New Data Sovereignty Rules for Cloud Consumers and Providers in the UAE

3 min 36 sec

Written by

Krishna Jhala

Legal Director

k.jhala@tamimi.com View LinkedIn Profile

Andrew Fawcett

Partner

a.fawcett@tamimi.com View LinkedIn Profile

The UAE Cyber Security Council (the Council) has issued Version 2.0 of its National Cloud Security Policy (the Cloud Policy), updating the first release that the Council published in May 2023. The Cloud Policy responds to the rapid growth of cloud computing across the UAE, which the Council recognises as a key enabler of digital services, big data analytics, artificial intelligence, and the Internet of Things, which, in turn, expand the cyber threat landscape.

The Cloud Policy aims to enhance cloud security in line with the UAE’s national priority to be a global leader in cybersecurity and to strengthen the cybersecurity of organisations and individuals in the UAE that use cloud services. The latest version of the Cloud Policy has an updated scope and applicability section, along with policy statements to provide further clarity on data sovereignty requirements for different data classifications. This requires considerations around data location, residency, and jurisdictional controls.

Scope and applicability

The Cloud Policy applies to all cloud service providers (CSPs) that deliver cloud services to consumers. On the consumer side, the Cloud Policy applies to UAE federal ministries and authorities, as well as to non-government critical information infrastructure (CII) entities.

Where an Emirate has its own CII protection programme, that Emirate’s lead authority carries out the applicability assessment, enforcement, and monitoring of the Cloud Policy for Emirate government entities and non-government CII entities within its jurisdiction. In the absence of an Emirate CII protection programme, the Cloud Policy applies directly to Emirate government entities.

All cloud consumers covered by the Cloud Policy must ensure that the CSPs they select comply with its requirements.

Data localisation and sovereignty requirements

Data location and sovereignty form one of the most important domains in the Cloud Policy. The Cloud Policy requires the location of data to be known at all stages and handled in accordance with applicable UAE laws. Cloud consumers must ensure, when selecting a CSP, that the provider operates within an acceptable legal jurisdiction, and must check that any provider agreements governing the use of their data are acceptable and not contrary to relevant local legislation.

The Cloud Policy categorises cloud security and sovereignty requirements into three distinct tiers.

1. Baseline secure cloud requirements, which set a foundational standard that applies to all CSPs irrespective of data classification.
2. Partial sovereign cloud requirements add controls over critical data and apply to CSPs that store or process data classified as confidential/restricted, building on the baseline tier. CSPs should ensure that all consumer data is stored strictly within the geographical boundaries and legal jurisdiction of the UAE.
3. Sovereign cloud requirements impose the most stringent controls, safeguarding highly critical data classified above confidential/restricted, and incorporate both of the lower tiers, with the most stringent control applying wherever requirements overlap. All data stored or processed on the cloud service should remain under the exclusive jurisdiction of the UAE and its competent authorities. CSPs should ensure that all data, including consumer metadata, is not disclosed under any circumstances to any authority other than those explicitly approved by the UAE.

Hosted encryption keys and their backups must be generated, stored, and managed within the UAE, and consumers must assess whether ‘hold your own key’ capabilities are needed to retain exclusive control over encryption keys.

The Cloud Policy also addresses government access requests more broadly. Where a CSP operating at the partial sovereign cloud tier receives a valid order from a governmental body for disclosure of consumer data, it must use reasonable efforts to redirect the request to the consumer, and inform the consumer and UAE authorities of such requests. For the sovereign cloud tier, all foreign access requests to data hosted within the cloud service should be denied by default.

Practical implications

For organisations operating in or selling cloud services into the UAE, the Cloud Policy raises the stakes on data classification and vendor due diligence. Cloud consumers covered by the Cloud Policy will need to classify their data against the policy’s recommended levels, assess which tier of sovereignty controls their data triggers, and confirm that their chosen CSPs can meet the corresponding localisation, encryption, access-request and incident-reporting obligations.

CSPs serving the UAE public sector and CII entities should expect to demonstrate UAE-based key management, UAE-resident infrastructure redundancy and, at the sovereign cloud tier, UAE-licensed telecommunications routing and UAE-cleared personnel as a condition of eligibility.