UAE business compliance for data backup is no longer the loose, light-touch regime it was a decade ago. The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, commonly called PDPL), the DIFC Data Protection Law (DIFC Law No. 5 of 2020), DHCC's health data retention rules, RERA's real estate record requirements, the Central Bank's financial sector audit trail rules and SCA market-conduct retention obligations all now carry meaningful penalties for non-compliance. Azizi Technologies has set up business backup in Dubai since 2007, and this guide sets out what these regimes mean for backup in practice in 2026, including a backup policy template you can adapt.
The major UAE regimes that affect backup
| Regime | Who it covers | Key backup obligation |
|---|---|---|
| PDPL (Federal Decree-Law No. 45 of 2021) | Any UAE business processing personal data of UAE residents | Confidentiality, integrity, availability of personal data; breach notification within 72 hours |
| DIFC Data Protection Law (DIFC Law No. 5 of 2020) | Entities inside DIFC | Stricter version of GDPR including DPO requirement for many entities, cross-border transfer rules |
| DHCC Health Data Protection Regulations | DHCC-licensed health entities | Health records retained 25 years; backup integrity and confidentiality requirements |
| RERA / DLD Record Keeping | Real estate brokerages, developers | Transaction records retained 10+ years, accessible to RERA on request |
| UAE Central Bank Risk-Based Approach | Banks, exchange houses, payment service providers | Audit trails retained 5+ years; backup of transaction data with integrity controls |
| SCA Market Conduct Rules | ADX / DFM listed entities, brokers | Trading records and client communications retained 5+ years |
| UAE Anti-Money Laundering Law (Federal Decree-Law No. 20 of 2018) | DNFBPs - real estate, auditors, lawyers, dealers in precious metals | Customer due diligence and transaction records retained 5+ years |
UAE data protection and retention regimes affecting backup (2026)
What PDPL specifically requires of backup
PDPL Article 20 lays out the technical and organisational measures controllers must apply. For backup specifically, this translates into:
- Confidentiality - personal data backups must be encrypted at rest and in transit. Plain unencrypted Hyper Backup is hard to defend.
- Integrity - backups must be tamper-evident. Object Lock or write-once storage satisfies this.
- Availability - data must be restorable within a reasonable timeframe. We document restore tests in the policy.
- Resilience - the controller must be able to restore availability and access in the event of an incident. Plain weekly USB drive is technically below the bar.
- Process for regular testing - PDPL expects you to test the controls regularly. An untested backup is hard to defend.
- Breach notification to the UAE Data Office - the deadline is set by the executive regulations, and you must have logs that prove what was lost and when. Backup logs and access logs feed this.
PDPL penalties are real
Federal Decree-Law No. 45 of 2021 sets administrative penalties for breach. The UAE Data Office can issue warnings, suspension orders and fines. Civil liability for data subjects who suffer loss adds another layer. The cheapest path is to design backup correctly the first time, not after a breach.
DIFC Data Protection Law - the stricter regime
DIFC Law No. 5 of 2020 is closer to GDPR than to PDPL in some respects and applies to entities inside DIFC. Backup-relevant differences:
- Mandatory Data Protection Officer for entities processing certain categories of data.
- Stricter cross-border transfer rules - data leaving DIFC needs an adequacy decision, standard contractual clauses or other approved transfer mechanism.
- Breach notification - to the DIFC Commissioner as soon as practicable.
- Right to erasure - your backup policy must allow for deletion of specific subjects' data on request, even from immutable backups (typically via key destruction or rotated retention).
- Records of processing activities - you must document where backups go and who can access them.
DHCC health data - 25-year retention
DHCC-licensed health entities (clinics, diagnostic centres, hospitals) must retain medical records for 25 years (longer in some specialisations). Backup implications:
- Archive tier - 25 years on NAS spinning disks is not realistic; we use AWS S3 Glacier Deep Archive or Azure Archive at about AED 0.0036 per GB per month.
- Format longevity - PDF/A for documents, DICOM for imaging, with periodic format-validation tests.
- Encryption key management - keys must survive 25 years. We escrow keys in a documented procedure with the practice manager and an external sealed-envelope copy.
- Patient export and portability - you must be able to extract one patient's records on request, including from archive.
- Audit trail - who accessed what record when, for 25 years.
RERA real-estate record retention
RERA and DLD require real estate brokerages and developers to retain transaction records for 10+ years. Backup implications:
- Transaction records - SPAs, MOUs, Form A/F, agency agreements, commission breakdowns - all on a retention-locked tier.
- Email retention - broker communications related to transactions, retained alongside transaction records.
- RERA inspection - on request, you must produce specific transaction records within a reasonable window. Backup access procedures must be documented.
- AML records - DNFBP requirements add another 5+ years on customer due diligence and source-of-funds documentation.
Financial sector audit trails
Banks, exchange houses, payment service providers, and ADX / DFM-affiliated brokers face the strictest backup requirements:
- 5+ year transaction audit trail with integrity controls.
- Real-time replication of core records, not just nightly backup.
- Independent integrity verification - typically WORM storage or hash-chain logging.
- Disaster recovery RTO and RPO documented and tested annually.
- Segregation of duties - the people running backup are separate from the people who can delete records.
Backup policy template for Dubai SMBs
Every PDPL or DIFC-regulated Dubai business should have a written backup policy. Here is the minimum structure we deploy with AMC clients:
- 1Scope - which systems and data are in scope, by location, by business unit, by data category.
- 2Roles - data controller, processor, IT operator, DPO if applicable, with contact details.
- 3Backup frequency - working hours snapshot every 15-60 minutes; daily incremental; weekly full; monthly archive.
- 4Retention - 30 days hot, 12 months warm, regulator-specified period cold (5/10/25 years).
- 5Encryption - AES-256 at rest, TLS 1.3 in transit, key management documented.
- 6Off-site copy - location, transport method, immutability flag, who has access.
- 7Restore testing - monthly file-level, quarterly bare-metal, annual fire-drill, with documented logs.
- 8Incident response - who is called, in what order, within what timeframe; breach notification procedure to UAE Data Office.
- 9Access controls - who can access backups, MFA requirements, separation of duties.
- 10Review - annual review of the whole policy by the DPO or equivalent.
Our deliverable
Every Azizi compliance backup engagement includes a written policy document, restore runbook, access control matrix and quarterly compliance evidence pack. AMC clients get the quarterly evidence assembled and emailed without asking - useful when a regulator inspection lands with five days notice.
What an Azizi compliance backup install looks like
- 160-minute compliance scoping - we identify which regimes apply, what data categories you hold and where they live.
- 2Gap analysis vs PDPL / DIFC / DHCC / RERA / Central Bank requirements as applicable.
- 3Stack design - NAS, cloud, archive tier, encryption, key management, immutability and retention policies.
- 4Implementation - Synology or QNAP NAS, Backblaze B2 or AWS / Azure for cloud, Glacier Deep Archive or Azure Archive for long-term, all encrypted with documented keys.
- 5Policy document drafting - the written policy that satisfies the controller obligation.
- 6Restore drill - documented test of restoration from each tier.
- 7Quarterly compliance evidence - logs, restore-test reports, access reviews, ready for regulator inspection.
- 8Annual review and update - regulator rules change, vendor capabilities change, your data changes.
Azizi NAS + Recovery + Compliance combo
One team designs your PDPL-aligned backup, runs the cleanroom data-recovery lab in Bur Dubai for when things go wrong, and helps with regulator-facing evidence packs. See /data-recovery-dubai and /cybersecurity-dubai.
Get a compliance backup assessment in Dubai
60-minute compliance scoping for Dubai SMBs under PDPL, DIFC, DHCC, RERA or Central Bank rules. We identify gaps, design the stack, draft the policy and run the first restore drill. Deployment is quoted after scoping, and AMC plans include the quarterly evidence pack.
