Business Backup Compliance UAE 2026 - PDPL, DIFC, DHCC, RERA

UAE business compliance for data backup is no longer the loose, light-touch regime it was a decade ago. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, commonly called PDPL), the DIFC Data Protection Law (DIFC Law No. 5 of 2020), DHCC's health data retention rules, RERA's real estate record requirements, the Central Bank's financial sector audit trail rules and SCA market-conduct retention obligations all now carry meaningful penalties for non-compliance. After working with Dubai SMBs across all these regimes since 2007, Azizi Technologies has the practical compliance backup playbook. This guide is the 2026 reference, including a backup policy template you can adapt.

The major UAE regimes that affect backup

What PDPL specifically requires of backup

PDPL Article 20 lays out the technical and organisational measures controllers must apply. For backup specifically, this translates into:

• Confidentiality - personal data backups must be encrypted at rest and in transit. Plain unencrypted Hyper Backup is non-compliant.
• Integrity - backups must be tamper-evident. Object Lock or write-once storage satisfies this.
• Availability - data must be restorable within a reasonable timeframe. We document restore tests in the policy.
• Resilience - the controller must be able to restore availability and access in the event of an incident. Plain weekly USB drive is technically below the bar.
• Process for regular testing - PDPL requires you to actively test the controls. Untested backups are non-compliant.
• Breach notification within 72 hours - you must have logs that prove what was lost and when. Backup logs and access logs feed this.

DIFC Data Protection Law - the stricter regime

DIFC Law No. 5 of 2020 is closer to GDPR than to PDPL in some respects and applies to entities inside DIFC. Backup-relevant differences:

• Mandatory Data Protection Officer for entities processing certain categories of data.
• Stricter cross-border transfer rules - data leaving DIFC needs an adequacy decision, standard contractual clauses or other approved transfer mechanism.
• Breach notification - 72 hours, similar to PDPL.
• Right to erasure - your backup policy must allow for deletion of specific subjects' data on request, even from immutable backups (typically via key destruction or rotated retention).
• Records of processing activities - you must document where backups go and who can access them.

DHCC health data - 25-year retention

DHCC-licensed health entities (clinics, diagnostic centres, hospitals) must retain medical records for 25 years (longer in some specialisations). Backup implications:

• Archive tier - 25 years on NAS spinning disks is not realistic; we use AWS S3 Glacier Deep Archive or Azure Archive at AED 0.0036 per GB per month.
• Format longevity - PDF/A for documents, DICOM for imaging, with periodic format-validation tests.
• Encryption key management - keys must survive 25 years. We escrow keys in a documented procedure with the practice manager and an external sealed-envelope copy.
• Patient export and portability - you must be able to extract one patient's records on request, including from archive.
• Audit trail - who accessed what record when, for 25 years.

RERA real-estate record retention

RERA and DLD require real estate brokerages and developers to retain transaction records for 10+ years. Backup implications:

• Transaction records - SPAs, MOUs, Form A/F, agency agreements, commission breakdowns - all on a retention-locked tier.
• Email retention - broker communications related to transactions, retained alongside transaction records.
• RERA inspection - on request, you must produce specific transaction records within a reasonable window. Backup access procedures must be documented.
• AML records - DNFBP requirements add another 5+ years on customer due diligence and source-of-funds documentation.

Financial sector audit trails

Banks, exchange houses, payment service providers, and ADX / DFM-affiliated brokers face the strictest backup requirements:

• 5+ year transaction audit trail with integrity controls.
• Real-time replication of core records, not just nightly backup.
• Independent integrity verification - typically WORM storage or hash-chain logging.
• Disaster recovery RTO and RPO documented and tested annually.
• Segregation of duties - the people running backup are separate from the people who can delete records.

Backup policy template for Dubai SMBs

Every PDPL or DIFC-regulated Dubai business should have a written backup policy. Here is the minimum structure we deploy with AMC clients:

1. 1Scope - which systems and data are in scope, by location, by business unit, by data category.
2. 2Roles - data controller, processor, IT operator, DPO if applicable, with contact details.
3. 3Backup frequency - working hours snapshot every 15-60 minutes; daily incremental; weekly full; monthly archive.
4. 4Retention - 30 days hot, 12 months warm, regulator-specified period cold (5/10/25 years).
5. 5Encryption - AES-256 at rest, TLS 1.3 in transit, key management documented.
6. 6Off-site copy - location, transport method, immutability flag, who has access.
7. 7Restore testing - monthly file-level, quarterly bare-metal, annual fire-drill, with documented logs.
8. 8Incident response - who is called, in what order, within what timeframe; breach notification procedure to UAE Data Office.
9. 9Access controls - who can access backups, MFA requirements, separation of duties.
10. 10Review - annual review of the whole policy by the DPO or equivalent.

What an Azizi compliance backup install looks like

1. 1Free 60-minute compliance scoping - we identify which regimes apply, what data categories you hold and where they live.
2. 2Gap analysis vs PDPL / DIFC / DHCC / RERA / Central Bank requirements as applicable.
3. 3Stack design - NAS, cloud, archive tier, encryption, key management, immutability and retention policies.
4. 4Implementation - Synology or QNAP NAS, Backblaze B2 or AWS / Azure for cloud, Glacier Deep Archive or Azure Archive for long-term, all encrypted with documented keys.
5. 5Policy document drafting - the written policy that satisfies the controller obligation.
6. 6Restore drill - documented test of restoration from each tier.
7. 7Quarterly compliance evidence - logs, restore-test reports, access reviews, ready for regulator inspection.
8. 8Annual review and update - regulator rules change, vendor capabilities change, your data changes.

Frequently asked questions