From the Central Bank to health regulators and Dubai and Abu Dhabi government, more and more UAE rules ask for tested continuity plans and data kept in the country. This is what they ask about backup and recovery, and where we help.
A quick overview for the UAE. Whether your organisation is in scope is something you determine yourself, with your regulator or legal adviser.
The Operational Risk Management Regulation (Circular 1/2026) applies since 14 September 2026: critical operations mapped, board-approved disruption tolerances, and a plan to continue or restore operations that is reviewed every year. Incidents are reported within 4, 24 and 72 hours.
Backup and recovery: Tested continuity and recovery, with the master system of record kept in the UAE.
Federal Law 2/2019 on ICT in health fields keeps health data inside the UAE by default. In Abu Dhabi, ADHICS sets the security standard for healthcare and allows cloud hosting in the UAE.
Backup and recovery: Backups of health data stored in the UAE, with backup procedures and continuity evidence.
The National Cloud Security Policy of the UAE Cyber Security Council and, for Dubai government, the DESC Information Security Regulation. Confidential and critical information stays in the UAE.
Backup and recovery: Knowing where every copy is, backups, recovery plans and maximum tolerable disruption.
The UAE Information Assurance Standard v2.1 (November 2025) and the national business continuity standard AE/SCNS/NCEMA 7000, often combined with ISO 22301.
Backup and recovery: Backups, recovery tests and continuity plans you can show an auditor.
The federal PDPL (Decree-Law 45/2021), with executive regulations still to come, and the separate data protection laws of DIFC and ADGM. They regulate transfers abroad rather than require local storage.
Backup and recovery: Personal data protected against loss, and no transfer abroad unless you choose it.
Sources: Trowers & Hamlins on the CBUAE Operational Risk Management Regulation; CMS on health data and Federal Law 2/2019; Al Tamimi on the National Cloud Security Policy; KPMG on the UAE Information Assurance Standard v2.1; Abu Dhabi Media Office on NCEMA 7000 compliance; Overview of UAE data residency rules.
No supplier can make you compliant. We take care of an important part, backup and recovery, and give you the evidence to show for it.
Backups and recovery points are stored in a UAE data centre. A second copy in the EU only if you ask for it.
We restore the systems in scope, including their network dependencies, and write down what worked.
Restore reports, recovery plans and logs you can hand to your regulator or auditor without rewriting them.
Immutec is ISO 27001:2022 certified. We document the scope, the responsibilities and the escalation route.
Something else? Send us your question and an engineer will reply.
Yes. Your backups are stored in a data centre in the UAE. An extra copy in our EU data centre is optional, and only if you ask for it.
We keep your data in the UAE and run the service with our own engineers. Some government workloads need a provider certified by the UAE Cyber Security Council. Tell us how your data is classified and we tell you honestly whether we fit.
We provide the backup and recovery part: restore reports, recovery plans and test results. The wider business continuity programme stays with you.
No. We coordinate recovery with your incident response, security and IT teams. Containment and clean-up are arranged separately.
We go through your backup and recovery arrangements with you and show what your regulator or auditor will ask for.