DevOps Dubai Bur Dubai — multi-cloud managed ops

Data residency

The federal PDPL contains no blanket localisation rule — cross-border transfer is permitted to jurisdictions with adequate protection or under contractual safeguards, consent or other statutory grounds — but sector law does localise: Federal Law No. 2 of 2019 on the Use of ICT in Healthcare requires health data generated in the UAE to be stored inside the UAE, and central-bank and government-data rules impose their own in-country hosting conditions.

What shapes cloud procurement here

A UAE buyer sits under one of three parallel data-protection regimes depending on where the contracting entity is registered: the federal PDPL (Decree-Law 45/2021) onshore, DIFC Law No. 5 of 2020 under the DIFC Commissioner of Data Protection, or the ADGM Data Protection Regulations 2021 under the ADGM Office of Data Protection — and a single group can straddle all three, so DPAs are usually negotiated per-entity rather than per-group. The federal executive regulations to the PDPL still had not been published as of mid-2026, and the regulator itself was reorganised in June 2026 when the Emirates Data Office and TDRA's information/digital-government sector were folded into a new Federal Authority for Artificial Intelligence and Data, so procurement teams are contracting against detail that is not yet settled. Residency is rarely the blocker it is elsewhere in the region — AWS, Azure and Oracle all run live in-country regions — and technical delivery is conducted overwhelmingly in English, with Arabic needed mainly for government and semi-government tender documentation.

Sector regulators