UAE PDPL and cloud tenants: what residency actually means for Workspace, Microsoft 365, and Azure

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) has been in force since 2 January 2022. It applies to controllers and processors established in the UAE, and to organisations that process personal data of people in the UAE. A Microsoft or Google tenant in another country does not automatically take you out of scope if you are serving UAE staff or customers.

Residency is a product setting, not a slogan

Azure has regions in the UAE: UAE North (Dubai) and UAE Central (Abu Dhabi). Workloads you deploy there stay in those regions unless you choose a global service. Microsoft 365 and Google Workspace are multi-tenant SaaS. Their data location is governed by the tenant's data residency / data region configuration, not by which Azure VM you happen to run. If legal has asked for "data in the UAE," write down which products that sentence covers. Mail, files, backups, and device telemetry often have different answers.

• Google Workspace: Advanced/Enterprise editions can pin data to a chosen region. Confirm the region in the Admin console and what is excluded (some Google services are global).
• Microsoft 365: use the data residency commitments for your subscription. The UAE is not the same as the EU Data Boundary; do not mix the two in a contract.
• Azure and AWS: put stateful systems (databases, file shares, backups) in UAE North / me-central-1 when that is a contractual requirement, and document any global control-plane services.

Transfers still need a lawful basis

PDPL restricts cross-border transfers unless an adequacy decision, appropriate safeguards, or a permitted exception applies. Sending HR files to a parent company mailbox in another country is a transfer. So is a US-based support vendor with admin access. Map those flows before you sign the cloud order form. Appoint a data protection officer where the law requires it, and keep a processing record that a regulator could actually read.

What to tell the board in one paragraph

Name the tenant geography, the backup geography, who can administer the tenant from where, and which subprocessors are in the Microsoft / Google / AWS DPA. That paragraph is more useful than a slide that says "we are cloud-first and compliant."