Regulator page
Who it applies to: Federal and local government entities, and operators of critical infrastructure such as energy, telecoms, health and transport.
UAE Information Assurance Regulation v1.1 (TDRA) - reportedly superseded by UAE IA Standard v2.x
The official PDF and csc.gov.ae could not be fetched (robots-blocked). Treat the v2 version number, date and issuer as unverified.
UAE Cyber Security Council national cybersecurity policies (incident response, information sharing, SOC baseline, cloud security, data exchange, encryption, AI security, etc.)
The CSC website blocked automated access, so policy texts were not read. No federal cybersecurity statute with incident timelines for private critical entities was found.
Dubai Law No. (15) of 2024 Concerning the Dubai Electronic Security Centre
The Arabic text prevails. Penalties are to be set by an Executive Council resolution (Art. 19), which was not found.
Dubai Electronic Security Center - Information Security Regulation
The official ISR text was not reviewed (desc.gov.ae not fetched). DESC also has a Cloud Service Provider (CSP) Security Standard for providers to Dubai government; it was not reviewed.
Law No. (5) of 2026 Regulating the Outsourcing of Government Services in the Emirate of Dubai
The law contains no data-localisation clause. Dubai Law 12/2020 on government contracts applies where the contract is silent.
Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS)
Incident-reporting timing to DoH was not found in the parts reviewed. Exemptions are requested via aamen@doh.gov.ae; they last up to one year and are renewable (secondary source).
Federal Law No. (2) of 2019 on the Use of Information and Communication Technology in Health Fields
It is a 'Federal Law', not a decree-law. The PDPL excludes health data that has its own legislation (PDPL Art. 2(2)).
Federal Law No. (11) of 2023 on Procurement in the Federal Government
u.ae calls it a 'Federal Decree-Law' but the MoF PDF says 'Federal Law'. The Executive Regulations were not reviewed.
Dubai Law No. 12 of 2020 (government contracts and warehouses) and the eSupply portal; Abu Dhabi Government Procurement Gate (ADGPG) under the Department of Government Enablement
jurisdiction is set to 'dubai' because the entry is anchored on Dubai Law 12/2020; the Abu Dhabi content is covered too. Split into two entries if the product needs per-emirate packs. The Dubai Law 12/2020 text was not reviewed.
National In-Country Value Programme
No public certificate-verification service was found on the FAQ page; enquiries go to ICV@moiat.gov.ae. Tender weightings vary by entity and were not verified.
Mapped from our source-by-source research, checked on 3 November 2026. High-confidence items were checked on an official page; Secondary source means law-firm or other secondary sources only; To be confirmed means reported but not verified.
v3.0 reportedly requires a UAE National to head information security or act as CISO, reporting to top management. To be confirmed
Third-party security controls exist in the IAR family, but the clause IDs were not verified. To be confirmed
Use only DESC-certified private electronic security companies and hosts. Data centres and cloud providers need DESC certification to connect to DESC networks. Outsourcing partners may be certified.
v3.0 adds minimum security and compliance requirements for external parties and managed services. To be confirmed
Contractors must be licensed companies. Sole proprietorships, civil companies and partnerships are excluded. The entity assesses efficiency, solvency and compliance.
Background verification of contractors and third-party users before access, and revocation of access within 24 hours of exit.
Contracts must cover scope, service levels, revenue sharing, audit and termination, with a minimum term of 3 years (renewable). Exclusive contracts are banned unless there is a single bidder.
Assigning the contract or partnering with third parties needs the entity's prior written approval and a tripartite agreement.
Third parties must notify the entity in advance of changes, including relocation, reconfiguration and onboarding of sub-contractors.
The national cyber incident response plan is a reference for firm-level incident response plans. Secondary source
Third-party assessors must not keep assessment data after the engagement; it must be erased from their assets.
Performance KPIs, audit access, and monthly revenue reports reconciled by the entity.
Retain health information for at least 25 years from the last health procedure.
Entities must report threats, hacks, leaks, interceptions or risks to DESC.
v3.0 reportedly bars storing or processing critical information outside the UAE, including in cloud services. To be confirmed
Health information (PII, PHI or copies) must not be stored, processed or transferred outside the UAE without a valid, specific DoH exemption.
Third-party staff delivering services must work from within the UAE unless DoH grants an exemption. Secondary source
Health information and data for services provided in the UAE may not be stored, processed, generated or transferred outside the UAE, except in cases set by a Health Authority decision coordinated with MOHAP.
Exceptions under MOHAP Resolution 51/2021 include treatment abroad, overseas labs, research, insurers and claims, authority requests, personal devices and pharmacovigilance. Conditions include consent, encryption and a copy kept in the UAE. Secondary source
Contractors protect customer data privacy and confidentiality under Dubai Digital Authority and DESC processes.
Management and technical security controls for designated critical entities. v2 reportedly adds AI, cloud (data location, key management, sovereignty) and IoT/OT controls. To be confirmed
A national cloud security policy exists; its content and applicability were not reviewed. To be confirmed
Comply with DESC rules (including the ISR), connect to a DESC or certified SOC, and get DESC approval before sharing electronic security data.
Integrity and conflict-of-interest rules. Employees may not take part in procurements where they or their companies have an interest, and must report conflicts.
A preferential margin is possible for in-country value, local products and SMEs, as set by the Executive Regulations.
Grounds to exclude bidders (non-compliance, poor past performance, unpaid government dues), and to cancel awards for bribery, fraud or bid rigging.
Suppliers register on the Federal Supplier Register (Ministry of Finance) to bid on the Digital Procurement Platform, renewed annually. Secondary source
Dubai: a central supplier registry within the unified contracts system; suppliers register on eSupply. Secondary source
Abu Dhabi: DED-licensed suppliers self-register on ADGPG; other and international suppliers apply through the contracting entity. A profile is visible to all Abu Dhabi entities. Secondary source
ICV certificates are issued by about 21 authorised certifying bodies. A certificate is valid for 14 months from the date of the audited financial statements used.
For federal tenders, ICV certification is optional, but a supplier without a certificate scores zero for ICV.
Emiratisation: contractors employ at least one UAE National for every non-UAE National.
Mapped from the built-in summary. Each line shows whether the feature is live in the product today.
This is a summary for orientation, not legal advice. Always rely on the official text, and take advice on your own situation. For federal legislation, the Arabic text prevails.
