Do You Know Where Your Customer Data Actually Lives?

Most businesses we speak to can't say where their customer data is hosted. Here is what the UAE rules say, and five questions to put to your software vendors.

Why it matters

Most businesses we speak to can't say exactly where their data is hosted. CRM, KYC, invoicing and billing often run on platforms hosted outside the UAE. For some organisations that is a commercial preference. For others it is now a compliance problem.

What the rules say

• Licensed by the Central Bank? CBUAE Circular No. 1/2026, the Operational Risk Management Regulation, took effect on 14 September 2026. It requires a licensed financial institution's Master System of Record to be maintained within the UAE, including where functions are outsourced. Branches of foreign institutions may, subject to CBUAE approval, comply by keeping an up-to-date copy in the UAE.
• Handling health data? Federal Law No. 2 of 2019 (Article 13) restricts storing or processing UAE health data outside the country, with limited exceptions set out in Ministerial Resolution No. 51 of 2021.
• Everyone else: under the federal data protection law (Federal Decree-Law No. 45 of 2021, Articles 22 and 23), personal data can only leave the UAE under specific conditions. DIFC and ADGM apply their own data protection rules.

Copies count, not just the live system

Live data can sit in the UAE while backups and disaster recovery copies are replicated to another country. Support teams working abroad can access data that is stored here. Logs, analytics and built-in AI features are often processed somewhere else entirely. ADGM's Office of Data Protection interprets a transfer broadly: it covers making personal data available to someone in another jurisdiction, not only sending it.

Five questions to ask your software vendors

1. Where exactly is our data stored? "In the cloud" is not an answer. You need the country and the data centre region holding your live data. Follow up: is a UAE region available, and is it included in our plan?
2. Where are the backups kept? Follow up: which regions hold backup and disaster recovery copies, and can we restrict them?
3. Who can access our data, and from where? Follow up: can we see your list of sub-processors and where they are based?
4. Where do logs, analytics and AI features process our data? Follow up: which features send our data outside the UAE, and can we switch them off?
5. Will you put it in writing? A verbal answer won't satisfy an auditor. Follow up: will you commit to the data location in the contract, and notify us before it changes?

Where we can help

We have worked with financial services, healthcare and professional services firms across the UAE since 2019, including regulated firms in ADGM and DIFC since 2020. We can map where each of your systems and its backups is hosted, and plan the move to UAE regions where the rules require it.

Sources

• UAE Central Bank raises the bar on operational risk (Trowers & Hamlins, 28 September 2026)
• Federal Law No. 2 of 2019 on the use of ICT in health fields, Article 13, and Ministerial Resolution No. 51 of 2021
• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Articles 22 and 23
• ADGM Office of Data Protection, Data Transfers guidance (May 2025)

General guidance, not legal advice.

Full transcript

Good afternoon guys. Quick question, quick, quick question. Do you know where your customer data actually lives? Most of the businesses that we speak to can't answer that question.

If that's CRM, KYC, invoicing and billing procedures, a lot of that sits on platforms that are hosted outside of the country. So for some of you, that's going to be a real problem because if you're licensed by the central bank, new rules since September require your core systems of record to stay within the UAE. If you handle health data, it generally has to be stored here too. And for everyone else, the UAE data protection law sets rules on sending personal data abroad, most of which more clarity is going to come in January of the new year.

So quick question. If an auditor asked you tomorrow where your data is and how it's protected, could you answer? If not, we can help. We've worked with financial services, healthcare services, professional services of all types in the UAE since 2019, including regulated firms in ADGM and DIFC since 2020.

If you think that you need help to get compliant, reach out to us on hello@opsit.ae. We'd love to speak to you more. Speak soon. Take care.