TRW & Co · Data protection and AI
Cross-Border Data Transfers and Data Localisation in the UAE
Data localisation UAE rules are sector-specific, not universal. The federal PDPL lets personal data leave the country with adequate protection or a recognised exception, but health data, parts of financial services and government cloud workloads face genuine in-country requirements. This guide shows which rule applies, how to document lawful transfers and what the new cloud sovereignty tiers mean.
Key pointThe riskiest datasets are rarely governed by the PDPL at all: health, banking and government data sit under separate laws and policies, and remote access by offshore support teams can count as a transfer even when servers stay in the UAE.
At a glance
No general localisation
The federal PDPL permits cross-border transfers through adequacy or listed exceptions such as contracts, express consent and legal-claim necessity, rather than requiring data to stay onshore.
Health data stays home
Federal Law No. 2 of 2019 keeps health data in the UAE by default, with ministerial exemptions for cases such as overseas treatment, research, insurance and telemedicine.
Cloud sovereignty tiers
The National Cloud Security Policy links hosting expectations to data classification, with in-country keys and refusal of foreign access at the most sensitive tier.
Free zones differ
DIFC and ADGM use their own adequacy lists, standard clauses and binding corporate rules, and treat transfers to mainland UAE as international transfers.
New federal authority
In June 2026 the Cabinet consolidated the UAE Data Office into a new Artificial Intelligence and Data Authority reporting directly to the Cabinet.
Swipe or scroll →
The short answer on data localisation UAE rules
There is no single, economy-wide rule on data localisation UAE businesses must follow. The federal Personal Data Protection Law (PDPL) allows personal data to leave the country if the destination offers adequate protection or a recognised exception applies. Hard localisation comes from sector rules instead: health data, parts of the financial sector, and government and critical-infrastructure workloads in the cloud.
That layering is what catches companies out. A retailer running a customer database on an overseas cloud may be entirely lawful, while a clinic, a payment firm or a supplier to a federal ministry doing the same thing may be in breach. The answer turns on what the data is, who holds it, and where the entity is licensed.
The free zones add a further split. The DIFC and ADGM each run their own common-law data protection regimes with their own transfer rules, and they treat onshore UAE as a separate jurisdiction. A group with a mainland operating company and a DIFC holding entity is therefore managing at least two transfer frameworks at once.
As of October 2026, this guide explains where localisation genuinely bites, how lawful transfers are structured, what the cloud sovereignty tiers mean for procurement, and the practical steps that keep an international data flow defensible.
Who sets the rules: federal, sector, emirate and free zone layers
Before choosing a transfer mechanism, identify which regime governs each dataset. Four layers usually matter.
The federal PDPL: transfer, not localisation
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been in force since 2 January 2022, according to the UAE Government portal on data protection laws. Its cross-border provisions sit in Articles 22 and 23. Article 22 permits transfers to countries with adequate protection, through data protection legislation or relevant international agreements. Article 23 sets out routes where adequacy is absent, including a contract binding the recipient to PDPL-equivalent standards, the data subject's express consent where it does not conflict with public or security interests, and transfers necessary for legal claims, contract performance or international judicial cooperation.
The difficulty is operational. The Executive Regulations that should detail the adequacy process and transfer procedures have not been published, no official adequacy list exists, and no federal standard contractual clauses have been issued. Companies therefore document their reasoning against the statutory tests rather than ticking a regulator-issued box.
The regulatory map also moved in 2026. On 14 June 2026 the Cabinet announced a new Artificial Intelligence and Data Authority, consolidating the UAE Data Office with the federal AI office and the TDRA's digital government sector. Watch that body for transfer guidance; the PDPL itself remains the operative law. Our guide to the UAE PDPL covers the wider obligations.
Health data: the clearest localisation rule
The PDPL excludes health data, which is governed by Federal Law No. 2 of 2019 on the use of information and communications technology in health fields. For data localisation UAE purposes, that law is the closest thing the country has to a true mandate: health data relating to services provided in the UAE should be stored and processed inside the country unless a permitted case applies.
A Ministry of Health and Prevention resolution sets out the exempt categories, such as overseas treatment, scientific research, insurance, telemedicine and wearable devices, with local emirate health authorities playing a role in approvals. Health-tech platforms, insurers and pharmaceutical groups should treat this regime as the starting point, not the PDPL. See our healthcare regulation page for licensing context.
Financial services: storage and outsourcing expectations
Banking and credit data also fall outside the PDPL. Institutions licensed by the Central Bank of the UAE operate under its consumer protection, outsourcing and payments frameworks, several of which contain data-storage and approval expectations that in practice keep customer and payment data onshore or require prior sign-off for offshore processing. Because these expectations are licence-specific, data localisation UAE analysis for a payments or lending business must start from the licence, not the PDPL. Fintechs should read the current rulebook text for their licence category rather than rely on general summaries; our fintech regulation page explains the licensing map.
DIFC and ADGM: self-contained regimes
Entities in the DIFC follow the DIFC Data Protection Law No. 5 of 2020; entities in ADGM follow the ADGM Data Protection Regulations 2021. Both use adequacy findings, standard contractual clauses and binding corporate rules in a way that closely tracks European practice. Neither imposes general localisation, but both treat a transfer to mainland UAE as an international transfer requiring a lawful basis. Our guides to the DIFC Data Protection Law and the ADGM Data Protection Regulations go deeper.
Cloud sovereignty tiers: the newest data localisation UAE layer
The most significant recent development is the National Cloud Security Policy issued by the UAE Cyber Security Council, now in a second version. It addresses both cloud consumers and cloud service providers and includes a dedicated domain on data location and sovereignty.
Legal commentary on the revised policy describes a tiered model. Baseline security requirements apply to all providers. A partial sovereign tier, aimed at confidential or restricted data, expects consumer data to remain within UAE geography and jurisdiction. A full sovereign tier, for more sensitive classifications, expects data to remain under exclusive UAE jurisdiction, with hosted encryption keys generated and managed in the country and foreign access requests refused by default.
The policy is aimed primarily at federal and emirate government entities and at critical information infrastructure operators, with emirate-level programmes taking the lead where they exist. Private companies are reached indirectly: if you sell software, managed services or analytics to a ministry, a utility or a bank, your customer will push these expectations into your contract.
Classify first, then buy. The sovereignty tier depends on the classification of the data, not the size of the customer. A contract to process public, non-sensitive data for a government entity may sit at baseline, while a small dataset of restricted information can trigger full sovereign hosting, in-country key management and limits on foreign support access.
How to structure a defensible transfer, step by step
Whatever the regime, a defensible approach to data localisation UAE questions follows the same sequence. The aim is a short, dated record showing why each flow is lawful.
- Inventory datasets and flows. List each system holding personal or classified data, where it is hosted, who can access it from abroad (including support desks and group IT) and which vendors sit in the chain.
- Assign the governing regime. Tag each dataset as PDPL, health, financial, government/CII, DIFC or ADGM. Mixed systems take the strictest applicable rule unless the data can be segregated.
- Check for a localisation trigger. Confirm whether a sector rule or a sovereignty tier requires in-country storage, in-country processing or prior approval. If it does, the question becomes whether an exemption or approval is available.
- Choose the transfer route. For PDPL data, document adequacy reasoning or an Article 23 route, usually a contract. For DIFC and ADGM data, use the centre's adequacy list, standard clauses or binding corporate rules.
- Paper the vendor chain. Put data processing terms in place with each processor and sub-processor, covering location, onward transfer, access requests, breach notice and deletion. Our data processing agreements team drafts these.
- Assess foreign access risk. Record whether foreign authorities could compel access to the data and what technical controls, such as customer-held keys, reduce that risk.
- Review on change. Revisit the record when a vendor, hosting region, product feature or regulation changes, and at least annually.
Transfer mechanisms compared across UAE regimes
The table summarises the main options. It is a planning aid: confirm current requirements before relying on any route.
| Regime | Default position | Main routes | Practical note |
|---|---|---|---|
| Federal PDPL (onshore) | Transfer permitted with safeguards | Adequacy (Art. 22); contract, express consent, legal claims, contract necessity (Art. 23) | No published adequacy list or federal clauses yet; document reasoning |
| Health data (federal health ICT law) | Localisation unless an exemption applies | Ministerial exemption categories; health authority involvement | Treat offshore analytics and support access as transfers |
| Central Bank licensees | Sector storage and outsourcing rules | Prior approval or compliant outsourcing arrangements | Read the rulebook for your licence category |
| Government and CII cloud workloads | Tiered by data classification | Baseline, partial sovereign or sovereign hosting | In-country keys and access refusal at higher tiers |
| DIFC | Transfer permitted with safeguards | Adequacy list, standard clauses, binding corporate rules, derogations | Mainland UAE is treated as a separate jurisdiction |
| ADGM | Transfer permitted with safeguards | Adequacy, ADGM standard clauses or addendum, binding corporate rules | Closely aligned with EU-style tools |
Illustrative scenario: a SaaS platform selling into government and health
This scenario is illustrative and does not describe any real client. A software company headquartered in Singapore sells a scheduling and analytics platform. Its UAE subsidiary is licensed on the mainland in Dubai; customer data sits in a European cloud region and support is provided from India.
For ordinary corporate customers, the PDPL analysis is manageable. The company relies on a contractual route, with processing terms that bind its group entities and cloud provider to PDPL-equivalent standards, and keeps a short transfer assessment on file.
Two new deals change the picture, and show how data localisation UAE obligations attach to customers and data types rather than to the vendor itself. A private hospital group wants the platform for patient appointments, which brings the health ICT law into play. Unless an exemption applies, patient data should be hosted in the UAE, and remote access by the Indian support team needs to be analysed as a transfer. A federal entity also wants the product for internal scheduling of classified information, and its procurement team asks for partial sovereign hosting under the cloud policy.
The practical solution is a UAE region deployment for health and government tenants, with in-country key management for the government tenant and a support model that limits offshore access to metadata. The company keeps its European deployment for other customers. Each contract states exactly which deployment applies, avoiding a costly migration of the whole customer base.
Common data localisation UAE mistakes
Treating the PDPL as the whole answer
The PDPL expressly leaves health, banking and credit, and government data to other laws. Companies that run a single PDPL-based transfer assessment often miss the stricter sector rule that actually governs their most sensitive dataset. Start every assessment by asking which regime applies, and expect more than one answer inside a single organisation.
Ignoring remote access
Localisation is not only about where servers sit. A UAE-hosted database that offshore engineers or a group help desk can query in real time may still involve a transfer. Map who can see the data, from where, and under what controls. Logging, just-in-time access and pseudonymisation can make remote support defensible where full localisation is required.
Assuming free zone rules travel with the group
A DIFC or ADGM entity cannot rely on its free zone's adequacy decisions for data it holds as a mainland business, and vice versa. Groups with entities in several zones need a transfer record per legal entity and should not route data through a free zone entity to avoid onshore requirements.
Relying on consent as the default
Express consent is a PDPL route, but it is fragile: it can be withdrawn, it must be informed, and it may conflict with public or security interests. For recurring business flows, a contract-based route with clear safeguards is more durable. Keep consent for genuinely occasional, individual-driven transfers.
Signing cloud terms without a sovereignty clause
Standard hyperscaler terms rarely commit to a UAE region, in-country keys or refusal of foreign access requests. If your customers include government or critical-infrastructure entities, negotiate those commitments up front and flow them down to sub-processors. Retrofitting them after an audit is far more expensive.
The cross-border angle: UK, EU, Singapore, India and Bangladesh
Most UAE groups transfer data in both directions, so the counterpart rules matter as much as data localisation UAE requirements. Getting one side right while ignoring the other leaves the flow exposed. Data arriving from the UK or EU must already satisfy the exporter's regime, which often means UK or EU standard clauses; the UAE recipient then inherits contractual obligations that may be stricter than local law.
Singapore-headquartered groups commonly apply a single group transfer framework; that works if it includes a UAE annex mapping PDPL routes and sector exceptions. For Indian and Bangladeshi service providers, which support many Gulf back offices, the key issues are remote access controls and whether the work involves health, banking or government data. TRW & Co's offices in Dhaka, Singapore and London help align both ends of the flow. For transfer documentation beyond localisation, see our cross-border data transfers practice page.
What to do next: a localisation checklist
Use this checklist to turn data localisation UAE analysis into decisions your procurement, IT and legal teams can act on.
- Build a dataset register tagged by regime: PDPL, health, financial, government/CII, DIFC, ADGM.
- Identify every dataset with a hard localisation or approval trigger and confirm its current hosting.
- Classify government and CII customer data against the cloud policy tiers before bidding.
- Document a transfer route for each offshore flow, preferring contracts over consent for recurring transfers.
- Update vendor and intra-group agreements with location, access-request and key-management terms.
- Plan breach response across jurisdictions; our guide to data breach notification in the UAE sets out the timelines.
- Track the new Artificial Intelligence and Data Authority for PDPL regulations, adequacy decisions and clauses.
If you need a transfer assessment, a sovereign cloud contract review or a group data map, contact TRW & Co at info@trw.co or +971 58 942 1012.
Frequently asked questions
01Does UAE law require all personal data to be stored in the UAE?
No. The federal PDPL regulates transfers rather than requiring localisation. Personal data can leave the UAE where the destination provides adequate protection or an exception applies, such as a contract imposing equivalent safeguards, the data subject's express consent, or necessity for legal claims or contract performance. Localisation obligations arise from sector rules instead, mainly for health data, certain financial-sector data and government or critical-infrastructure workloads hosted in the cloud. Each dataset should be checked against the regime that actually governs it.
02Can health data be transferred outside the UAE?
Only in permitted cases. Federal Law No. 2 of 2019 on ICT in health fields keeps health data relating to UAE services inside the country unless an exemption applies. A ministerial resolution lists exempt categories, including overseas treatment, scientific research, insurance, telemedicine, drug safety and personal medical devices. Health providers, insurers and health-tech platforms should map every offshore flow, including remote support access and analytics, against those categories and the requirements of the relevant emirate health authority before transferring anything.
03Has the UAE published an adequacy list under the PDPL?
As of October 2026, no official federal adequacy list or standard contractual clauses have been published, because the PDPL Executive Regulations have not been issued. Businesses therefore document their reasoning against Articles 22 and 23 directly, usually relying on a contract that binds the recipient to PDPL-equivalent standards. The new Artificial Intelligence and Data Authority, which absorbed the UAE Data Office in 2026, is the body to watch for future adequacy decisions and transfer tools.
04What is the National Cloud Security Policy?
It is a policy issued by the UAE Cyber Security Council setting security and sovereignty expectations for cloud consumers and cloud service providers. It applies chiefly to federal and emirate government entities and critical information infrastructure operators. Commentary on the revised version describes baseline requirements for all providers and higher sovereign tiers, linked to data classification, that expect UAE hosting, in-country encryption key management and default refusal of foreign access requests. Private suppliers feel it through customer contracts.
05Do DIFC companies need to localise data?
Generally no. The DIFC Data Protection Law allows transfers to jurisdictions on its adequacy list or under safeguards such as standard contractual clauses or binding corporate rules, with limited derogations. The important nuance is that mainland UAE is treated as a separate jurisdiction, so moving data from a DIFC entity to an onshore affiliate is an international transfer that needs a lawful route. Sector rules, for example on health data, may still apply alongside the DIFC regime.
06Does remote access from abroad count as a data transfer?
It can. If staff or vendors outside the UAE can view or query personal data held on UAE servers, many regulators and practitioners treat that access as a transfer. Where localisation applies, such as for health data or sovereign cloud workloads, unrestricted offshore access may defeat the purpose of local hosting. Controls such as role-based access, logging, pseudonymisation and customer-held encryption keys help, and the access model should be written into vendor and intra-group agreements.
Sources and official materials
- Data protection laws — UAE Government portal — Overview of the PDPL, UAE Data Office, health data law and free zone regimes
- National Cloud Security Policy — UAE Government portal — Cloud consumer and provider domains, including data location and sovereignty
- Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority — UAE Cabinet — June 2026 consolidation of the UAE Data Office into a new federal authority
- Central Bank of the UAE — Rulebook and regulations for licensed financial institutions
- Dubai International Financial Centre — DIFC Data Protection Law and transfer tools
- Abu Dhabi Global Market — ADGM Data Protection Regulations 2021 and transfer tools
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
