Insights

The UAE Personal Data Protection Law (PDPL) applies to most businesses that handle personal data about people in the UAE. It sets out how that data must be collected, used, stored and protected, and gives individuals rights over their information.

What changes for your IT

• Know where personal data lives: map every system, file share and cloud app that stores it.
• Limit access: give staff access only to the data they need for their role.
• Protect it: use encryption, multi-factor authentication and up-to-date devices.
• Detect and report breaches: have monitoring in place and a plan to respond quickly.
• Keep records: document how data is processed and who is responsible.

Where to start

Begin with a data and security gap assessment. It shows where personal data is stored, who can access it and which controls are missing, so you can fix the most important gaps first.

Tip: This article is general guidance, not legal advice. Speak to your legal adviser about how the law applies to your organisation.

Moving to the cloud can cut costs and improve resilience, but only with the right preparation. These five questions help you plan properly.

1. 1What are we moving, and why? List your servers and applications, and the business reason for moving each one.
2. 2Which cloud fits best? Azure, AWS and Google Cloud each suit different workloads and licences.
3. 3Where must our data be stored? Check data residency and regulatory requirements before you choose a region.
4. 4How will we keep it secure? Plan identity, network and backup controls before anything moves.
5. 5What will it really cost? Compare running costs, not just migration costs, and plan for ongoing optimisation.

Tip: Start with a readiness assessment. It answers these questions for you and gives you a staged migration plan.

Both models can work well. The right choice depends on your size, budget and how much specialist knowledge you need.

In-house IT works well when

• You need someone on site every day for many users.
• Your systems are highly specialised to your business.
• You have budget for training, tools and cover during holidays.

Managed IT works well when

• You want predictable monthly costs.
• You need a range of skills, from helpdesk to security and cloud.
• You need cover outside office hours, 24/7.

The hybrid option

Many businesses combine both: an in-house IT person for day-to-day needs, with a managed service provider for security monitoring, projects and out-of-hours support.

Most cyber attacks start with an email. Technology and training together give you the best protection.

1. 1Turn on multi-factor authentication for every account.
2. 2Use advanced email filtering to block malicious links and attachments.
3. 3Run regular phishing simulations and short training sessions.
4. 4Make it easy for staff to report suspicious emails.
5. 5Keep devices and browsers updated automatically.
6. 6Use endpoint protection that can stop malware at the device.
7. 7Have a clear plan for what to do if someone clicks.

Tip: Staff who report a mistake quickly should be thanked, not blamed. Fast reporting is what limits the damage.

Ransomware often targets backups first. Check your setup against these points.

• Follow the 3-2-1 rule: three copies, on two types of storage, with one off site.
• Keep at least one immutable copy that cannot be changed or deleted.
• Back up Microsoft 365 and cloud apps, not just servers.
• Monitor backup jobs daily and fix failures quickly.
• Test restores regularly and time how long they take.
• Document who does what during a recovery.

Tip: If you have never tested a full restore, you do not yet know that your backup works.

IT AMC contracts vary a lot. Compare these points before choosing a provider.

• Response times: how quickly will an engineer respond, and when?
• What is covered: which devices, software and locations are included?
• Spare parts: are parts included or charged separately?
• Preventive visits: how often, and what is checked?
• Reporting: will you get a written report after each visit?
• Escalation: who do you call when something urgent goes wrong?

Tip: Ask for the service levels in writing and check they match how your business actually works.