Cloud Services Agreement (UAE)

A Cloud Services Agreement in the United Arab Emirates is a commercial contract under which a cloud service provider agrees to deliver infrastructure, platform, or managed cloud services to a customer over the internet in exchange for a periodic fee, subject to defined service levels, data residency requirements, and security obligations. Cloud services agreements cover the full spectrum of cloud delivery models: Infrastructure as a Service (IaaS — virtual machines, storage, networking); Platform as a Service (PaaS — managed databases, application runtimes, container platforms); Software as a Service (SaaS — hosted software applications); and Managed Cloud Services (where the provider operates and manages the cloud environment on the customer's behalf). UAE cloud services agreements are classified as service agreements under the UAE Civil Code (Federal Law No. 5 of 1985), which governs the provider's obligation of professional skill and care and the customer's payment obligations. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office, is the paramount regulatory overlay for cloud services agreements: every cloud arrangement that processes personal data of UAE residents must comply with the PDPL's data processor obligations, data residency restrictions, and cross-border transfer rules.

The UAE has positioned itself as a regional cloud hub. Major hyperscale providers including Microsoft (Azure UAE North region in Abu Dhabi and Dubai), Amazon Web Services (AWS Middle East UAE region in Abu Dhabi), and Google Cloud (UAE region) all operate data centre infrastructure in the UAE, providing UAE businesses with the ability to host cloud workloads within the country and satisfy data localisation requirements imposed by the Central Bank of the UAE, the Securities and Commodities Authority (SCA), and the health authorities. The UAE Government Cloud (G-Cloud) programme, administered by the Telecommunications and Digital Government Regulatory Authority (TDRA), provides a framework for federal government entities to procure approved cloud services from vetted providers.

The Central Bank of the UAE has issued specific Cloud Computing Guidelines (2021) for licensed financial institutions, requiring that UAE banks procuring cloud services for critical banking operations use UAE-based data centres, document the cloud arrangement in a formal written agreement, retain audit rights over the provider's UAE infrastructure, and ensure that the Central Bank can access systems and records in the UAE-hosted environment. Similar requirements apply to insurance companies regulated by the Insurance Authority and to capital markets participants licensed by the SCA. Healthcare entities licensed by the Department of Health in Abu Dhabi or the Dubai Health Authority are subject to health data security standards that impose comparable cloud governance requirements.

Value Added Tax at 5% under Federal Decree-Law No. 8 of 2017, administered by the Federal Tax Authority (FTA), applies to cloud services. Cloud providers registered for UAE VAT must charge VAT on service fees and issue compliant tax invoices. For customers, cloud service fees are a deductible business expense under the Corporate Tax Law (Federal Decree-Law No. 47 of 2022) at the 9% rate applicable to UAE-established taxable persons.

For free-zone cloud customers in the DIFC, agreements may be governed by the DIFC Contract Law (DIFC Law No. 2 of 2004) with data protection under the DIFC Data Protection Law (DIFC Law No. 5 of 2020). For ADGM entities, the ADGM Contract Regulations 2015 and ADGM Data Protection Regulations 2021 apply. Both regimes impose data processor obligations broadly equivalent to the federal PDPL requirements.

A Cloud Services Agreement in the UAE is required whenever a business procures infrastructure, platform, or managed cloud services from a third-party cloud provider under the UAE Civil Code (Federal Law No. 5 of 1985) and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Enterprise cloud migration. UAE enterprises migrating from on-premises data centres to public cloud or hybrid cloud environments require formal written cloud services agreements with their chosen hyperscale or regional cloud provider. The agreement governs the service scope, data residency, security standards, SLAs, pricing, and exit rights critical to a well-managed migration.

Financial services cloud procurement. UAE banks, insurance companies, and capital markets participants procuring cloud services for regulated workloads must comply with the Central Bank of the UAE's Cloud Computing Guidelines, which require formal written agreements specifying UAE data residency, audit rights, and business continuity provisions. A cloud services agreement satisfying the Central Bank Guidelines protects the institution from regulatory penalties.

Government and semi-government entities procuring cloud services for digital government initiatives must comply with the UAE Government Cloud (G-Cloud) framework requirements and the TDRA's cloud governance standards. A formal cloud services agreement is a prerequisite for G-Cloud procurement.

Healthcare providers adopting cloud-based electronic medical records, telemedicine platforms, or health data analytics systems require cloud services agreements that address health data security requirements from the Dubai Health Authority or the Department of Health in Abu Dhabi.

Startups and scale-ups hosted on cloud infrastructure for their SaaS, fintech, or digital platform products require cloud services agreements that ensure data residency, security, and SLA commitments from their infrastructure providers — terms their own end-customers will require them to confirm. A formal cloud services agreement with the infrastructure provider enables the startup to provide its customers with documented security and compliance assurances.

A UAE Cloud Services Agreement compliant with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the UAE Civil Code (Federal Law No. 5 of 1985) must contain the following elements. The forms-legal.com UAE Cloud Services Agreement template addresses each component in a format recognised by the Dubai Courts, the DIFC Courts, and the ADGM Courts, and aligned with the Central Bank of the UAE's Cloud Computing Guidelines.

Party identification must record the full legal name, UAE trade licence number (or free-zone registration), and registered address of both the provider and the customer.

Service description must identify the type of cloud service (IaaS, PaaS, SaaS, or managed cloud) and describe the specific resources, capabilities, or applications being provided, with reference to a technical specification attached as Schedule 1.

Service levels must set the monthly uptime commitment, incident response and resolution targets, maintenance window notification requirements, and the customer's exclusive remedy (typically service credits) for SLA failure. For regulated-sector customers, SLAs must align with the relevant regulator's business continuity requirements.

Data residency must specify the location(s) where customer data is stored and processed. For customers subject to UAE data localisation requirements, the agreement must explicitly require storage within the UAE (typically in named data centre regions). Cross-border transfer restrictions under Chapter 7 of the PDPL must be addressed.

Data protection obligations must confirm the customer as data controller and the provider as data processor under the PDPL, specifying processing instructions, security measures, sub-processor restrictions, breach notification timelines, and data deletion obligations on termination.

Security standards must specify technical security requirements: encryption standards (TLS 1.2+, AES-256), access controls, MFA, vulnerability scanning, penetration testing frequency, and relevant certifications (ISO 27001, SOC 2).

Audit rights must allow the customer (and, where applicable, its regulator — the Central Bank of the UAE, the DFSA) to audit the provider's UAE-hosted environment and security controls, either directly or through an independent auditor.

Fees and VAT must state the monthly fee in AED, the billing basis (fixed resource bundle, usage-based, or hybrid), and confirm that VAT at 5% under Federal Decree-Law No. 8 of 2017 applies.

Exit provisions must address data portability, data deletion timescales, and transition assistance obligations.

Governing law and forum must identify UAE law and the chosen forum.

Completing a UAE Cloud Services Agreement requires the provider and customer to agree technical and commercial terms before populating the template. Proceed as follows.

Begin with the parties. Enter the provider's full legal name from its UAE trade licence or free-zone registration. For international cloud providers without UAE establishment, enter the full company name and jurisdiction of incorporation. Enter the customer's full legal name and UAE trade licence number.

Enter the agreement date in DD/MM/YYYY format.

In the cloud services section, select the service type — IaaS, PaaS, SaaS, or Managed Cloud. Enter a specific description of the services, referencing the technical schedule. Vague descriptions such as 'cloud hosting services' should be replaced with specific resource descriptions (virtual machine types, storage capacity, managed database specifications).

Enter the uptime SLA. For standard business workloads, 99.5% to 99.9% monthly is appropriate. For regulated financial or healthcare workloads, confirm the uptime required by your regulator and specify accordingly.

Select the data residency requirement. Customers subject to UAE data localisation obligations (Central Bank of the UAE regulations, healthcare data requirements) should select 'within the United Arab Emirates only' and confirm with the provider the specific data centre region (for example, Microsoft Azure UAE North, AWS Middle East UAE).

Enter the monthly fee in AED. Note that VAT at 5% under Federal Decree-Law No. 8 of 2017 applies in addition. For usage-based pricing, attach a rate card as Schedule 3.

Enter the initial contract term. Enterprise cloud agreements commonly run 24 to 36 months. Longer terms typically attract discounts; shorter terms provide more flexibility. Include a 90-day non-renewal notice provision.

Select the governing forum. The DIFC Courts or ADGM Courts are popular choices for cloud services agreements involving international providers and UAE enterprise customers.

Both parties sign through authorised representatives. Electronic signatures are valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).

A UAE Cloud Services Agreement must comply with the following legal requirements.

Data protection obligations under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) are the most significant regulatory requirement. The PDPL requires a written data processing agreement governing the cloud provider's role as data processor. The UAE Data Office may investigate non-compliant processing and impose administrative penalties. Cross-border data transfer restrictions under Chapter 7 must be addressed in the agreement.

Regulatory requirements for licensed financial institutions under the Central Bank of the UAE's Cloud Computing Guidelines require formal written agreements, UAE data residency for critical banking data, audit rights, and business continuity provisions. Non-compliance may result in regulatory action against the financial institution.

Cybersecurity obligations under the UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) require cloud providers to implement reasonable security measures to prevent unauthorised access to customer data. A data breach caused by inadequate security may expose the provider to investigation by the UAE Data Office and civil liability to the customer.

VAT registration and invoicing under Federal Decree-Law No. 8 of 2017 require cloud providers exceeding the AED 375,000 annual registration threshold to register with the Federal Tax Authority, charge VAT at 5%, and issue compliant tax invoices. For foreign cloud providers supplying to UAE customers, the reverse-charge mechanism may apply.

Corporate Tax Act (Federal Decree-Law No. 47 of 2022) at 9% applies to UAE-established cloud providers' taxable income. Cloud service fees are deductible business expenses for UAE customers.

Electronic execution is valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021). Corporate signatories must hold authority under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021).

UAE Cloud Services Agreements regularly fail to protect customers — and expose providers to liability — because of the following recurring errors.

1. No data residency specification. Accepting a cloud agreement without specifying where data is stored exposes regulated-sector customers to Central Bank of the UAE or UAE Data Office enforcement. Name the data centre region explicitly.

2. Vague data deletion obligations. An agreement without a specific timeline and procedure for data deletion on termination leaves the customer unable to confirm PDPL compliance. Require deletion within 30 days with written certification.

3. Service credits as inadequate remedy. Accepting service credits as the exclusive remedy without evaluating whether the credit cap covers actual business interruption costs leaves enterprise customers underprotected for sustained outages. Negotiate higher credit caps or carve out liability for wilful misconduct.

4. No audit rights. Accepting a cloud agreement without documented audit rights prevents regulated-sector customers from satisfying their regulators' cloud governance requirements. Include a right for the customer (and its regulator) to audit the UAE-hosted environment.

5. Inadequate exit provisions. A cloud agreement without data portability and transition assistance obligations creates vendor lock-in. Require a data export mechanism and a transition assistance period.

6. Ignoring VAT. Agreeing fees without addressing VAT at 5% under Federal Decree-Law No. 8 of 2017 creates pricing disputes. State the VAT position on each invoice.

7. Short non-renewal notice window. Accepting an auto-renewal clause with a 30-day non-renewal window for a 24-month term creates the risk of being locked into an unwanted renewal. Negotiate a 90-day non-renewal notice period.