In today's globalised world, businesses frequently leverage data storage, processing, and analytics capabilities from providers across borders. This shift has brought remarkable efficiencies but has also introduced new regulatory challenges. For UAE-based businesses, cross-border data transfers are subject to stringent regulations, designed to ensure the security and privacy of sensitive information.

Zijad Hanic, Counsel at SEAMLESS Legal, explores the essentials of cross-border data handling from a UAE perspective, including compliance with data protection laws, permitted exceptions, and best practices for businesses looking to harness the benefits of international data management.

Understanding cross-border data regulations in the UAE

The UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) sets the foundation for personal data protection, offering guidance on when and how data can be transferred outside UAE borders. The PDPL is part of the UAE's wider effort to establish itself as a leader in digital innovation, while also ensuring that personal data is treated with utmost care and respect.

Key articles within the PDPL lay out the conditions under which cross-border transfers are allowed:

• Adequate protection standard: for data to be transferred outside the UAE, the destination country must have an equivalent level of data protection. The UAE Data Office may maintain a list of approved jurisdictions, similar to how the European Union handles data transfers through “adequacy decisions”.
• Explicit consent and safeguards: if the destination country lacks an adequate level of protection, companies can still transfer data abroad under certain conditions. These include obtaining explicit consent from the data subject or ensuring appropriate safeguards through legally binding agreements that commit the foreign entity to PDPL compliance standards.

Sector-specific restrictions: health and financial data

Beyond the PDPL, specific data localisation requirements apply to sectors like healthcare and finance. Federal Law No. 2 of 2019 mandates that health-related data, for instance, must be stored and processed within the UAE. This ensures that sensitive health information remains within regulatory reach. Similarly, the UAE Central Bank enforces strict localisation rules for financial and payment data, requiring storage within national borders to mitigate risks associated with cross-border financial data processing.

Businesses in these sectors must exercise particular caution when considering cross-border data handling to avoid non-compliance.

Practical steps for UAE companies handling cross-border data

To effectively manage cross-border data transfers, UAE businesses should adopt a proactive, compliance-focused approach. Here are several best practices:

• Conduct a risk assessment: evaluate the risks associated with transferring data to specific countries. This assessment should include reviewing the destination country's data protection laws and any potential security vulnerabilities.
• Implement binding agreements: establish Data Processing Agreements (DPAs) with international service providers. These agreements should outline the data protection measures in place and ensure adherence to the UAE’s PDPL requirements.
• Obtain explicit consent: in scenarios where personal data must be transferred without an equivalent level of protection, obtain clear, written consent from data subjects. This is particularly crucial for personal information deemed sensitive or critical to the individual.
• Secure data encryption and access controls: whether data is hosted locally or internationally, applying robust encryption and multi-layered access controls is essential for safeguarding information from unauthorized access.
• Regularly monitor compliance: regulations on data protection continue to evolve, especially as new privacy concerns emerge. Companies should periodically review compliance with UAE regulations and update their data protection protocols accordingly.

The future of cross-border data handling in the UAE

The UAE’s progressive stance on technology adoption—seen in initiatives like the UAE Artificial Intelligence Strategy 2031—signals that the country is keen to strike a balance between innovation and regulatory oversight. Partnerships with global tech companies, like G42’s collaboration with OpenAI, demonstrate how UAE entities are finding ways to responsibly engage with international data solutions. However, each partnership must be governed by agreements that ensure data protection remains paramount.

Conclusion

Cross-border data handling can unlock new opportunities for UAE businesses, but it also requires a disciplined approach to compliance. By understanding and respecting UAE data protection laws, companies can confidently explore global data solutions while safeguarding the privacy and security of their customers' data.

The publication is also available in Russian.