UAE Data Localisation and Cloud Compliance — Business Guide 2026
UAE has specific data localisation requirements for certain industries, including financial services and healthcare. Businesses using cloud services in UAE must understand data residency obligations. This guide covers UAE data localisation and cloud compliance for 2026.
In this guide:
UAE Data Localisation Framework
- No blanket UAE data localisation law: UAE does not require all data to be stored in UAE (unlike some countries)
- Sector-specific requirements: certain sectors have mandatory UAE data localisation
- UAE PDPL (Federal Decree-Law No. 45 of 2021): cross-border transfer restrictions; personal data can be transferred if recipient country has adequate protection or appropriate safeguards
UAE Financial Services Data Localisation
- UAE Central Bank: requires that financial institutions’ core banking systems and critical customer data be stored in UAE data centres
- CBUAE Circular: financial institutions using cloud services must ensure critical data is in UAE; foreign cloud providers serving UAE banks must have UAE cloud nodes (AWS UAE, Azure UAE North, Google Cloud Dubai — all now available)
- DFSA (DIFC): DFSA-regulated entities must meet DFSA’s technology risk guidelines; data localisation for certain sensitive financial data
UAE Healthcare Data Requirements
- DHA (Dubai Health Authority): patient data must be stored in UAE; cloud solutions used for patient records must have UAE data residency
- HAAD (now Abu Dhabi Health Services — SEHA): similar UAE data residency requirement for patient health records
- Electronic health record sharing: UAE Health Data Space initiative — national health data infrastructure; providers connect to national system, not send data abroad
UAE Government Contracts and Data
- UAE government entities: typically require UAE data residency for all government data; cloud providers must have UAE region
- G42 (UAE sovereign AI and cloud): UAE government’s preferred cloud infrastructure partner; UAE-hosted AWS, Azure, Google Cloud alternatives with UAE government credibility
Practical Cloud Compliance for UAE Free Zone Companies
- General commercial data: can be stored internationally (US, EU, etc.) without restriction for most non-regulated businesses
- Personal data (PDPL): if transferred outside UAE, ensure adequate safeguards (contractual clauses equivalent to PDPL standards)
- Healthcare/finance: MUST use UAE data centres (AWS UAE, Azure UAE North, Google Cloud Middle East)
- Recommendation: use UAE-region cloud from day 1 for all businesses; easier to comply and scale; UAE cloud costs comparable to EU cloud