Four years after the UAE data protection law was published, its Executive Regulations still have not been issued. That single fact changes every compliance conversation — and most of the guides online do not mention it.
A quick disclaimer we actually mean: we run infrastructure, we are not lawyers, and nothing below is legal advice. What follows is how the situation looks from the hosting side, which is the part we are qualified to describe.
What the UAE Data Protection Law Says Today
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data — usually shortened to PDPL — is the UAE’s general data protection law. It was published in 2022 and sets out the familiar structure: lawful bases for processing, data subject rights, obligations on controllers and processors, breach notification, and rules for moving personal data outside the country.
On cross-border transfer, Articles 22 and 23 allow personal data to leave the UAE in three broad situations: to a country the UAE Data Office has determined offers an adequate level of protection; under a contract that binds the recipient to equivalent protections; or under specific derogations such as explicit consent, performance of a contract, or legal claims.
Read that quickly and it sounds like a workable framework. Read it carefully and you notice that two of the three routes depend on things that do not exist yet.
The Part the Other Guides Skip
The Executive Regulations were supposed to follow within six months of publication. As of October 2026 they have not been issued, and the practical consequences are specific:
- No adequacy list has been published. So “transfer to an adequate country” is not a route you can currently rely on, because no country has been declared adequate.
- No standard contractual clauses have been issued. The contractual route exists in the law, but the approved form of words does not.
- The detailed obligations are still pending. Registration, DPO thresholds, impact assessment triggers, breach timelines in practice — the Decree-Law delegates the specifics.
There is also a compliance clock attached: Article 29 gives controllers and processors six months to comply once the Regulations are issued, subject to extension. So the lead time you get is six months, starting from a date nobody can predict.
Anyone selling you certainty about UAE PDPL compliance right now is selling you their interpretation. Some of those interpretations are good. None of them are the Regulations.
What This Means for Where You Host
Here is the practical conclusion, and it is less dramatic than the uncertainty suggests: data that never leaves the UAE does not need a transfer mechanism. If the processing happens inside the country, the entire Article 22–23 question — the adequacy list you cannot use, the clauses that have not been published — simply does not arise.
That is not a legal opinion, it is arithmetic. It is also why in-country hosting has become the default answer for UAE organisations that would rather not re-paper their contracts twice: once on an interim interpretation, and again when the Regulations land.
Two caveats worth stating plainly, because they catch people out:
- Your provider’s head office is not where your data lives. Those are separate facts, and both matter. We are a Delaware corporation; the infrastructure in question is in Dubai and Fujairah. Ask any provider to name the facility, not the company.
- Free zones have their own regimes. The DIFC and ADGM each have their own data protection law, and entities established there follow those rather than the federal PDPL. If you are in a free zone, the analysis above is not yours — check which law applies before anything else.
What We Would Do in the Meantime
Four things, none of which you will regret whatever the Regulations say:
- Write down where the data physically is. One page: which systems, which countries, which providers, which backups. Most organisations cannot produce this, and every version of compliance starts with it. Backups are the line people forget — data resident in Dubai and backed up to Ireland has left the country.
- Get a data processing agreement in place with every processor. Not because the clauses are final, but because the obligation to have one is not in doubt. Ours is published — read it before you ask us for one.
- Reduce the number of jurisdictions involved. Every border your data crosses is a transfer you may have to justify later. Fewer is strictly easier.
- Keep the decision reversible. Favour architectures you can relocate. A workload on standard virtual machines moves between regions in a weekend; one wired into a single provider’s managed services does not.
Where Our Infrastructure Sits
We run three regions: DX1 in Dubai and FJ1 in Fujairah for UAE residency, and VIE2 in Vienna for workloads where the requirement is GDPR rather than PDPL. They are separate regions, so data placed in one stays in one unless you replicate it deliberately.
For organisations where an auditor needs physical rather than logical separation, a dedicated private cloud puts your workloads on hardware allocated to you alone, which keeps the audit scope inside your own environment. For everyone else, a virtual private cloud in a single UAE region is usually the proportionate answer.
If you want to go through your own data map with someone who will tell you which parts are a hosting problem and which parts need a lawyer, get in touch. We are reasonably good at telling the two apart.
