UAE Technology Rules for Businesses: A 2026 Guide
Six sets of rules decide how business software is built and hosted in the UAE. This guide states each one plainly, what it means for your systems, and where we checked it. Checked 1 October 2026. It is general guidance, not legal advice — confirm your own position with your adviser.
1. E-invoicing
Business invoices are moving to structured e-invoices exchanged through Accredited Service Providers. Companies with revenue of AED 50 million or more must appoint a provider by 30 October 2026 and start on 1 January 2027; companies below AED 50 million by 31 March 2027, starting 1 July 2027; government entities by 31 March 2027, starting 1 October 2027.
For your systems: your POS, billing or ERP must output every required field and connect to the provider you appoint. See e-invoicing readiness and its readiness checker.
Source: Ministry of Finance e-invoicing programme; extension reported by Deloitte.
2. Personal data
The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) has been in force since 2 January 2022 and reaches organisations that process the personal data of people in the UAE. Its main obligations: consent as the default basis, with listed exceptions; rights of access, correction, erasure, restriction, portability and objection; breach notification; a data protection officer for high-risk processing; and limits on transfers abroad. Its implementing regulations, including the transfer rules, had not been issued at our last check (late September 2026). Companies in the DIFC and ADGM follow their own data protection laws (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021).
For your systems: know what personal data you hold and why, be able to export and erase one person’s data, and write down where the data is stored.
Sources: DLA Piper; Chambers Data Protection & Privacy 2026; ITSEC, checked against the UAE legislation portal on 23 September 2026.
3. Health data
Federal Law No. 2 of 2019 (Article 13) prohibits storing or processing health information related to health services provided in the UAE outside the country, unless an exemption applies. Ministerial Decision No. 51 of 2021 lists the exemptions, and several of them still require a copy to be kept inside the UAE.
For your systems: clinics, pharmacies and health apps need hosting and processing in the UAE — including any AI service that reads patient messages.
Source: Latham & Watkins on Ministerial Decision 51/2021.
4. Banking and finance data
Under the Central Bank’s framework, banks may not share confidential customer data outside the UAE without both Central Bank approval and the customer’s prior written consent.
For your systems: plan hosting and processing in the UAE, and expect the bank’s own vendor assessment before any work starts.
Source: Chambers, the CBUAE framework (January 2026).
5. Internet calling (VoIP)
Voice over the internet offered to the public is a licensed telecommunications service in the UAE. The regulator, TDRA, names two licensees — e& (Etisalat) and du — and says third parties may provide such services only in collaboration with them or with TDRA’s approval. TDRA also keeps a list of approved calling apps.
For your systems: a phone menu (IVR) or call centre should run on e& or du business lines, and an in-browser or in-app “call us” button needs their written confirmation or TDRA approval before it goes live. See IVR and call automation.
Sources: TDRA FAQs; TDRA VoIP regulatory policy.
6. Where cloud data can sit in the UAE
Three of the large cloud providers run regions inside the country: AWS Middle East (UAE), me-central-1; Microsoft Azure UAE North (Dubai), with UAE Central (Abu Dhabi) restricted-access; and Oracle Cloud UAE East (Dubai) and UAE Central (Abu Dhabi). Google Cloud listed no UAE region when we checked.
For your systems: “hosted in a UAE region” does not always mean “processed in the UAE” — some AI services offered in UAE regions process requests in other regions, so check each service’s deployment type. The data-residency advisor shows which rule applies to your data. See also dedicated and GPU servers.
Sources: AWS regions; Azure regions; Oracle Cloud regions; Google Cloud locations.
Building to these rules
We build and run systems that meet these rules from the start — data stored where it must be, invoices in the national format, calls on licensed lines. We are software engineers, not lawyers: your legal and tax position stays with your advisers.
Talk to us
Tell us what you need and where you operate. We reply within one business day.