Data residency in the UAE: a checklist before you choose a cloud region
Questions to answer about your data and regulators before deciding where workloads can run.
Where your data may be stored and processed is a design decision, and it is cheaper to settle before you build. This checklist helps you prepare. It is a planning aid, not legal advice, so confirm requirements with qualified counsel.
1. Know your data
- List the datasets involved and who owns each.
- Separate personal data, sensitive personal data and non-personal data.
- Note where each dataset is created, stored, processed and backed up.
2. Identify which rules apply
- Federal personal data law. The UAE has a federal data protection law that sets obligations for handling personal data.
- Sector rules. Sectors such as health and financial services can have stricter requirements, including limits on transfers abroad.
- Free zone regimes. DIFC and ADGM have their own frameworks.
- Contract and customer requirements. Clients may require local storage even where the law does not.
3. Decide what can leave the country
- Can processing happen abroad if storage stays local?
- Can data be anonymized or aggregated before transfer?
- What safeguards and agreements are needed for any transfer?
4. Choose architecture to match
- Select cloud regions and providers that offer in-country options where required.
- Plan encryption, key management and access control, including who can reach data and from where.
- Design backups and disaster recovery within the same limits.
5. Plan for operations
- Decide how support staff in other offices access systems.
- Log and audit access so you can show compliance.
- Review requirements regularly, because rules change.
Start before you build
Teams that map data and rules first avoid costly redesign later. Our Cloud Strategy & Security and Data & AI Governance teams can help you design a compliant platform.
Frequently asked questions
Does all data in the UAE have to stay in the UAE?
No. Requirements depend on the type of data, the sector and the applicable regime. Some sectors, such as health, have stricter rules on moving data abroad, so confirm with legal counsel.
Do free zones have different data rules?
Free zones such as DIFC and ADGM have their own data protection frameworks, which may apply alongside or instead of federal rules depending on the entity.
Related services
Cloud Strategy & Security
Secure cloud foundations aligned with your business and regulatory needs.
Data & AI Governance
Policies, ownership and controls that keep data and AI compliant and auditable.