrangements |
| DIFC and ADGM financial firms | DFSA and FSRA rulebooks; DIFC and ADGM data laws | Transfers under the free zone data regimes | Engagement on material outsourcing |
| Dubai government | DESC Information Security Regulation and CSP Standard | Certified providers; UAE hosting usually required | DESC certification of the provider |
Key decisions in cloud outsourcing in the UAE
UAE region or global region
The arrival of UAE cloud regions from global providers has made in-country hosting realistic for most workloads. For regulated sectors it is often the only practical route. For others, a global region may be cheaper or offer services not yet available locally; the trade-off is a transfer analysis under the PDPL and, for any health or banking data, a localisation problem. Many organisations split workloads: regulated data in the UAE, analytics and development elsewhere on de-identified data.
Remember that hosting is only one dimension. Support engineers, security operations centres and backup sites may sit in other countries even when primary storage is local, and remote access from abroad can itself amount to a transfer. Ask the provider for a complete map of where data is stored, processed and accessed, and record it in the contract or a binding data processing addendum.
Standard terms or negotiated contract
Hyperscalers offer largely standard terms, with regulated-industry addenda that provide audit rights, regulator access and notification commitments. Smaller SaaS and managed-service providers will usually negotiate more. The question is not whether the terms are perfect but whether they meet your regulatory minimum and whether residual gaps can be closed with technical controls, such as customer-managed encryption keys. Our SaaS and technology contracts page goes deeper.
Outsourcing people as well as systems
Business process outsourcing moves staff and know-how. The UAE has no automatic transfer of employment on outsourcing, so staff who move to a provider need new contracts, visa transfers and end-of-service settlement under the Labour Law, Federal Decree-Law No. 33 of 2021. Read our guidance on outsourcing agreements and end-of-service benefits.
You can outsource the service. You cannot outsource the accountability to your regulator or your customers.
Process: from business case to go-live
- Classify the data and the function. Identify personal, health, banking, government or confidential commercial data, and whether the function is material or critical to the business.
- Check regulatory triggers. Map localisation rules, approval or notification duties and any sector certification requirements before choosing a provider.
- Due diligence on the provider. Review financial standing, security certifications (such as ISO 27001, ISO 27017, CSA STAR or DESC), data centre locations, subcontractors and incident history.
- Negotiate the contract. Secure data location, security standards, audit and regulator access, incident notification, sub-outsourcing controls, service levels, liability and exit assistance.
- Engage the regulator where required. File notifications or obtain approvals in good time, with the risk assessment and contract summary the regulator expects.
- Migrate and test. Run security and resilience testing, confirm data has landed where the contract says, and update records of processing and the outsourcing register.
- Govern the relationship. Monitor performance and risk, review the arrangement periodically and test exit and business continuity plans.
Contract terms that matter most
Whatever the sector, a contract for cloud outsourcing in the UAE should cover the following, either expressly or through the provider's documented commitments.
Data location and access
Named regions for storage and processing, restrictions on remote access from abroad, and commitments on government access requests. These are the clauses regulators ask about first.
Security and incidents
Security standards, certifications, encryption and key management, and incident notification fast enough for you to meet your own regulatory and contractual deadlines.
Audit and regulator rights
Rights for you, your auditors and your regulator to obtain information and audit, including pooled audits and certification reports where on-site audits are impractical.
Subcontracting
Notice of, and the right to object to, new subprocessors, with flow-down of security and data protection obligations along the chain.
Liability and service levels
Service credits are rarely enough. Negotiate higher caps for data breaches and confidentiality, and termination rights for persistent failure.
Exit and portability
Data return in usable formats, transition assistance, a run-off period and certified deletion. Exit plans must be workable, not just written.
Under the new Civil Transactions Law, Federal Decree-Law No. 25 of 2025, in force since 1 June 2026, review how your limitation and exclusion clauses will be read, especially for contracts governed by UAE law. UAE law has traditionally limited exclusions of liability for harmful acts and allowed courts to adjust agreed damages towards actual loss, so cloud outsourcing in the UAE governed by local law needs drafting that works with that approach rather than against it.
Security incidents, outages and concentration risk
The legal exposure in cloud outsourcing in the UAE crystallises when something goes wrong. A breach at a provider is still the customer's breach in the eyes of regulators and data subjects, and an outage at a single provider can take down several functions at once.
Breach notification chains
The federal PDPL, the DIFC Data Protection Law and the ADGM Data Protection Regulations each require controllers to notify the regulator, and in some cases affected individuals, of qualifying personal data breaches. Sector regulators, including the Central Bank and the health authorities, have their own incident reporting expectations. Your provider's notification commitment must be fast and detailed enough for you to meet the shortest of these. A contract promising notice "without undue delay" with no content requirements often leaves the customer guessing at the moment it most needs facts. Our data breach response page sets out the steps.
Concentration and resilience
Regulators increasingly look at whether too many critical functions depend on one provider or one region. Mitigations include multi-region or multi-provider architecture for critical services, documented recovery time objectives, regular failover testing and clear allocation of responsibility in the shared-responsibility model. For cloud outsourcing in the UAE by financial institutions, expect supervisors to ask for evidence that business continuity plans have been tested against the failure of a major provider, not merely written.
Risks and common mistakes
Hosting health or banking data abroad by default
Global SaaS tools often store data in the provider's home region unless configured otherwise. For a hospital, clinic, insurer or bank that can mean an immediate breach of localisation rules. The problem is often discovered during an audit, after years of use. Before onboarding any tool that may touch patient or customer data, confirm the region in writing and in the configuration, and check backups, logging and support access, which can sit elsewhere even when primary storage is local.
Missing regulator notification or approval
Regulated firms sometimes treat cloud as procurement rather than outsourcing. Regulators do not. A bank that moves a core system without the steps the Central Bank expects, or a DIFC firm that fails to engage the DFSA on a material outsourcing, risks enforcement and may be forced to unwind the arrangement. Keep a current outsourcing register, classify each arrangement and build regulator engagement into the project timetable.
Unworkable exit provisions
Exit clauses that simply say data will be returned on termination rarely work when a provider fails or a relationship ends acrimoniously. You need agreed formats, a transition period with continued service, assistance obligations at agreed rates and certified deletion. Test the exit plan with a sample migration. Regulators increasingly ask whether firms could actually leave a critical provider within a reasonable time.
Ignoring sub-outsourcing chains
A managed-service provider may rely on a hyperscaler, which relies on its own affiliates and contractors. Each link may access data or affect resilience. Contracts that do not require notice of material subcontractors, or flow down security and audit obligations, leave you blind. Ask for a full subprocessor list and a right to object or terminate if a change creates a regulatory or security problem.
Treating staff transfers as automatic
Unlike some jurisdictions, the UAE does not automatically transfer employees to a new provider when a function is outsourced. Ending employment triggers end-of-service gratuity and notice obligations, and new contracts and visa changes are needed at the provider. Poor handling causes disputes and service disruption. Agree the people plan, costs and timetable with the provider before signing, and communicate early with affected staff.
Cross-border angle
Many UAE businesses run shared services and technology operations from abroad, and many foreign groups serve their UAE operations from global platforms. The legal interaction runs in both directions.
Bangladesh and India. Offshore development centres and BPO teams in Dhaka, Chattogram, Bengaluru or Hyderabad commonly access UAE personal data. That access is a transfer under the PDPL and may be prohibited outright for localised health or banking data. Bangladesh's own data protection framework is evolving, and India's Digital Personal Data Protection Act 2023 imposes duties on the Indian side. TRW & Co's Dhaka office helps design compliant access models.
United Kingdom, EU and Singapore. Groups headquartered in London, Europe or Singapore often bring outsourcing frameworks built for the UK PRA and FCA, the EU's Digital Operational Resilience Act or the Monetary Authority of Singapore. Those frameworks are a good base, but UAE localisation and approval rules must be layered on top.
China and Saudi Arabia. Chinese providers are active in the UAE cloud market, and Chinese law contains its own rules on data export and state access that should be addressed in contracts. Saudi Arabia has strict cloud and data residency rules, so GCC-wide deployments often need separate Saudi and UAE regions.
How TRW & Co helps with cloud outsourcing in the UAE
We act for customers and providers on cloud, SaaS and outsourcing projects across regulated and unregulated sectors. Where representation before UAE onshore courts or the DIFC/ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners.
Regulatory mapping
We identify localisation, approval and notification rules for each workload and entity, and turn them into a decision memo the business and regulator can follow.
Contract negotiation
We negotiate hyperscaler addenda, SaaS terms and managed-service and BPO agreements, prioritising the clauses regulators and auditors examine.
Data protection
We prepare data processing agreements, transfer assessments and records of processing across the federal, DIFC and ADGM regimes.
Incidents and disputes
We advise on outages, breaches and service failures, including notification and recovery claims, with our cybersecurity incidents team.
See all our practices for related technology and data services.
Checklist for decision-makers
- Classify every workload by data type and business criticality.
- Confirm localisation rules for health, banking and government data.
- Check whether regulator notification or approval is needed before signing.
- Verify hosting regions, backups and support access in writing.
- Secure audit, regulator access and incident notification rights.
- Control subcontracting and require a current subprocessor list.
- Agree and test a realistic exit plan.
- Plan staff transfers, visas and end-of-service costs for BPO deals.
To discuss a cloud or outsourcing project, contact TRW & Co at info@trw.co.
Frequently asked questions
01Can we store UAE customer data in a cloud region outside the UAE?
For most general commercial data, yes, if the transfer meets the Personal Data Protection Law's requirements for adequate protection or appropriate safeguards. Health data is different: the ICT Health Law requires it to be held in the UAE unless a specific exemption applies. Banks need Central Bank approval and customer consent to send confidential customer data abroad. DIFC and ADGM entities follow their own data protection transfer rules. Check the sector rules before choosing a region.
02Does a bank need Central Bank approval to move to the cloud?
The Central Bank's Outsourcing Regulation for Banks treats cloud as outsourcing and requires banks to manage it under board-approved policies, due diligence and minimum contract terms. Data needed for core activities must stay in the UAE, and confidential customer data may not be sent abroad without Central Bank approval and customer consent. Depending on the arrangement, the bank may need to engage the Central Bank before going live. Build that step into the project plan from the start.
03What should a cloud contract include for a regulated firm?
At minimum: named data locations, security standards and certifications, prompt incident notification, audit and information rights for the firm and its regulator, controls on subcontracting, service levels with real remedies, liability caps that reflect data and confidentiality risk, and a workable exit plan with data return and deletion. Hyperscalers usually provide regulated-industry addenda covering many of these. The gap analysis against your regulator's rules is what matters.
04Do DIFC and ADGM firms follow the same outsourcing rules?
No. DFSA-regulated firms in the DIFC and FSRA-regulated firms in ADGM follow outsourcing rules in their own regulator's rulebook, and their data protection obligations come from the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021. The federal PDPL does not apply to them. If a group has entities both onshore and in a financial free zone, each entity's arrangements need to be checked against its own regime.
05What are the rules for cloud providers serving the Dubai government?
Dubai government and semi-government entities must ensure that their cloud providers comply with the Dubai Electronic Security Center's Cloud Service Provider Security Standard, which builds on ISO 27001, ISO 27017, CSA STAR and the Dubai Information Security Regulation. Providers are certified and audited periodically. Tenders typically also require UAE hosting. Suppliers aiming at government work should obtain certification early, because it is often a pass-or-fail condition.
06Do employees automatically transfer when we outsource a function?
No. UAE labour law has no equivalent of automatic transfer rules found in some other jurisdictions. If employees move to the provider, their existing employment must end, with notice and end-of-service gratuity paid under the Labour Law, and the provider must issue new contracts and arrange visa changes. Some employers negotiate recognition of prior service with the provider. Agree the people plan and costs before signing the outsourcing contract.
07Does the new Central Bank Law affect technology providers?
Possibly. Federal Decree-Law No. 6 of 2025 brought platforms, applications and technologies that enable licensed financial activities within the Central Bank's perimeter, even where they do not deal with customers directly. Its one-year transition period ran to mid-September 2026, subject to any extension. Providers whose products facilitate payments, lending or other financial services for UAE customers should review whether they now need a licence or a regulated partner.
Sources and official materials
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection — Processors and cross-border transfers
- CBUAE Outsourcing Regulation for Banks (announcement) — Central Bank outsourcing regime for banks
- Dubai Electronic Security Center — Information Security Regulation and CSP Standard
- Dubai Financial Services Authority — DIFC outsourcing rules
- ADGM Office of Data Protection — ADGM data protection regime
- Telecommunications and Digital Government Regulatory Authority — Digital government and ICT regulation
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
