UAE Data Center & Cloud Service Provider Guide 2026: TRA & TDRA Requirements

Updated August 2026. The UAE has positioned itself as the digital infrastructure hub for the Middle East, Africa, and South Asia (MEASA) region, with a data centre market valued at AED 12 billion in 2025 and growing at approximately 18% per year. The confluence of government digitalisation mandates, strict data residency laws, and a surge in AI/ML workload demand is driving unprecedented investment in UAE data centres and cloud service provider businesses. This guide covers every licence, registration, and compliance requirement for data centre operators and cloud service providers in the UAE.

UAE Data Centre and Cloud Market Overview

The UAE’s data centre market is one of the fastest-growing in the world, driven by a government digital transformation agenda that includes Smart Dubai, Abu Dhabi’s Digital Government Programme, and the UAE Artificial Intelligence Strategy 2031. The country hosts multiple hyperscale cloud campuses from international operators alongside a growing number of purpose-built co-location facilities, edge data centres, and sovereign cloud deployments.

Key demand catalysts include: UAE Cloud First Policy mandating on-shore data hosting for all federal and emirate-level government workloads; strict financial data residency rules from the UAE Central Bank (CBUAE) requiring banking and payment data to remain in the UAE; MOHAP health data localisation requirements; and a flourishing startup and scaleup ecosystem generating commercial cloud demand. Power infrastructure (DEWA’s green energy initiatives, ADWEA’s grid expansion) and connectivity (multiple submarine cable landings at Fujairah and Abu Dhabi) underpin the country’s data centre attractiveness.

Regulatory Framework: TRA and TDRA

The Telecommunications and Digital Government Regulatory Authority (TDRA, formerly TRA) is the federal body responsible for regulating telecommunications, ICT services, and digital government in the UAE. Key TDRA functions for data centre and cloud operators include:

• Cloud Service Provider (CSP) Registration: Mandatory for any entity providing Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) to UAE government entities. Non-government commercial cloud services are not required to be TDRA-registered, but registration is commercially valuable as a trust signal.
• UAE Cloud Security Standard (UAE CSS): Published by TDRA, the UAE CSS establishes the security baseline for cloud services used by federal government. All TDRA-registered CSPs must demonstrate compliance with UAE CSS controls, audited by a TDRA-approved independent auditor.
• Telecommunications Licence: Data centre operators providing managed connectivity or private network services alongside co-location must hold a TDRA telecommunications service licence (Category 1 or 2 depending on service scope).
• Spectrum Coordination: Data centres using licensed wireless backhaul (microwave links, satellite uplinks) must coordinate spectrum with TDRA’s Spectrum Affairs department and hold spectrum assignment certificates.

UAE Cloud First Policy: What It Means for CSPs

The UAE Federal Cloud First Policy (issued 2021, updated 2023) requires all UAE federal ministries, authorities, and government entities to prioritise cloud-based solutions and to host classified and sensitive government data exclusively on cloud infrastructure physically located within the UAE. The policy distinguishes three data sensitivity levels:

Data Classification	Hosting Requirement	CSP Requirement
Public / non-sensitive	UAE or international cloud permitted	No restriction
Internal / restricted	UAE-hosted cloud only	TDRA-registered CSP
Confidential / classified	Sovereign cloud or government-owned data centre only	UAE government-approved sovereign cloud operator

International hyperscalers (AWS, Azure, Google Cloud) have all established UAE regions precisely to comply with this policy: AWS UAE (ap-southeast-3), Azure UAE North and UAE Central, Google Cloud ME-Central1 (Qatar-adjacent Dubai) are all in operation. New market entrants who wish to compete for government cloud contracts must achieve TDRA registration before bidding on any tender.

Sector-Specific Data Residency Laws

Beyond the general Cloud First Policy, several UAE regulatory bodies mandate data residency for their specific sectors:

• Financial data (CBUAE): UAE Central Bank Circular No. 8/2021 requires all licensed financial institutions to maintain primary copies of customer data, transaction data, and system-of-record data on UAE-hosted infrastructure. Backup copies may be stored offshore with CBUAE notification.
• Health data (MOHAP/DHA/DOH): Patient health records, clinical data, and electronic health records (EHR) must be hosted in the UAE per MOHAP’s Health Data Management Policy and the Dubai Health Authority (DHA) Health Data Governance framework. The Abu Dhabi Department of Health (DOH) maintains the same residency requirement.
• Telecommunications data (TDRA): Subscriber data held by telecom operators must remain in the UAE. Cloud-based CDRs (call detail records) must be on UAE-hosted infrastructure.
• Government procurement data (MoF): Data generated through UAE government e-procurement platforms (Tejouri, etc.) is subject to UAE data residency requirements under the Federal Data Governance Policy.

Data Centre Construction: DM NOC, Civil Defence, and Infrastructure

Building a new data centre facility in the UAE requires a sequence of regulatory approvals from the construction and safety perspective, separate from the TRA/TDRA registration for cloud services:

1. Dubai Municipality (DM) NOC: Required for any new construction, modification, or change of use. The DM NOC process reviews building plans, structural calculations, mechanical/electrical systems, and fire suppression. Dubai Silicon Oasis (DSO), Dubai Internet City (DIC), and Dubai Industrial City have streamlined DM processes for data centre developments.
2. Dubai Civil Defence (DCD) Approval: Mandatory for fire and safety systems. Data centres require DCD-approved fire suppression systems (typically gaseous suppression — FM200, Novec 1230, or CO2 — plus sprinkler backup), emergency power and cooling resilience plans, and approved evacuation procedures.
3. DEWA Power Connection: Data centres are significant power consumers. DEWA power connection applications for large facilities (above 1 MW) must be lodged 12–18 months before target commissioning, with load-growth projections submitted for DEWA capacity planning. DEWA’s Green Data Centre initiative offers preferential tariffs for data centres meeting PUE (Power Usage Effectiveness) targets of 1.5 or better.
4. Etisalat/du Connectivity: Redundant carrier connectivity is a technical necessity and a Tier classification requirement. Both Etisalat (e&) and du offer dedicated dark fibre and carrier-grade internet connectivity packages for data centre operators.

Tier Classification and Build Costs

Tier Level	Uptime SLA	Redundancy	Build Cost (AED)
Tier 1	99.671%	No redundancy	5M–15M
Tier 2	99.741%	Partial redundancy	10M–30M
Tier 3	99.982%	N+1 concurrently maintainable	20M–100M+
Tier 4	99.995%	2N fully fault-tolerant	100M–500M+

Key Market Players and Co-Location Options

Operators who do not wish to build a greenfield data centre can access UAE infrastructure through co-location at established facilities. Major UAE co-location providers include:

• Equinix DX1/DX2 (Dubai): Carrier-neutral, interconnection-focused; DX1 in Al Quoz, DX2 in Dubai Silicon Oasis. Standard Equinix SLA and global ecosystem access.
• du Data Centres: TECOM-located Tier 3 facilities; preferred for government and semi-government tenants needing TRA-registered infrastructure.
• e& (Etisalat) Data Centres: Multiple UAE locations; integrated managed cloud services and connectivity.
• Core42 (formerly G42 Cloud): Abu Dhabi-based sovereign cloud and data centre operator backed by G42. Primary provider of UAE government cloud services and ADGM digital infrastructure.
• Khazna Data Centres: Hyperscale-focused UAE operator; Tier 3+ facilities in Abu Dhabi and Dubai.

Frequently Asked Questions

Does a company offering cloud SaaS in the UAE need TRA/TDRA registration?

TDRA CSP registration is mandatory if you are offering cloud services to UAE government or public sector entities. Commercial SaaS businesses serving private sector customers only are not required to register, but registration provides significant competitive advantage in tender evaluations and demonstrates regulatory compliance. Businesses handling regulated data (financial, health) should also ensure their data residency practices align with the relevant sector regulator’s requirements regardless of TDRA registration status.

Can international hyperscalers (AWS, Azure, Google) serve UAE government workloads?

Yes, but only through their UAE-located regions and only for data classifications up to “Internal/Restricted.” All three major hyperscalers have UAE regions and are TDRA-registered CSPs. For classified or sovereign data, the UAE government uses dedicated government cloud environments operated by UAE government-controlled entities (such as Core42 for Abu Dhabi) under a separate sovereign cloud framework not available to commercial tenants.

What are the PUE targets for UAE data centres?

DEWA’s Green Data Centre initiative targets a maximum Power Usage Effectiveness (PUE) of 1.5 for data centres to qualify for preferential commercial power tariffs. State-of-the-art UAE hyperscale facilities (using chilled water cooling and free-cooling techniques enabled by UAE cool nights in winter months) are achieving PUE of 1.3–1.45. The TDRA UAE Cloud Security Standard and sustainability reporting framework for government cloud procurements require CSPs to disclose PUE metrics annually.

What is the typical timeline to build and open a Tier 3 data centre in Dubai?

From land acquisition/site identification to commissioning and first customer handover, a Tier 3 data centre in Dubai typically takes 24–36 months. Key milestones: DM building permit (4–8 months), civil construction (12–18 months), mechanical/electrical fit-out (8–12 months concurrent), DCD inspection and Civil Defence approval (2–4 months), DEWA power energisation (2–4 months), and final commissioning and testing (2–3 months). Pre-built modular data centres can compress this timeline to 12–18 months.

Is there a specific UAE law on data protection and privacy?

Yes. Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL) is the UAE’s primary data protection law, effective September 2022. The PDPL governs the collection, processing, and storage of personal data by entities in the UAE and imposes obligations on data controllers and processors including consent, data subject rights, and cross-border transfer restrictions. DIFC has its own Data Protection Law (DIFC DP Law 2020) and ADGM has the ADGM Data Protection Regulations 2021 — both aligned with GDPR standards. Data centre and cloud operators handling personal data must comply with the applicable law(s) depending on their juridical location.