Daljeet Singh
Co-Founder and Director of Business Development
UAE data residency requirements are often described as a single rule that all data must stay in the country. That is not how UAE law works. The federal Personal Data Protection Law (PDPL) does not require personal data to be stored in the UAE. It sets conditions for transferring personal data abroad. Requirements to keep data inside the UAE come from sector rules: health data, banking and payments, IoT services, and government data.
For an organisation in Dubai or elsewhere in the UAE, the practical question is which of these rules apply to your data, and what each one requires. This guide sets out the federal law, the sector rules, the free zone regimes in the DIFC and ADGM, what SaaS providers need to consider, and the cloud options for hosting data inside the UAE.
Table of Contents
Data residency, data localisation and data sovereignty
The three terms are often used interchangeably, but they mean different things, and the difference matters when reading UAE rules.
- Data residency is where data is physically stored and processed, usually chosen by the organisation for legal, contractual or performance reasons.
- Data localisation is a legal requirement to keep certain data inside a country. In the UAE this applies to specific sectors, not to all data.
- Data sovereignty is the principle that data is subject to the laws of the country where it is held, which affects who can compel access to it.
Does UAE law require data to be stored in the UAE?
Not as a general rule. The table summarises the main UAE requirements and whether each one is a true localisation rule or a restriction on transfers abroad.
| Rule | Applies to | Type | What it requires |
|---|---|---|---|
| UAE PDPL (Federal Decree-Law No. 45 of 2021) | Personal data of people in the UAE, outside excluded categories and free zones | Transfer restriction | Transfers abroad allowed to adequate countries or under listed conditions |
| Health data law (Federal Law No. 2 of 2019, Article 13) | Health data relating to health services provided in the UAE | Localisation | Store and process in the UAE, with listed exceptions |
| Central Bank of the UAE rules | Licensed financial institutions, payment and stored value providers | Localisation | Consumer and transaction data and the master system of record kept in the UAE |
| TDRA IoT Regulatory Policy (2018) | IoT service providers and others involved in IoT in the UAE | Localisation by data class | Secret, sensitive and confidential data stored primarily in the UAE; government data in those classes always in the UAE |
| Government cloud rules (DESC, Cyber Security Council) | Government entities, critical infrastructure and their cloud providers | Localisation in practice | Certified providers, known data location and acceptable legal jurisdiction |
| DIFC and ADGM data protection laws | Organisations in the two financial free zones | Transfer restriction | Transfers to adequate jurisdictions or with safeguards such as standard clauses |
UAE PDPL data residency requirements
The UAE PDPL, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. It applies to the processing of personal data of people in the UAE, wherever the controller or processor is based. It does not apply to government data, data held by security and judicial authorities, health data and banking and credit data covered by their own laws, or organisations in the DIFC and ADGM, which have their own data protection laws.
The PDPL does not say where personal data must be stored. Instead, Articles 22 and 23 set conditions for sending it outside the UAE:
- Article 22, adequate countries. Transfers are allowed to countries approved by the UAE Data Office, whose functions are moving to the new Federal Authority for Artificial Intelligence and Data, because they have a data protection law covering the main principles, or a data protection agreement with the UAE.
- Article 23, other countries. Where there is no adequacy approval, transfers are allowed in listed cases, including a contract that binds the recipient to PDPL-level protection, the data subject’s express consent, performance of a contract with the data subject, legal proceedings, international judicial cooperation and the public interest.
The PDPL’s executive regulations had not been issued as of mid-2026, and no adequacy list or standard contractual clauses have been published. The UAE Data Office never became fully operational, and in June 2026 the UAE created the Federal Authority for Artificial Intelligence and Data, which takes over its functions. In practice, organisations transferring personal data abroad rely on the contract and consent conditions in Article 23. Once the executive regulations are issued, organisations will have six months to comply. Treat any published PDPL fine amounts or adequacy lists with caution until the regulations appear.
Health data
Health data has the clearest localisation rule in UAE law. Article 13 of Federal Law No. 2 of 2019 on the Use of ICT in Health Fields provides that health data relating to health services provided in the UAE may not be stored, processed, generated or transferred outside the country, except in cases set by a decision of the health authority in coordination with the Ministry of Health and Prevention.
Ministerial Resolution No. 51 of 2021 sets out permitted exceptions, ten as most legal guides count them: treatment abroad, samples sent to overseas laboratories, approved scientific research, insurance claims, cooperation with UAE government bodies, simple wearable devices, pharmacovigilance, other transfers approved under the resolution, telemedicine and a formal request from the patient. Several exceptions require written consent and encryption, and some require a copy of the data to remain in the UAE.
The emirate health authorities add their own rules. Abu Dhabi’s Department of Health applies the ADHICS standard, which tightly controls cloud use for health information: the 2019 version prohibited it without Department of Health approval, and the current version, effective from August 2024, is described as requiring approval before patient data is placed in the cloud. The Dubai Health Authority has its own health information classification and consent standards. Healthcare providers, insurers and health technology companies should assume that patient data must be hosted in the UAE unless a specific exception applies.
Banking, payments and financial services
The Central Bank of the UAE (CBUAE) does not have one data residency law. Its requirements sit in several regulations, and together they amount to localisation for regulated financial institutions:
- Consumer Protection Standards. Licensed financial institutions must hold and store all consumer and transaction data within the UAE, with a secure backup in a separate location.
- Outsourcing Regulation for Banks. The master system of record, including confidential data, must be kept in the UAE. Customer confidential data cannot be sent abroad without Central Bank approval and the customer’s prior written consent. Foreign bank branches may keep a daily updated copy in the UAE instead, with approval.
- Retail Payment Services and Card Schemes Regulation, Stored Value Facilities Regulation and Payment Token Services Regulation. Personal and payment data must be stored and maintained in the UAE. The Payment Token Services Regulation allows exceptions approved by the Central Bank.
- Open Finance Regulation. Open finance data must be stored in the UAE, with no copies abroad without Central Bank approval and the user’s written consent.
- Operational Risk Management Regulation. In force from 14 September 2026 for licensed financial institutions, it requires the master system of record to be kept in the UAE, including when functions are outsourced, and introduces incident reporting within four hours.
In February 2026 the CBUAE announced a partnership with Core42, a G42 company, to build a Sovereign Financial Cloud Services Infrastructure for licensed financial institutions under its Financial Infrastructure Transformation programme. It is described as a dedicated and isolated environment with multi-cloud management. The announcement does not say that licensed institutions will be required to use it, and gives no go-live date.
Government data, IoT and critical infrastructure
TDRA IoT Regulatory Policy. The policy, dated March 2018, classifies data as open, confidential, sensitive or secret. For individuals and businesses, secret, sensitive and confidential data should be stored primarily in the UAE and may be stored abroad only where the destination provides at least equivalent security. Government data in those classes must always be stored in the UAE. Open data can be stored anywhere. The policy applies to IoT service providers and others involved in IoT services in the UAE, including providers based abroad that serve the UAE market.
Dubai government. Cloud providers serving Dubai government and semi-government entities must be certified under the Dubai Electronic Security Center’s Cloud Service Provider Security Standard. Dubai government data is classified under the Dubai Data Law (Law No. 26 of 2015) and its data policies.
National Cloud Security Policy. Issued by the UAE Cyber Security Council in 2023 and updated in September 2025, the policy is mandatory for government entities, critical infrastructure entities and the cloud providers serving them, and recommended for others. Its data location and sovereignty requirements cover knowing where data is stored, processed and managed, and making sure cloud providers operate within acceptable legal jurisdictions.
UAE IA Standard. Government entities and designated critical information infrastructure must also meet the UAE Information Assurance Standard, which includes cloud and data protection controls. See our guide to NESA compliance and the UAE IA Standard.
DIFC and ADGM
The two financial free zones have their own data protection laws, and the federal PDPL does not apply to organisations within them.
DIFC. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) allows transfers out of the DIFC to jurisdictions the Commissioner has found adequate, or with safeguards such as the Commissioner’s standard contractual clauses or binding corporate rules, or under listed derogations. Amendments in DIFC Law No. 1 of 2025, in force from 15 July 2025, introduced a private right of action that lets individuals claim compensation directly in the DIFC Courts, clarified that the law covers DIFC-incorporated organisations wherever they process data and organisations incorporated elsewhere, including sub-processors, that process data in the DIFC under stable arrangements, and increased several fines.
ADGM. The ADGM Data Protection Regulations 2021 allow transfers to jurisdictions on the Commissioner’s adequacy list, or with ADGM standard contractual clauses, binding corporate rules or derogations. Fines can reach USD 28 million.
Transfers between a free zone and the rest of the UAE are cross-border transfers under the free zone laws and need a valid transfer basis.
Data residency requirements for SaaS providers
No UAE law requires SaaS data in general to be hosted in the UAE. A SaaS provider serving UAE customers can usually host personal data abroad if the PDPL transfer conditions are met, typically through a data processing agreement that binds the provider to PDPL-level protection.
In-country hosting becomes a requirement when the SaaS product handles data covered by a sector rule:
- patient or health data for UAE health services
- consumer, transaction or payment data for a CBUAE-licensed customer
- government data, or data for government and critical infrastructure customers that require certified cloud providers
- secret, sensitive or confidential data handled by an IoT service
Customers in these sectors will usually ask for UAE hosting, a description of where each component stores and processes data, including backups, logs and support access, and contract terms covering transfers and breach notification. As a processor under the PDPL, the SaaS provider should process data only on the customer’s instructions, apply security measures such as encryption, keep a record of processing and notify the customer of breaches.
Where to host data in the UAE
Several hyperscale and sovereign cloud providers operate in the UAE. Check each provider’s current documentation for the services available in-country, because not every service in a region keeps all of its data there.
| Provider | UAE presence | Notes |
|---|---|---|
| Amazon Web Services | Middle East (UAE) region, launched August 2022 with three Availability Zones. Two UAE facilities were affected by strikes in March 2026, and in September 2026 AWS said it could not restore one zone. Check current status before planning new workloads. | Certified as a Tier 1 cloud provider by the Dubai Electronic Security Center; annual UAE IA assessment |
| Microsoft Azure and Microsoft 365 | UAE North (Dubai) with three availability zones; UAE Central (Abu Dhabi), restricted access, for in-country disaster recovery | Microsoft 365 commits to storing core customer data at rest in the UAE; Advanced Data Residency extends coverage |
| Oracle Cloud Infrastructure | UAE East (Dubai) and UAE Central (Abu Dhabi) | Oracle Alloy also powers du’s National Hypercloud, run from du’s own UAE data centre |
| Alibaba Cloud | UAE (Dubai) region, two zones | Operating since 2016 |
| Core42 (G42) | Sovereign Public Cloud built on Microsoft Azure in the UAE | Sovereign controls and customer-managed keys; Signature Private Cloud for secret workloads |
| Google Cloud | No UAE region as of October 2026 | Nearest regions are Doha (Qatar) and Dammam (Saudi Arabia) |
Hybrid and colocation models remain common. Some organisations keep regulated data on infrastructure in UAE data centres and use public cloud for less sensitive workloads, analytics or backups. Khazna Data Centers is the largest data centre operator in the UAE.
Technical approaches to data residency
Regional hosting with policy controls. Deploy the regulated workload in a UAE region and use cloud policy controls to prevent resources from being created in other regions. Global services such as identity and billing may still process some data outside the region, so check provider documentation.
Partitioning by customer or record. Keep each customer’s data, or records for a given country, in a regional data store while the application control plane stays global. This suits SaaS products with customers in several jurisdictions.
Customer-managed encryption keys. Holding encryption keys in the UAE, in a key manager the organisation controls, limits who can decrypt the data. It does not change where the data is stored, so it does not by itself satisfy a localisation rule.
Tokenisation and data privacy vaults. Sensitive fields are stored in a regional vault and the main application stores tokens in their place. This keeps regulated data in-country while the rest of the platform runs elsewhere.
Whichever approach you use, include backups, logs, monitoring data and support access in the design. These are the components most often stored outside the region.
Building a data residency compliance plan
1. Map your data. Build an inventory of personal and regulated data: what it is, where it is stored and processed, and which systems and suppliers handle it.
2. Identify the rules that apply. Match each data set to the rules above: the PDPL, a sector rule, or a free zone law. A single organisation may fall under several.
3. Document transfers. For every flow of personal data outside the UAE or out of a free zone, record the transfer basis, such as a contract or consent under the PDPL, or standard clauses in the DIFC or ADGM.
4. Choose hosting that matches the requirement. Use UAE hosting where a localisation rule applies, and confirm which services and components keep data in-country.
5. Review supplier contracts. Include data location, transfer, sub-processor and breach notification terms in contracts with cloud and SaaS providers, and assess their security as part of your third-party risk management.
6. Apply security controls. Encryption, access control, monitoring and tested backups protect data wherever it is held. See our cloud security services for how these are applied to UAE cloud workloads.
7. Review regularly. The PDPL executive regulations, Central Bank rules and national cloud policies are still developing. Review your position when new rules are issued.
Frequently asked questions
Does the UAE have a data localisation law?
There is no general UAE law requiring all data to be stored in the country. Localisation requirements apply to specific sectors: health data, data held by Central Bank-regulated financial institutions and payment providers, certain IoT data, and government data.
Does the UAE PDPL require data to be stored in the UAE?
No. The PDPL (Federal Decree-Law No. 45 of 2021) sets conditions for transferring personal data outside the UAE, such as adequacy approval, a contract binding the recipient, or the data subject's consent. It does not require personal data to be stored in the UAE.
Can health data be stored outside the UAE?
Only in limited cases. Federal Law No. 2 of 2019 requires health data relating to health services provided in the UAE to be stored and processed in the country, with exceptions set by Ministerial Resolution No. 51 of 2021, such as treatment abroad, research and insurance claims.
Do UAE banks have to store data in the UAE?
Yes. Central Bank of the UAE rules require licensed financial institutions to keep consumer and transaction data and their master system of record in the UAE. Moving confidential customer data abroad requires Central Bank approval and the customer's prior written consent.
Can a SaaS company host UAE customer data outside the UAE?
Usually yes for general personal data, provided the PDPL transfer conditions are met, typically through a data processing agreement. UAE hosting is needed when the data falls under a sector rule, such as health, banking and payments, or government data.
Which cloud providers have data centres in the UAE?
Amazon Web Services, Microsoft Azure, Oracle Cloud Infrastructure and Alibaba Cloud operate cloud regions in the UAE, and Core42 offers a sovereign public cloud built on Azure in the UAE. Google Cloud does not have a UAE region as of October 2026. The AWS UAE region lost one of its three zones after strikes in March 2026, so check its current status.
What changed in DIFC data protection law in 2025?
DIFC Law No. 1 of 2025, in force from 15 July 2025, introduced a private right of action that lets individuals claim compensation in the DIFC Courts, clarified that organisations incorporated elsewhere are covered when they process data in the DIFC under stable arrangements, and increased several fines.
Have the UAE PDPL executive regulations been issued?
Not as far as published legal guides report; the most recent, from June 2026, confirm they have not been issued. The UAE Data Office never became fully operational, and in June 2026 its functions were moved to the new Federal Authority for Artificial Intelligence and Data. Organisations will have six months to comply once the regulations are issued.
This guide summarises publicly available information as of October 2026 and is not legal advice. Several UAE rules are developing, including the PDPL executive regulations. Confirm your obligations with your regulator or legal adviser.
