SaaS Subscription Agreement (UAE)
SAAS SUBSCRIPTION AGREEMENT
Dated: [Agreement Date]
Provider: [Provider Name] (Trade Licence: [Provider Licence]), of [Provider Address] (the "Provider");
Subscriber: [Subscriber Name] (Trade Licence: [Subscriber Licence]), of [Subscriber Address] (the "Subscriber").
1. DEFINITIONS
1.1 'Service' means [Service Name]: [Service Description], accessed via the Provider's hosted platform.
1.2 'Effective Date' means [Agreement Date].
1.3 'Subscriber Data' means all data, content, and information submitted by the Subscriber or its Permitted Users to the Service.
1.4 'Permitted Users' means [Number of Permitted Users] authorised by the Subscriber to access the Service.
2. SUBSCRIPTION AND ACCESS
2.1 The Provider grants the Subscriber a non-exclusive, non-transferable right to access and use the Service during the Subscription Term for the Subscriber's internal business purposes, subject to the terms of this Agreement.
2.2 The Subscriber may permit the Permitted Users to access the Service. The Subscriber is responsible for all use of the Service by Permitted Users and for ensuring Permitted Users comply with this Agreement.
2.3 The Subscriber shall not: (a) sub-license, resell, or provide the Service to third parties as a bureau service; (b) reverse-engineer or decompile the underlying software except as permitted by the Copyright Federal Decree-Law No. 38 of 2021; or (c) use the Service in a manner that violates UAE law.
3. SERVICE LEVELS
3.1 The Provider shall use commercially reasonable efforts to make the Service available with an uptime of [Uptime SLA], measured monthly, excluding scheduled maintenance windows notified at least 48 hours in advance and emergency maintenance required to protect the security or integrity of the platform.
3.2 Where the Service falls below the agreed uptime, the Subscriber's exclusive remedy is a service credit as specified in Schedule 1, unless the failure results from the Provider's wilful misconduct or fraud.
4. SUBSCRIPTION FEES AND PAYMENT
4.1 The Subscriber shall pay the Provider the subscription fee of [Subscription Fee] in UAE Dirhams (AED) by bank transfer within 30 days of invoice.
4.2 All fees are exclusive of Value Added Tax at 5% under Federal Decree-Law No. 8 of 2017, administered by the Federal Tax Authority, which the Subscriber shall pay in addition upon receipt of a valid VAT invoice.
4.3 The Provider may increase subscription fees at renewal on 60 days prior written notice. If the Subscriber does not accept the increase, it may terminate at the end of the current term.
5. DATA PROTECTION AND HOSTING
5.1 As between the parties, the Subscriber is the data controller and the Provider is the data processor in respect of any personal data processed through the Service. Each party shall comply with its obligations under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office.
5.2 The Provider shall: (a) process Subscriber Data only on the Subscriber's documented instructions; (b) implement appropriate technical and organisational security measures; (c) not engage sub-processors without the Subscriber's prior written consent; (d) assist the Subscriber in responding to data subject requests under the PDPL; and (e) notify the Subscriber of any personal data breach without undue delay.
5.3 Subscriber Data shall be hosted [Data Hosting Location]. Cross-border transfers are permitted only in accordance with Chapter 7 of the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
5.4 The Subscriber owns all Subscriber Data. The Provider shall return or delete all Subscriber Data within 30 days of termination and certify deletion in writing.
6. INTELLECTUAL PROPERTY
6.1 The Provider retains all right, title, and interest in and to the Service, including all copyright protected under the Copyright Federal Decree-Law No. 38 of 2021, and all improvements, enhancements, and modifications to the platform.
6.2 The Subscriber retains all right, title, and interest in and to Subscriber Data. No Subscriber Data is used by the Provider for its own commercial purposes.
7. TERM AND TERMINATION
7.1 This Agreement commences on the Effective Date and continues for [Subscription Term], after which it renews automatically for successive 12-month periods unless either party gives 60 days written notice of non-renewal.
7.2 Either party may terminate on 30 days written notice for material breach unremedied within 15 days of notice. The Provider may suspend or terminate immediately for non-payment unremedied within 7 days.
7.3 On termination, the Subscriber shall cease accessing the Service and the Provider shall return or delete Subscriber Data as provided in Clause 5.4.
8. GENERAL
8.1 This Agreement is governed by the laws of the United Arab Emirates. The parties submit to the exclusive jurisdiction of the [Governing Forum].
8.2 This Agreement constitutes the entire agreement between the parties on the subject of the Service and supersedes all prior representations.
Signed for and on behalf of the Provider: [Provider Name]
Signed for and on behalf of the Subscriber: [Subscriber Name]
Provider
________________
Signature
Subscriber
________________
Signature
What Is a SaaS Subscription Agreement (UAE)?
A SaaS Subscription Agreement in the United Arab Emirates is a commercial contract by which a provider of cloud-hosted software grants a subscriber the right to access and use the software over the internet as a service (Software as a Service), in exchange for a recurring subscription fee, for a defined term. Unlike a traditional software licence agreement where the software is installed on the subscriber's own hardware, a SaaS arrangement involves the provider hosting the software on its own infrastructure, maintaining the platform, and providing updates, with the subscriber accessing the service through a web browser, mobile application, or API. SaaS subscription agreements are governed by the UAE Civil Code (Federal Law No. 5 of 1985), the Copyright Federal Decree-Law No. 38 of 2021 (which protects the software as an original work), the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (where personal data is processed through the service), and the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021) (which validates electronic execution).
The UAE has a rapidly growing SaaS market, anchored by major technology hubs including the Dubai Internet City, Dubai Silicon Oasis, the DIFC technology ecosystem, Hub71 in Abu Dhabi, and twofour54 in the Abu Dhabi media zone. UAE enterprises in banking (supervised by the Central Bank of the UAE), government, healthcare, logistics, and retail increasingly rely on SaaS platforms for critical business functions, including enterprise resource planning, human resources management aligned with the Ministry of Human Resources and Emiratisation (MOHRE) Wage Protection System, customer relationship management, financial reporting required by the Securities and Commodities Authority (SCA), and data analytics platforms. The Federal Tax Authority (FTA) has extended Value Added Tax at 5% under Federal Decree-Law No. 8 of 2017 to electronically supplied services including SaaS, making VAT treatment a key commercial term in every UAE SaaS contract.
The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office, is the critical regulatory overlay for SaaS contracts. Because SaaS inherently involves the provider processing the subscriber's data on its infrastructure, the PDPL's data processor obligations apply fully: the provider must act on the subscriber's documented instructions, implement appropriate technical and organisational security measures, not engage sub-processors without consent, assist the subscriber in responding to data subject requests, and notify the subscriber of personal data breaches. The PDPL's cross-border data transfer restrictions impose further constraints on providers who host data outside the UAE.
For free-zone entities established in the DIFC, SaaS contracts may be governed by DIFC law under the DIFC Contract Law (DIFC Law No. 2 of 2004), and data protection is subject to the DIFC Data Protection Law (DIFC Law No. 5 of 2020). For ADGM entities, the ADGM Contract Regulations 2015 and the ADGM Data Protection Regulations 2021 apply. Both free-zone regimes are broadly aligned with international best practice and the GDPR framework, making them familiar to international SaaS providers entering the UAE market through free-zone structures.
A well-structured UAE SaaS subscription agreement addresses six core areas: the scope of the service and permitted use; service levels and uptime obligations; subscription fees, VAT treatment, and payment terms; data protection, data ownership, and data residency; intellectual property ownership (the provider retains the software copyright; the subscriber retains its data); and term, renewal, and termination with clear data return and deletion obligations.
When Do You Need a SaaS Subscription Agreement (UAE)?
A SaaS Subscription Agreement in the UAE is required whenever a business procures access to a cloud-hosted software service from a third-party provider under the Copyright Federal Decree-Law No. 38 of 2021 and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
Enterprise cloud software procurement is the primary context. UAE companies purchasing access to ERP platforms, HR systems, accounting and finance tools, CRM software, project management platforms, or business intelligence dashboards hosted by a third-party provider require a formal subscription agreement to govern fees, uptime commitments, data handling, and termination rights.
Regulated-sector procurement in banking, insurance, and capital markets requires SaaS contracts that comply with the Central Bank of the UAE's Information Technology Risk Management guidelines and the SCA's technology governance requirements. Both regulators require documented agreements with cloud service providers that address business continuity, data security, and incident response — requirements that go beyond a standard click-wrap terms of service.
Government and semi-government entity procurement of SaaS solutions is governed by the UAE Government Procurement Policy Framework, which requires formal contracts with SaaS vendors, service level agreements, and data handling provisions aligned with the Emirates Government Service Excellence Programme standards.
Startup and SME contracts with SaaS vendors. UAE startups and SMEs registered with free-zone authorities such as the DIFC Fintech Hive, Hub71, in5, and Dubai CommerCity routinely subscribe to SaaS tools and should review the provider's standard terms before accepting them, particularly regarding data handling, IP ownership, limitation of liability, and lock-in through proprietary data formats.
Multi-jurisdictional deployments where a UAE subsidiary uses a SaaS platform also used by its parent company in another country require a subscription agreement that addresses which entity is the subscriber, how user licences are allocated, and whether the parent's master agreement covers the UAE entity's use — which may trigger data transfer issues under the PDPL if the parent's master agreement requires UAE data to be processed abroad.
What to Include in Your SaaS Subscription Agreement (UAE)
A UAE SaaS Subscription Agreement compliant with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the UAE Civil Code (Federal Law No. 5 of 1985) must contain the following elements. The forms-legal.com UAE SaaS Subscription template addresses each component in a commercially standard format accepted by UAE enterprise subscribers and recognised by the Dubai Courts, the DIFC Courts, and the ADGM Courts.
Party identification must record the full legal name, trade licence number, and registered address of both the provider and the subscriber. Corporate signatories must hold board authorisation or a power of attorney under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021).
Service description must identify the SaaS service by product name and functional description. Clarity here prevents disputes about whether specific features, integrations, or modules are included in the subscription.
Permitted users must be defined: the number of named users, concurrent sessions, or the scope of the subscriber's organisation authorised to access the service. Clear user-count definitions prevent over-deployment disputes.
Service levels must set the uptime commitment (typically 99.0% to 99.9% monthly), incident response and resolution targets, scheduled maintenance windows, and the subscriber's remedy for SLA failure (typically service credits capped at a monthly percentage).
Subscription fees and VAT must state the fee in AED, the payment schedule, and confirm that VAT at 5% under Federal Decree-Law No. 8 of 2017 applies in addition to the fee where the provider is VAT-registered with the Federal Tax Authority.
Data protection provisions must comply with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The agreement must confirm the subscriber as data controller and the provider as data processor, specify processing instructions, security measures, sub-processor rules, data breach notification obligations, and cross-border transfer restrictions. For DIFC and ADGM entities, the applicable free-zone data protection law must be identified.
IP ownership must confirm that the provider retains copyright in the software under the Copyright Federal Decree-Law No. 38 of 2021 and that the subscriber owns all subscriber data.
Term, renewal, and termination must set the initial term, auto-renewal mechanics, notice periods, grounds for early termination, and the provider's obligation to return or delete subscriber data within a defined period on termination.
Limitation of liability must cap the provider's exposure under Article 390 of the UAE Civil Code (Federal Law No. 5 of 1985) and exclude indirect loss, subject to carve-outs for data protection breaches and fraud.
Governing law and forum must identify UAE law and the competent court — the Dubai Courts, Abu Dhabi Judicial Department, DIFC Courts, or ADGM Courts — or an arbitral institution such as the Dubai International Arbitration Centre (DIAC).
How to Fill Out Your SaaS Subscription Agreement (UAE)
Completing a UAE SaaS Subscription Agreement requires the provider and subscriber to agree commercial and technical terms before filling in the template. Proceed as follows.
Begin with the parties. Enter the provider's full legal name as registered with its UAE or foreign company registry. If the provider is a foreign entity without a UAE trade licence, record its full company name, jurisdiction of incorporation, and registered address. Enter the subscriber's full legal name and UAE trade licence number.
Enter the date in DD/MM/YYYY format.
In the service section, enter the product name and a functional description of the service. Be specific about what the subscription covers: list modules, integrations, and APIs included. State the permitted user count — per-named-user, per-seat, or enterprise — clearly.
Enter the uptime SLA as a percentage with a clear exclusion for scheduled maintenance. Typical UAE enterprise commitments range from 99.0% to 99.9% monthly.
State the subscription fee in AED, noting whether it is monthly or annual. Annual subscriptions usually attract a discount. Add the VAT position: if the provider is UAE VAT-registered, VAT at 5% under Federal Decree-Law No. 8 of 2017 applies in addition to the stated fee.
Choose the data hosting location. For subscribers with UAE data sovereignty requirements or regulated-sector obligations (Central Bank of the UAE, Department of Health), select 'within the United Arab Emirates'. Major cloud providers including Microsoft Azure, AWS, and Google Cloud operate UAE data centre regions that satisfy this requirement.
Select the governing forum. The DIFC Courts or ADGM Courts are common choices for SaaS contracts involving international providers and UAE enterprise subscribers, given their English-language proceedings and recognition under the mutual enforcement framework. The Dubai Courts and Abu Dhabi Judicial Department are the default onshore forums.
Both parties sign through authorised representatives, electronically under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021) or on paper.
Legal Requirements for SaaS Subscription Agreement (UAE)
A UAE SaaS Subscription Agreement must comply with the following legal requirements under UAE and free-zone law.
Data processing obligations under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) are the most significant regulatory requirement. The PDPL requires that processing by a data processor (the SaaS provider) be governed by a written agreement with the data controller (the subscriber) covering the scope of processing, security measures, sub-processing, data subject rights assistance, breach notification, and cross-border transfer restrictions. The UAE Data Office can investigate non-compliant processing arrangements and impose administrative penalties.
Cross-border data transfer restrictions under Chapter 7 of the PDPL require that personal data transferred outside the UAE be sent only to countries deemed adequate by the UAE Data Office or on the basis of approved safeguards. SaaS providers must identify their data centre locations and ensure the agreement documents the applicable transfer mechanism.
VAT registration and invoicing obligations under Federal Decree-Law No. 8 of 2017 require providers who make taxable supplies of electronically supplied services in the UAE exceeding the registration threshold to register with the Federal Tax Authority, charge VAT at 5%, issue compliant tax invoices, and submit periodic returns. Foreign providers may be required to register even without a UAE establishment.
Copyright protection under the Copyright Federal Decree-Law No. 38 of 2021 protects the SaaS software as an original work. The agreement must not grant the subscriber rights to reproduce, reverse-engineer, or distribute the software beyond what is necessary for the authorised use.
Corporate authority under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021) requires that signatories hold board authorisation or a valid power of attorney.
Electronic execution is valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021) for both the agreement and any associated schedules. Click-wrap acceptance of standard SaaS terms is treated as binding by UAE courts where the terms were reasonably available and the subscriber had an opportunity to review them before acceptance.
Common Mistakes to Avoid in Your SaaS Subscription Agreement (UAE)
UAE SaaS Subscription Agreements regularly fail to protect the subscriber or expose the provider to liability because of the following recurring errors.
1. No data processing clause. A SaaS agreement that processes personal data without a data processing clause or schedule violates the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The UAE Data Office may investigate and impose penalties on both the provider (for operating without documented processing instructions) and the subscriber (for failing to ensure the processor agreement is in place).
2. Vague data return obligations. An agreement that does not specify when and how the provider will return or delete subscriber data on termination leaves the subscriber unable to migrate away and potentially in breach of PDPL data minimisation obligations. Require return or deletion within 30 days with written certification.
3. No uptime commitment. Accepting a SaaS service without a contractual uptime SLA leaves the subscriber without a remedy when the service is unavailable. Negotiate a minimum monthly uptime and a service credit schedule.
4. Undefined data residency. Failing to specify where subscriber data is hosted creates regulatory risk for subscribers in regulated sectors. Confirm the hosting location in writing, particularly where the Central Bank of the UAE, the Securities and Commodities Authority (SCA), or the Abu Dhabi Judicial Department has issued data localisation requirements.
5. No auto-renewal opt-out mechanism. SaaS agreements that auto-renew without adequate notice of the renewal date and a reasonable notice period for cancellation can result in the subscriber being locked into an unwanted renewal term. Require a minimum 60-day non-renewal notice window.
6. Ignoring VAT. Agreeing a subscription fee without addressing VAT under Federal Decree-Law No. 8 of 2017 creates pricing disputes. Confirm whether the stated fee is VAT-inclusive or exclusive, and ensure the provider issues VAT-compliant invoices.
7. Accepting the provider's standard terms without review. Many SaaS providers present standard-form terms that heavily favour the provider — with broad IP licences over subscriber data, minimal SLA commitments, and uncapped liability for the subscriber. UAE enterprise subscribers should negotiate key terms, particularly data ownership, data security, SLA credits, and termination rights.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). SaaS Subscription Agreement (UAE) (United Arab Emirates) [Legal document template]. Forms Legal. https://forms-legal.com/uae/business/intellectual-property/saas-subscription-agreement-uae
"SaaS Subscription Agreement (UAE) (United Arab Emirates)." Forms Legal, 2026, https://forms-legal.com/uae/business/intellectual-property/saas-subscription-agreement-uae.
@misc{formslegal-saas-subscription-agreement-uae,
author = {{Forms Legal}},
title = {SaaS Subscription Agreement (UAE) (United Arab Emirates)},
year = {2026},
howpublished = {\url{https://forms-legal.com/uae/business/intellectual-property/saas-subscription-agreement-uae}},
note = {Free legal document template. Based on Personal Data Protection Law — Federal Decree-Law No. 45 of 2021}
}Also available for these jurisdictions:
Frequently Asked Questions
Yes. Where a SaaS application processes personal data of UAE residents — including employee records, customer data, or financial data containing personal identifiers — both the subscriber (as data controller) and the provider (as data processor) must comply with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office. The PDPL requires that processing by a processor be governed by a written agreement that specifies the subject matter and duration of processing, the nature and purpose of processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. A SaaS subscription agreement without a data processing clause or schedule fails this requirement and may expose both parties to investigation and penalties by the UAE Data Office.
The subscription agreement or an accompanying data processing schedule must also address cross-border data transfers. The PDPL restricts transfer of personal data outside the UAE to countries that provide an adequate level of protection, or on the basis of specific safeguards (such as standard contractual clauses approved by the UAE Data Office) or with the data subject's consent. Where a SaaS provider hosts data in a jurisdiction outside the UAE, the agreement must document the transfer mechanism and ensure the provider implements the required safeguards.
SaaS subscription fees are subject to Value Added Tax at 5% under Federal Decree-Law No. 8 of 2017, administered by the Federal Tax Authority (FTA). A SaaS subscription supplied to a UAE-based subscriber constitutes a taxable supply of electronically supplied services in the UAE, and the provider, if registered for VAT with the FTA, must charge and collect VAT, issue a VAT-compliant tax invoice, and account for the VAT in its periodic VAT return.
For foreign SaaS providers without a UAE establishment (such as providers incorporated only in a foreign country), the reverse-charge mechanism applies under Federal Decree-Law No. 8 of 2017: the UAE subscriber who is VAT-registered is required to self-account for VAT on the subscription fee. Foreign providers that exceed the mandatory registration threshold for UAE VAT (currently AED 375,000 in taxable supplies per year) may need to register for VAT in the UAE, a process administered through the FTA's online portal. The FTA has issued specific guidance on the VAT treatment of electronically supplied services, which SaaS providers and their UAE subscribers should review before contracting. Failure to address VAT in the subscription agreement creates pricing disputes between the parties and potential non-compliance with FTA requirements for both sides.
Service levels in UAE SaaS subscription agreements typically cover uptime (availability), incident response times, and scheduled maintenance windows. Uptime commitments in the UAE market for business-critical SaaS applications generally range from 99.0% to 99.9% per month, measured on a calendar-month basis and excluding scheduled maintenance and force majeure events. A 99.5% monthly uptime allows approximately 3.6 hours of downtime per month.
Incident response SLAs are graded by severity: critical incidents (complete service unavailability) typically carry a response commitment of 30 to 60 minutes and a resolution target of 4 to 8 hours. High-severity incidents carry a 2-hour response and an 8 to 24-hour resolution. Lower-severity incidents may have longer response and resolution windows.
Where the SaaS service is deployed in a regulated sector — for example, banking (supervised by the Central Bank of the UAE), government, or healthcare (licensed by the Department of Health in Abu Dhabi or the Dubai Health Authority) — the relevant regulator may impose minimum availability and business continuity standards that are higher than typical commercial SLAs. The subscriber should confirm the regulator's technology resilience requirements before negotiating the SLA schedule. Remedies for SLA failure are typically expressed as service credits rather than cash compensation, and the agreement should cap the total credits available and confirm that credits are the subscriber's exclusive remedy for service unavailability, unless the provider's failure amounts to a fundamental breach under Article 267 of the UAE Civil Code (Federal Law No. 5 of 1985).
In a UAE SaaS arrangement, all data submitted by the subscriber or its users to the service (subscriber data) belongs to the subscriber. The provider, as a data processor, has no proprietary interest in the subscriber data and must not use it for its own commercial purposes, aggregate it with other clients' data without consent, or disclose it to third parties, except as instructed by the subscriber or required by law.
Ownership of subscriber data is confirmed both as a contractual matter under the UAE Civil Code (Federal Law No. 5 of 1985) and as a data protection matter under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The PDPL treats the subscriber (as data controller) as the party responsible for determining the purpose and means of processing, and the provider (as data processor) must act strictly on the controller's instructions. The agreement must require the provider to return or delete all subscriber data within a specified period after termination — 30 days is typical — and to certify deletion in writing. The subscriber should verify that the provider's deletion process extends to all backup copies and disaster recovery environments where subscriber data may reside.
For SaaS services used by free-zone entities in the DIFC and the ADGM, the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the ADGM Data Protection Regulations 2021 apply instead of the federal PDPL. These regimes are broadly aligned with GDPR and impose similar processor obligations, but the subscriber and provider should confirm which law governs based on the location of each party's establishment.
A UAE SaaS provider may store or process subscriber data outside the UAE only in accordance with the cross-border data transfer restrictions in Chapter 7 of the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office. The PDPL permits cross-border transfer where the destination country provides an adequate level of data protection as determined by the UAE Data Office (analogous to the EU adequacy decision mechanism), where appropriate safeguards are in place (such as standard contractual clauses or binding corporate rules approved by the UAE Data Office), or where the data subject has consented.
At the time of writing, the UAE Data Office publishes a list of countries assessed as providing adequate protection. Where the provider proposes to host data in a country not on that list, the subscription agreement must include the relevant transfer mechanism and the subscriber must ensure that mechanism is properly implemented. UAE financial institutions regulated by the Central Bank of the UAE and government entities dealing with sensitive or classified data are subject to additional data localisation requirements that restrict processing outside designated UAE data centres.
For SaaS deployments involving DIFC or ADGM entities, the DIFC and ADGM maintain their own lists of approved transfer destinations and their own standard contractual frameworks, which may differ from the federal PDPL regime. In practice, many UAE enterprise clients negotiate data residency requirements that mandate hosting within UAE-based cloud regions — available through major providers such as Microsoft Azure, AWS, and Google Cloud, all of which operate UAE data centre regions — to avoid cross-border transfer complexity.
If a SaaS provider enters insolvency or restructuring proceedings under the UAE Insolvency Law (Federal Decree-Law No. 54 of 2023), the subscriber faces the risk of losing access to the service and its data if the provider ceases operations or the insolvency trustee terminates ongoing contracts. UAE insolvency law allows the liquidator or trustee to reject or affirm executory contracts, including SaaS agreements, which creates uncertainty for subscribers who rely on the service for critical operations.
Prudent subscribers mitigate this risk by: (a) requiring the provider to maintain source code escrow arrangements, so that the subscriber can obtain access to the software codebase on the occurrence of insolvency; (b) negotiating a contractual right to export subscriber data at any time and on short notice, and testing that export mechanism regularly; (c) requesting evidence that the provider backs up subscriber data in an accessible format and that the backup is stored independently of the provider's primary systems; and (d) including in the subscription agreement a specific provision that the subscriber's data must be returned or made available for export within a defined short period (for example, 48 to 72 hours) from any insolvency event.
The Dubai Courts and the Abu Dhabi Judicial Department have jurisdiction over insolvency proceedings under the UAE Insolvency Law (Federal Decree-Law No. 54 of 2023), while DIFC and ADGM entities are subject to their own insolvency and restructuring regimes. Subscribers to SaaS services provided by DIFC or ADGM entities should confirm which insolvency regime applies when structuring their data recovery rights.
A SaaS subscription agreement and website terms and conditions serve different commercial and legal purposes in the UAE, though both govern the use of digital services and are subject to the UAE Civil Code (Federal Law No. 5 of 1985) and the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).
Website terms and conditions are a standardised set of terms published by a website operator to govern all users' access to the website, including anonymous visitors and registered users. They typically cover intellectual property in the website content, prohibited uses, links to third-party sites, disclaimers of warranty, and dispute resolution. They are unilateral documents that users accept by browsing or registering, and they are rarely negotiated.
A SaaS subscription agreement, by contrast, is a bilateral commercial contract between the provider and a specific business subscriber, negotiated to reflect the specific service, fee, user count, and data handling arrangements. It is typically signed by both parties (electronically or on paper) and creates obligations on both sides, including the provider's uptime commitment, data protection obligations under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and the subscriber's payment obligations. Enterprise SaaS contracts often include negotiated schedules for service levels, data processing, security standards, and source code escrow. Many SaaS providers present subscribers with a click-wrap subscription agreement at account creation — this is a valid contract under UAE law when the terms are clearly accessible and the subscriber has an opportunity to review them before accepting.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Software Licence Agreement (UAE)
A software licence agreement for the UAE allowing a software owner to grant a business the right to use a software product, compliant with the Copyright Federal Decree-Law No. 38 of 2021, PDPL, and UAE Civil Code.
Data Processing Agreement (UAE)
A data processing agreement for the UAE governing how a data processor handles personal data on behalf of a data controller, fully compliant with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) administered by the UAE Data Office.
Non-Disclosure Agreement (UAE)
A mutual confidentiality agreement binding both parties to protect proprietary information under the UAE Civil Code (Federal Law No. 5 of 1985) and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Suitable for joint ventures, M&A due diligence, and technology licensing in the United Arab Emirates.
Service Agreement (UAE)
A commercial service agreement setting out the scope, fees, and obligations between a service provider and client under the UAE Civil Code (Federal Law No. 5 of 1985) and the Commercial Transactions Law (Federal Decree-Law No. 50 of 2022). Includes VAT and data protection clauses for the United Arab Emirates.
Website Terms and Conditions (UAE)
Website Terms and Conditions set out the contract between a UAE website operator and its users, covering services, payment, acceptable use, liability, and data protection. They align with the Consumer Protection Law (Federal Law No. 15 of 2020), the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and UAE electronic commerce rules.