When a business in the UAE hires an outside team to build or run its website, store or app, the team usually gets access to far more than code. They see customer names, emails, phone numbers, orders and sometimes payment settings. That is why IT outsourcing in the UAE is as much a data question as a technical one, and why the contract matters as much as the quote.
This guide gives you seven checks to run before you sign with any software company, including us. It builds on what the UAE government says about the federal data protection law, and it adds practical items we would want to see in any agreement. It is general guidance, not legal advice, so have a lawyer review the final contract.
| Area | What to confirm in the contract |
|---|---|
| Data | Which personal data the vendor sees, and who has access |
| Location | Where data is stored and processed, and by which subcontractors |
| Tools | Whether AI or other outside services receive your code or data |
| Credentials | Limited-role accounts, no shared merchant or admin passwords |
| Exit | Code ownership, access removal and return or deletion of data |
IT outsourcing and the UAE data protection law
The UAE’s government portal describes Federal Decree Law No. 45 of 2021 as the integrated framework for protecting personal data and privacy. It came into force on 2 January 2022. Points that matter when you outsource:
- It applies to processing of personal data done fully or partly through electronic systems, inside or outside the UAE.
- Companies that hold personal data must secure it and keep it confidential, and processing without the owner’s consent is prohibited, except in limited cases such as public interest or legal procedures.
- People can ask for inaccurate data to be corrected and can ask to restrict or stop processing.
- The law sets requirements for transferring personal data across borders.
- The UAE Data Office, affiliated with the UAE Cabinet, acts as the federal regulator.
The portal does not set out penalties or the status of executive regulations. Some free zones, such as DIFC and ADGM, have their own data protection regimes, so check which rules apply to your entity and your customers. If your store serves customers abroad, other countries’ laws may apply as well.
Why the contract matters more than the quote
A low price for IT outsourcing is easy to compare. A weak contract is harder to see until something goes wrong. When you outsource, the agreement is the only place where promises about data, security and ownership become enforceable, so read it with the same care as the price.
Look for plain language on five topics: what data the vendor may access, the purpose it may be used for, where it may be stored, how long it is kept, and what happens when the work ends. If a clause is vague, ask for it to be rewritten, not explained verbally. A verbal assurance from a salesperson will not help you in a dispute.
It also pays to separate the project scope from the ongoing support scope. Building a site and maintaining it are different jobs with different access needs, and many problems begin when temporary build access quietly becomes permanent.
Seven checks before you sign
Check 1: Define exactly what data the vendor will touch
List the categories: customer records, order history, email lists, analytics and admin accounts. Then limit access to what the job needs. A team redesigning your homepage does not need your full customer list.
Check 2: Know who processes your data and where
Ask for the names of any subcontractors, freelancers, hosting providers and software services involved, and in which countries they operate. The law sets requirements for cross-border transfers, so your lawyer should confirm what applies to your case.
Check 3: Ask about AI tools
Many teams now use AI assistants to write and review code. Ask whether your code, content or customer data is sent to outside AI services, which tools are approved, and whether you can opt out for sensitive parts. We discuss the wider picture in our guide to AI coding tools.
Check 4: Keep real customer data out of development
Developers rarely need live customer data. Ask for a staging site with sample or anonymised data, and agree that production exports are never copied to personal laptops or shared chat tools.
Check 5: Protect credentials and payment settings
Give limited-role accounts, not your main admin login. Never send payment gateway keys by email or chat. Your merchant account and its keys stay under your control, a point we also cover in our CCAvenue UAE merchant account checklist.
Check 6: Agree on security duties and incident reporting
The contract should say who patches the server, plugins and frameworks, how quickly the vendor must tell you about a suspected breach, and what logs are kept. Server-level issues, like the recent PHP vulnerability, show why somebody must own updates.
Check 7: Plan the exit on day one
Agree who owns the code, the content and the repository, how all access is removed at the end, how data held by the vendor is returned or deleted, and what documentation is handed over. A good vendor is comfortable with a clear exit.
Typical outsourcing models and their data risks
Each IT outsourcing arrangement carries different risks, and it helps to name the model before you compare quotes:
- Fixed-price project. The scope is agreed in advance. Risk: the vendor keeps broad access after launch because nobody removes it.
- Dedicated team or time-and-materials. You pay for developer time. Risk: staff change often, so access lists drift out of date.
- Maintenance retainer. A team looks after updates and backups. Risk: they hold admin access for a long time, so role limits and logging matter most.
- Freelancer network. A company coordinates several individuals. Risk: you may not know who actually sees your data, so ask for a named list.
Whatever the model, keep an access register: who has which account, since when and why. Review it every quarter and at the end of every project.
Questions to ask in the first call
- Which of our data will your team see, and who exactly?
- Where is it stored and processed, and by which subcontractors?
- Do you use AI tools on our code or content, and which ones?
- Who owns the code and repository when we finish?
- How will you tell us if something goes wrong?
- How is access removed when the project ends?
Onshore, nearshore and offshore: does location change the data question?
Many UAE businesses outsource to teams in other countries, and the location of the team is a fair thing to ask about. It does not make a vendor good or bad on its own. What matters is that you know where people sit, where your data is stored and which laws apply to each step.
IT outsourcing to a team in another country can work well if the contract names the locations, limits access to what the job needs and states how personal data moves between them. A local team can still cause trouble if it passes your files to unnamed freelancers. So ask for facts: the countries involved, the hosting region, the subcontractor list and the incident process.
Time zone and language matter in practice too. Agree working hours, an escalation contact and a response time for urgent issues, so a problem on a Friday evening does not wait until Monday.
Red flags
- The vendor asks for your main admin or merchant account password.
- No named person is responsible for security updates.
- The contract is silent on data, subcontractors or exit.
- Pressure to sign before you have seen the terms.
Data you should never share by email or chat
Even with a good contract, day-to-day habits decide whether data stays safe. Agree with your vendor that these items are never sent by email, chat or shared documents:
- Passwords for your hosting, domain, WordPress admin or merchant account.
- Payment gateway API keys, secret keys and webhook secrets.
- Exports of customer lists or order histories with names, phone numbers and addresses.
- Photos of identity documents or trade licences, unless a secure upload link is used.
Use a password manager with shared vaults, one-time links that expire, or a secure upload form. If a credential was ever sent in plain text, rotate it. Changing a password costs minutes; explaining a leaked key to customers costs far more.
How this fits with VAT, payments and platform choice
Data handling is one part of a UAE online business. Tax invoices and VAT settings are covered in our guide to WooCommerce VAT in the UAE, and choosing a partner is covered in how to evaluate a web design company. If you want a team to maintain your site securely after launch, our website maintenance service covers updates, backups and monitoring.
A simple 30-day onboarding plan with a new vendor
The first month of any IT outsourcing relationship sets the habits. A sensible plan looks like this:
- Week 1: access. Create limited-role accounts, a shared password manager entry and a staging site. Do not hand over your main admin login.
- Week 2: documentation. Agree how changes are requested, reviewed and approved, and who your single point of contact is.
- Week 3: a small task. Give a contained job and watch how the team handles testing, communication and backups.
- Week 4: review. Check the access register, read the first report, and confirm that the data rules in the contract are followed in practice.
If something feels off at the end of the month, it is far cheaper to adjust or part ways then than after a year of dependency. Keep copies of the contract, the access register and the handover notes in your own storage, not only in the vendor’s tools.
Planning an outsourced website or store project?
Tell us what you want to build. We will explain who needs access to what, how we use staging data and how handover works before you commit.
Frequently Asked Questions
Does the UAE data protection law apply to my online store?
If you process personal data of customers through electronic systems, the federal law is likely relevant, and it covers processing done inside or outside the UAE. Free zones such as DIFC and ADGM have separate regimes, so ask a lawyer which rules apply to your entity.
Can my software vendor store our customer data abroad?
The law sets requirements for cross-border transfers of personal data. Ask the vendor where data is stored and processed, and have your lawyer confirm what applies before you agree.
Who should own the website code after an outsourcing project?
Agree it in the contract. Most businesses want ownership of the code, content and repository, with full access handed over at the end, but terms vary, especially for third-party plugins and licences.
