SaaS and Technology Contracts in the UAE

A SaaS agreement UAE customers and providers sign is a services contract, a licence and a data processing arrangement rolled into one. Onshore it is governed by the federal Civil Transactions Law, with the Personal Data Protection Law, the Copyright Law and the Electronic Transactions and Trust Services Law shaping key clauses; DIFC and ADGM contracts sit under their own common-law style rules and data protection regimes.

This guide sets out the terms that decide whether a SaaS or technology contract works in practice: scope and service levels, data and security clauses, intellectual property, liability allocation, exit and the choice of law and forum. It also explains what changes under the new Civil Transactions Law in force from 1 June 2026. For broader support, see our pages on SaaS and technology contracts in the UAE and technology transactions in the UAE.

SaaS agreement UAE: the short answer

• No SaaS-specific statute. Cloud subscriptions are governed by general contract law, plus sector rules for regulated customers such as banks and healthcare providers.
• Data clauses carry the most legal risk. The provider is usually a processor of the customer's personal data, so the contract must meet the applicable data protection regime: federal PDPL, DIFC or ADGM.
• Liability caps work, within limits. Parties can allocate risk, but liability for fraud and gross fault cannot be excluded, and agreed compensation can be reduced by a court if excessive.
• Service levels need teeth. Availability targets, service credits and termination rights for chronic failure should be measurable and linked.
• Exit is where value is lost. Data return formats, transition assistance and deletion certificates should be agreed before signature.

The legal framework

A SaaS agreement UAE law governs draws on several statutes at once. Identifying which apply is the first drafting task, because the answer changes the data, security and liability clauses.

Contract law

Onshore, the baseline was the Civil Transactions Law, Federal Law No. 5 of 1985. The new Civil Transactions Law, Federal Decree-Law No. 25 of 2025, is in force from 1 June 2026. Among other changes, it narrows the court's power to adjust agreed compensation and recognises a confidentiality duty for information exchanged during negotiations and under contracts. Long-term subscriptions that straddle the change should be checked against the transitional rules. Our article on the UAE Civil Transactions Law 2025 covers the reform in detail.

In the DIFC, the DIFC Contract Law and related laws apply; in ADGM, English common law applies under its legal framework.

Data protection

• Federal PDPL. Federal Decree-Law No. 45 of 2021 governs personal data processing onshore and in most free zones, with the UAE Data Office as regulator. It requires processors to act on documented instructions and keep data secure, and restricts cross-border transfers.
• DIFC. The DIFC Data Protection Law, DIFC Law No. 5 of 2020, has detailed controller and processor contract requirements. See our DIFC data protection law guide.
• ADGM. The ADGM Data Protection Regulations 2021 follow a GDPR-style model.
• Sector rules. Health data is subject to the federal law on information and communications technology in health fields, Federal Law No. 2 of 2019, which restricts storing health data outside the UAE except as permitted. Central Bank-regulated institutions must also meet the Central Bank's outsourcing and technology risk expectations.

Intellectual property and electronic contracting

Software is protected as a literary work under the Copyright Law, Federal Decree-Law No. 38 of 2021, without registration. Click-through and electronically signed subscriptions are generally valid under the Electronic Transactions and Trust Services Law, Federal Decree-Law No. 46 of 2021, described on the UAE Government portal. Consumer-facing SaaS must also respect the Consumer Protection Law, Federal Law No. 15 of 2020, and the federal law on trading by modern technology means. Texts are on the UAE Legislation portal.

Key commercial terms

Scope, subscription and changes

Define the service by reference to a documented feature set and a version policy. Providers want the right to change the service; customers need protection against changes that remove material functionality. A common compromise allows improvements and security changes freely but requires notice and a termination right for material adverse changes.

Service levels and credits

Availability should be measured over a stated period, with clear exclusions for planned maintenance and customer-caused outages. Service credits are usually the first remedy, but the contract should say whether they are the sole remedy. Customers should insist on a termination right for repeated failures, otherwise chronic underperformance can continue indefinitely. Under the new Civil Transactions Law, a credit regime that functions as agreed compensation may be reduced by a court if it is excessive, so credits should be proportionate.

Fees, renewals and price increases

Auto-renewal and indexed price increases are common and enforceable if clearly agreed. Specify notice periods for non-renewal and caps on increases. Value added tax generally applies to electronic services supplied to UAE customers; the parties should state whether fees are exclusive of VAT and how a non-resident provider will account for it. The Federal Tax Authority publishes the relevant guidance, and tax agents should confirm the position.

Acceptable use, suspension and customer obligations

Providers reserve the right to suspend the service for non-payment, security threats or breach of an acceptable use policy. For customers, an unrestricted suspension right is a serious operational risk. A balanced SaaS agreement UAE businesses can live with limits suspension to what is necessary, requires prior notice except in a genuine emergency, and obliges the provider to restore the service promptly once the issue is resolved.

Customer obligations deserve equal care. The customer is usually responsible for its users, credentials and the lawfulness of the data it uploads, including any notices or consents needed under the PDPL. Make those obligations specific so that responsibility for an incident caused by a compromised customer account is clear.

Data and security clauses

For most customers, the data clauses are the most important part of a SaaS agreement UAE regulators would look at after an incident. The contract should contain, or attach, a data processing agreement that matches the applicable regime; our page on data processing agreements in the UAE explains what each regime requires.

• Roles. State who is controller and who is processor, and the processing purposes.
• Security. Describe technical and organisational measures by reference to a recognised standard, with audit or certification rights.
• Breach notification. Require notice to the customer without undue delay, with the information the customer needs to meet its own notification duties. See our guide to data breach notification in the UAE.
• Location and transfers. Name hosting regions and require notice before change. Cross-border transfer rules differ between the PDPL, DIFC and ADGM, and some sectors require local hosting.
• Sub-processors. Maintain a list, flow down equivalent obligations and give the customer a right to object.

Liability allocation and intellectual property

Caps, exclusions and indemnities

UAE law allows parties to allocate risk, but there are limits. Liability for fraud and gross fault cannot be excluded, and onshore courts retain a power to reduce excessive agreed compensation. A cap tied to fees is normal; a higher separate cap for data protection and confidentiality breaches is increasingly common. Indemnities for third-party IP infringement claims are standard from the provider. Our article on limitation of liability and indemnities in UAE law explains how courts read these clauses.

Intellectual property and customisations

The provider keeps ownership of the platform. The customer owns its data and, usually, outputs generated from it. Customisations and integrations need a clear rule: owned by the provider and licensed to the customer, or assigned to the customer. Because the Copyright Law contains rules on works created under commission and employment, the contract should state ownership expressly rather than rely on default rules. Where AI features are included, address training on customer data and ownership of outputs; see our guide to AI regulation in the UAE.

The contracting process

1. Classify the deal. Identify the customer's regulator, the data involved, and whether the contract is consumer, enterprise or regulated outsourcing.
2. Choose the framework. Decide on governing law, forum and the data protection regime (federal, DIFC or ADGM) before marking up terms.
3. Diligence the service. Review security certifications, hosting regions, sub-processors, uptime history and business continuity plans.
4. Negotiate the core terms. Focus on service levels, data clauses, liability, IP and exit, using the table above as a starting point.
5. Align the paper. Make sure the order form, master terms, data processing agreement and service level schedule have a clear order of precedence.
6. Sign properly. Use authorised signatories and keep the electronic signature audit trail.
7. Manage the contract. Track renewals, service credits, audit rights and sub-processor notices during the term.

An illustrative scenario

Illustrative only; the parties and facts are generic. A mid-sized Dubai mainland retailer subscribes to a cloud customer-relationship platform from an overseas provider on the provider's standard terms. Two years later, the provider suffers a security incident affecting customer contact data, and the retailer must manage notifications and customer complaints.

The retailer then discovers that its SaaS agreement UAE counsel never reviewed: the provider's liability is capped at one month's fees, breach notice is promised only "promptly", and the data processing terms refer to a foreign regime without reflecting the federal PDPL. The exit clause allows deletion of data within days of termination. With a negotiated agreement, the retailer would have had a data breach super-cap, specific notification content and timing, PDPL-aligned processing terms and an export window to move to a new provider.

Risks and common mistakes

The cross-border angle

Many SaaS providers serving UAE customers are based in the UK, the EU, India, Singapore or the US, and contract on their home law. A foreign governing law is generally permissible, but enforcing a foreign judgment in the UAE can be slow, and onshore court proceedings require Arabic translations. Arbitration seated in the UAE or abroad, or DIFC or ADGM jurisdiction, can be a practical neutral choice. Cross-border hosting also raises transfer questions under the PDPL, DIFC and ADGM regimes; see cross-border data transfers and data localisation in the UAE.

Checklist before signing

• Which data protection regime applies, and is a compliant data processing agreement attached?
• Where will data be hosted and accessed, and who are the sub-processors?
• Are service levels measurable, with credits and a termination right for repeated failure?
• Is the liability cap proportionate, with a super-cap for data and confidentiality breaches?
• Are fraud and gross fault outside any exclusion, as UAE law requires?
• Who owns customisations, integrations and AI-generated outputs?
• Is there a usable export window, transition help and certified deletion on exit?
• Do governing law and forum give the customer a realistic enforcement route?

TRW & Co negotiates SaaS and technology agreements for customers and providers, prepares data processing terms and advises on disputes. Where court representation is required, we work alongside locally licensed advocates and registered DIFC and ADGM practitioners. To review a SaaS agreement UAE contract or template, contact our Dubai team at info@trw.co or +971 58 942 1012.

Frequently asked questions

Sources and official materials

1. UAE Legislation portal — Civil Transactions Law, PDPL, Copyright Law and consumer protection texts
2. Electronic Transactions and Trust Services Law, UAE Government portal — Electronic contracts and signatures
3. Federal Tax Authority — VAT guidance on electronic services
4. ADGM Legal Framework — Common-law contract rules in ADGM
5. DIFC Courts — Forum for DIFC technology contract disputes
6. Central Bank of the UAE — Outsourcing and technology risk expectations for licensed institutions

General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.