The first question in a UAE deal is not which room to use but which legal system the target sits in. Mainland companies fall under federal law, while companies in the two financial free zones, the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), operate under their own common-law-based frameworks, each with a separate data protection law and regulator.
One country, three systems
Three legal systems inside one country
Onshore, the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies, with the UAE Data Office as the authority. Implementation has been gradual, and implementing regulations have taken time to appear, so check the current position before relying on any specific transfer rule. The UAE government portal summarises the federal and free zone laws.
In the DIFC, the Data Protection Law No. 5 of 2020 is enforced by the Commissioner of Data Protection. In ADGM, the Data Protection Regulations 2021 are overseen by the Office of Data Protection. Both free zone regimes were modelled closely on the GDPR, with similar rules on lawful processing, data subject rights and transfers outside the zone.
Transfers out of the zone
In both DIFC and ADGM, sending personal data to a jurisdiction not recognised as adequate generally needs appropriate safeguards, such as standard contractual clauses. A bidder viewing files from London or Mumbai should be treated as a transfer. Ask your provider where files are stored and who can access them.How UAE deals tend to run
Deal flow in the UAE mixes several kinds of transactions. Family business groups sell or partially sell divisions, often for the first time and with limited documentation, so the room has to be built from scratch. Sovereign wealth and state-linked investors are active buyers at home and abroad, and they bring institutional diligence standards. International private equity and strategic buyers use Dubai and Abu Dhabi as a regional base. IPO activity on the Dubai Financial Market and Abu Dhabi Securities Exchange has also grown, bringing underwriter diligence rooms.
Because the bidders are spread across the Gulf, Europe, India and Asia, support availability and a clean, simple interface matter more than in a single-country process. Many family-owned targets also want a quick, low-friction setup, so the time from contract to a working room is worth comparing.
Language is a practical point. Onshore constitutional documents, licences and court filings are often in Arabic, while the SPA and most commercial contracts are in English. A sensible room places certified translations next to each original, uses folder names that both legal teams can follow, and routes Q&A on Arabic documents to a reviewer who reads them. Agree at the outset which version prevails if a translation and its original differ, because that question tends to surface late.
Regulators to know
| Regulator | Jurisdiction | Typical deal touchpoint |
|---|---|---|
| DFSA | DIFC | Change in control of DIFC-regulated firms |
| FSRA | ADGM | Change in control of ADGM-regulated firms |
| Securities and Commodities Authority | Onshore capital markets | Listed company acquisitions and IPOs |
| Central Bank of the UAE | Onshore banks, insurers and payment firms | Approval for new controllers |
| Ministry of Economy | Federal competition law | Merger notification above set thresholds |
Merger control was strengthened by a federal competition law issued in 2023, with notification thresholds set by later decisions; confirm current thresholds with counsel. Sector licensing authorities, for example in telecoms, energy or healthcare, can add further approvals.
Pricing in dirhams and dollars
The UAE dirham has long been pegged to the US dollar at about 3.67 AED per USD, so USD list prices translate predictably. Our figures are indicative; confirm with the provider. Ellty publishes $149/mo with a 14-day free trial, and iDeals, Datasite, Intralinks and Ansarada quote on request. UAE VAT is 5%; a VAT-registered business importing services usually accounts for it through the reverse charge. Free zone status does not by itself remove VAT, and the treatment varies, so confirm with a tax adviser. See VDR pricing for billing models.
Indicative room budget in the United Arab Emirates
Pick a billing model, then set the length of the process and the number of users.Common deal types and related guides: family business divestments (mergers and acquisitions), sovereign and private equity investments (private equity), IPOs (IPO and capital markets), real estate developments and portfolios (real estate), and energy projects (energy and infrastructure).
Deal timeline in the UAE
The first step in a UAE deal is a legal question rather than a commercial one, and the answer shapes everything after it.
Deal timeline in the UAE
- First step Identify the regime Mainland, DIFC or ADGM decides the data law and the regulator.
- Preparation Build the record Family groups often assemble documents for the first time.
- Diligence Bilingual room Certified translations sit beside Arabic originals.
- Approvals Change in control DFSA, FSRA or Central Bank approval; merger notification above thresholds.
- Closing Archive and hand over Export the record and agree who keeps it.
Data protection obligations at a glance
The cards below are qualitative. The onshore regime is still developing, and penalty levels depend on the regime and its implementing rules, so check the current position with counsel.
Data protection obligations at a glance: UAE
Cross-border transfer options
Cross-border transfer options for a UAE room
Common mistakes in UAE rooms
- Assuming one law covers the group. A mainland parent with a DIFC subsidiary has two regimes in one room.
- Assuming free zone status removes VAT. It does not by itself; confirm the treatment with a tax adviser.
- Untranslated originals. Arabic licences and filings without translations slow down foreign bidders’ counsel.
- One large user group for the family side. Separate family members, management and advisers so permissions and logs stay meaningful.
- Underestimating time zones. Bidders from Europe, India and Asia will expect answers in their own hours.
Choosing a provider for a UAE deal
The UAE market rewards a room that is quick to set up and easy for first-time users, because many family-owned sellers are running their first process. Ask about support hours across the Gulf, Europe and Asia, how translations can be linked to originals, and where files are stored, since the answer feeds into DIFC, ADGM or PDPL documentation.
iDeals, Datasite, Intralinks and Ansarada list ISO 27001 and SSO and are common on sovereign and institutional deals. Ellty offers the full deal toolkit, including Q&A, e-signature and AI tools, with a published price and a fast setup. The dirham’s dollar peg makes any USD price easy to translate, as the calculator on this page shows.
FAQ
Which data protection law applies to a UAE data room?
It depends on where the controller is established. Mainland companies fall under the federal PDPL, while DIFC and ADGM entities follow their own data protection laws. Sector rules, such as for health data, can add requirements.
Do UAE deals require local hosting?
There is no general requirement for deal rooms. Some sectors, including health and some government-linked activity, have local storage rules, so check the target's licences.
Does the dirham peg simplify pricing?
Yes. With the dirham pegged to the dollar, a USD price converts at a stable rate, though VAT and any bank charges still apply.