admin

Good office Wi-Fi and cabling in Dubai is decided long before anyone switches on a laptop. IT should be involved before the fit-out drawings are signed off, so cable routes, the comms room, ceiling access and Wi-Fi access point positions are planned alongside partitions, lighting and air conditioning. Leave it until the ceilings are closed and you pay for it in disruption, compromises and rework.

This guide is for office managers, project managers and managing directors who have signed a lease in Dubai and have a fit-out contractor starting soon. It walks through each stage, the main technical choices and the checklist to hand your contractor.

Key takeaways

• Bring your IT partner in at drawing stage, not after the ceilings close.
• For new cabling, Cat6A supports 10 Gb/s over a full 100-metre channel; Cat6 supports it only over shorter distances.
• Plan access point positions from a predictive design, then verify on site before handover.
• Split staff, guest, AV, device and voice traffic onto separate networks from day one.
• Insist on a handover pack: test results, labelling, port schedule, as-built drawings and admin credentials held by you.

When should IT be involved in a fit-out?

At drawing stage. By the time partitions go up and ceilings close, the decisions that shape your network have already been made, whether anyone meant to make them or not.

Early involvement lets you plan:

• containment: the trays, conduits and routes cables will follow;
• the comms room: where it sits, its power, cooling, ventilation and security;
• ceiling access: so access points can be mounted and maintained;
• access point positions: based on the layout and usage, not on whatever spot was left;
• power: including Power over Ethernet (PoE) for access points, cameras, phones and meeting-room kit.

What happens at each stage?

Before drawings are signed off

• Agree the number and location of data points for desks, printers, screens, cameras, access control and meeting rooms, with spare capacity.
• Mark access point positions, informed by a predictive Wi-Fi design.
• Fix the comms room location and confirm power, cooling, ventilation and lockable access.
• Decide how internet lines enter the building and reach the comms room, and ask the landlord about riser access for a second provider.

During fit-out

• Containment goes in before ceilings and partitions close.
• Cabling is installed, terminated and labelled.
• Every link is tested and certified with a cable certifier, not just a continuity tester.
• Your IT partner and the fit-out contractor coordinate on access, sequencing and layout changes.

Before move-in

• Switches, access points and the firewall are installed, configured and tested.
• Internet lines are live, and failover is tested if you have a second line.
• Networks are split into staff, guest, AV, device and voice segments.
• Printers, meeting rooms and phones are tested on the real network.

At handover

Ask for, and check you have received:

• certification test results for every cable link;
• labelling at both ends of every cable;
• a port schedule showing what is connected where;
• as-built drawings;
• configuration backups and admin credentials for switches, Wi-Fi and the firewall, held by you, not only the installer.

Do you need a Wi-Fi survey?

For most offices, yes. Dubai fit-outs often combine glass partitions, concrete cores, metal-framed ceilings and dense open-plan seating, all of which affect coverage and capacity.

There are two complementary approaches:

• Predictive design: modelling coverage and capacity from floor plans and wall materials before anything is installed. Useful at drawing stage to place access points.
• On-site validation survey: measuring real signal and performance in the finished space to confirm and fine-tune.

Design for capacity, not just coverage. A meeting room with ten people on video calls needs more than “full bars”. Our meeting room AV checklist covers what those rooms need.

Is Wi-Fi 6E or Wi-Fi 7 worth it?

Wi-Fi 6E and Wi-Fi 7 can use the 6 GHz band, which is less congested than 2.4 and 5 GHz. In the UAE, TDRA allows indoor Wi-Fi in the lower part of the 6 GHz band under its short range device rules, so check that the access points you buy are TDRA type-approved for the UAE. Newer standards only help devices that support them, so look at the laptops and phones your staff will use over the next few years. The access points you choose also affect cabling and switch power, which is why this decision belongs at drawing stage.

Cat6 or Cat6A?

Both are common copper network cables. The practical difference is how far they can carry 10 Gb/s Ethernet (10GBASE-T):

	Cat6	Cat6A
10 Gb/s range	Up to 55 m, depending on the installation (guaranteed to 37 m)	Full 100 m channel
Typical use	Desk points with modest needs; short runs	New fit-outs, access points, longer runs
Cable size	Thinner, easier to install	Thicker; containment must allow for it
Expected life	Shorter headroom for future equipment	More headroom for faster access points

Many installers recommend Cat6A for new fit-outs, especially for access point runs, because cabling usually outlives several generations of switches and Wi-Fi. Cat6 can still be enough for some desk runs. Ask your installer to explain their recommendation, and make sure the containment is sized for the cable you choose. Larger offices may also use a fibre backbone between floors or comms rooms.

Power over Ethernet

Access points, cameras and phones are often powered over the network cable. The IEEE 802.3bt standard allows up to 60 W (Type 3) or 90 W (Type 4) per port at the switch. Newer access points can need more than older PoE+ switches provide, so size switch power budgets for the access points you actually plan to buy.

How should the network be split?

Separating traffic onto different virtual networks (VLANs), with firewall rules between them, limits what each part can reach. A visitor on guest Wi-Fi shouldn’t be able to see your file server.

A typical starting point:

Segment	Who or what	Can reach
Staff	Laptops and desktops	Internal systems and internet
Guest	Visitors	Internet only
AV	Meeting-room systems and displays	Required cloud services
Devices	Printers, cameras, access control	Only the systems that manage them
Voice	Desk phones, if used	Phone platform, with priority

Our first 10 cyber controls explain why segmentation matters for security.

Checklist to give your fit-out contractor

• [ ] IT partner named and involved before drawings are signed off
• [ ] Data point schedule agreed, with spare capacity
• [ ] Access point positions marked on drawings from a predictive design
• [ ] Comms room location, power, cooling, ventilation and security agreed
• [ ] Containment routes, sizes and ceiling access agreed
• [ ] Internet line entry routes agreed, including a second provider
• [ ] Cable type agreed (Cat6 or Cat6A, plus any fibre)
• [ ] Switch PoE budget sized for planned access points and cameras
• [ ] Labelling scheme agreed
• [ ] Testing and certification of every link included
• [ ] Network segments (VLANs) planned
• [ ] Wi-Fi validated on site before handover
• [ ] Handover pack: test results, labels, port schedule, as-built drawings, credentials

What drives the cost?

The main drivers are the number of data points and access points, cable category and run lengths, containment work, the comms room build, switch and access point models and their licences, and how the work is sequenced with the main contractor. Out-of-hours work in occupied buildings adds cost. Changes after ceilings close are the most expensive of all.

Common mistakes

• Treating Wi-Fi as an afterthought and mounting access points wherever the ceiling grid allows.
• Undersized comms rooms with no cooling.
• Accepting cabling without certification results.
• Letting the installer keep the only admin passwords.
• One flat network for staff, guests and devices.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a vendor-agnostic approach. Our Networks team has dedicated pre-sales, project delivery, engineering and ongoing support capabilities, working with vendors including Cisco, HP Aruba and Fortinet. We can work with your fit-out contractor from drawing stage to handover. Our Dubai office is at Saaha Offices, Downtown Dubai. If you are still choosing kit, see our guide to Cisco vs Aruba vs Fortinet.

Frequently asked questions

When should I involve IT in an office fit-out?

Before the drawings are signed off, so cable routes, the comms room and access point positions are designed in rather than squeezed in.

Should I choose Cat6 or Cat6A for a new office?

Cat6A supports 10 Gb/s over a full 100 m channel and gives more headroom for future access points. Cat6 can be enough for shorter desk runs.

Do I need a Wi-Fi survey for a new office?

For most offices, yes: a predictive design at drawing stage and an on-site validation before handover.

Is Wi-Fi 6E allowed in the UAE?

TDRA allows indoor Wi-Fi in the lower 6 GHz band under its short range device rules. Use access points that are type-approved for the UAE.

Do I need a comms room?

Most offices need a secure space for the network rack with reliable power and cooling. Its size depends on your equipment.

Talk to Softworx Services in Dubai

Moving office or starting a fit-out? Talk to the Softworx Services team early, while the drawings can still change.

Sources

• TDRA, Ultra-Wide Band and Short Range Devices regulations (6 GHz Wi-Fi): https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/UWB-and-SRD-Regulations-50.ashx
• Wi-Fi Alliance, regulations enabling 6 GHz Wi-Fi: https://www.wi-fi.org/regulations-enabling-6-ghz-wi-fi
• Fluke Networks, twisted pair cabling and 10 Gigabit (Cat6 and Cat6A distances): https://www.flukenetworks.com/expertise/learn-about/twisted-pair-cabling-and-10-gigabit-cabling
• CommScope, Cat 6A fact file: https://www.commscope.com/insights/the-enterprise-source/cat6a-the-fact-file/
• Ethernet Alliance, IEEE 802.3bt PoE technical brief: https://ethernetalliance.org/wp-content/uploads/2020/02/EthernetAlliance_Gen2PoECertProgram_techbrief-FINAL-19DEC19.pdf

In the Cisco vs Aruba vs Fortinet debate, there is no single winner. All three make capable firewalls or security appliances, switches and Wi-Fi for offices of every size. The right choice depends on how many sites you run, whether you want cloud or on-site management, how central security is to your design, the skills of whoever will run it and the licensing model you are comfortable paying for over five or more years.

This guide is for IT leads and operations managers at UAE SMEs and mid-size businesses setting up a new Dubai office or refreshing an old network. It explains what each vendor is typically chosen for, how to compare quotes fairly and the questions that matter more than the logo.

Key takeaways

• Decide on management model (cloud dashboard or on-site controller), security approach and support before you compare brands.
• Cisco offers both cloud-managed Meraki and traditionally managed Catalyst lines; HPE Aruba Networking centres on its Central cloud platform; Fortinet extends FortiGate firewall management to its own switches and access points.
• Licences and support are a large share of the lifetime cost. Compare five-year totals, not hardware prices.
• One vendor for everything is simpler to run; mixing vendors can suit you if you have the skills and a reason.
• Local stock, spares and support response in the UAE matter as much as features.

Is there a best network vendor for a Dubai office?

No. Each of these vendors serves organisations from small offices to large enterprises, and each has a sensible answer for a typical 20 to 300-person Dubai office. What differs is how the kit is managed, how security fits in, how it is licensed and who will look after it.

A better question is: which approach fits our sites, our people and our budget over the life of the equipment?

What is each vendor typically chosen for?

The summaries below describe how these vendors position their main office product lines. Exact features depend on model and licence, so check current datasheets for anything you rely on.

	Cisco	HPE Aruba Networking	Fortinet
Typical reason chosen	Breadth of portfolio and choice of management models	Wireless heritage and cloud-managed campus networking	Security-led design built around the FortiGate firewall
Cloud management	Meraki dashboard for Meraki devices	HPE Aruba Central (cloud)	FortiCloud and FortiGate-based management
On-site management	Catalyst range with on-premise tools	HPE Aruba Central on-premises option	FortiGate manages FortiSwitch and FortiAP via FortiLink
Licensing to understand	Meraki licences are required for devices to keep working	Central subscriptions per device	FortiGuard security and support bundles
Watch-outs	Two very different families; pick one deliberately	Product naming has changed after HPE’s acquisitions	Strongest value when you standardise on the Fortinet stack

Cisco

Cisco’s office portfolio covers two quite different approaches. Meraki is cloud-managed: firewalls, switches, Wi-Fi and cameras configured from one web dashboard, which suits multi-site businesses without a large network team. Cisco’s Catalyst range offers deep configuration and on-site management options favoured by larger IT teams. Meraki uses a co-termination licence model, and devices stop operating if licences lapse beyond the grace period, so renewals need to be planned.

HPE Aruba Networking

Aruba built its reputation in enterprise Wi-Fi and is now part of Hewlett Packard Enterprise as HPE Aruba Networking. Its management platform, HPE Aruba Central, manages access points, switches and gateways and is offered as a cloud service or for on-premises deployment. HPE also completed its acquisition of Juniper Networks in July 2025, so expect the portfolio and roadmap to keep evolving; ask any partner how that affects the products you are being quoted.

Fortinet

Fortinet starts from the firewall. A FortiGate can act as the controller for FortiSwitch switches and FortiAP access points through FortiLink, so security policy, switching and Wi-Fi are managed together. That appeals to businesses that want strong security at the centre of a simple, single-vendor design. The value is greatest when you commit to the Fortinet stack.

What about Palo Alto Networks?

Palo Alto Networks is primarily a security vendor. Many organisations pair Palo Alto firewalls with switching and Wi-Fi from another vendor. That is a perfectly sound design if you want a particular firewall and are comfortable running two management platforms.

Should you buy firewall, switches and Wi-Fi from one vendor?

Approach	Advantages	Trade-offs
Single vendor	One console, one support contract, consistent policies, simpler troubleshooting	Less choice per layer; stronger lock-in at renewal time
Best of breed	The strongest product for each layer; more bargaining power	Several consoles and contracts; more skills needed; more integration work

For most offices without a dedicated network team, a single vendor or a single management platform is easier to live with. Mixing vendors makes sense when you have a specific requirement, such as a firewall mandated by a client, or existing kit with years of life left.

What should drive the decision?

Score each option against these factors, weighted for your business:

1. Sites: one office or many? Multi-site estates benefit from cloud management and, often, SD-WAN.
2. Management model: will someone in-house configure it, or will a partner run it as a managed network service?
3. Security: is the firewall the centre of the design, or one layer among several?
4. Skills: what do your team or partner already know well?
5. Wi-Fi demands: density of users, meeting rooms, video calls and newer standards such as Wi-Fi 6E or Wi-Fi 7.
6. Power: how many access points, cameras and phones need PoE, and at what level?
7. Local support: stock, spares, warranty replacement and engineer availability in the UAE.
8. Lifecycle: end-of-sale and end-of-support dates for the models you are quoted.

How to compare quotes fairly

Quotes from different vendors are rarely like for like. Ask every bidder to price the same things:

• the same number of users, ports, access points and sites;
• hardware plus all licences needed for the features you asked for;
• support and warranty for the same term, ideally five years;
• installation, configuration and documentation;
• a clear statement of what happens if licences lapse.

Then compare the five-year total, not the year-one price. A cheaper box with expensive renewals is not cheaper.

A worked example

A 70-person firm moving into a single floor in Business Bay, with plans for a second site in Abu Dhabi, has no network engineer and an outsourced IT provider. It wants simple management, good meeting-room Wi-Fi and a strong firewall. A cloud-managed single-vendor design (Meraki, Aruba Central or a FortiGate-centred Fortinet stack) would all be reasonable. The deciding factors are the five-year licence cost, which platform its IT provider supports well, and how quickly failed hardware can be replaced locally.

What about licensing and lifecycle?

Many products now need subscription licences for management, security features or support, and some stop working or lose features without them. Ask for licensing terms in every quote, including what happens at renewal. Check end-of-sale and end-of-support dates too: equipment bought near the end of its life will need replacing sooner. Cabling and power choices should support the access points you plan to buy; see our guide to office Wi-Fi and cabling for a Dubai fit-out.

Common mistakes

• Buying on hardware price and discovering the licence renewal cost later.
• Choosing a platform nobody on the team or at the IT provider knows well.
• Under-sizing PoE for newer access points.
• Leaving the firewall on default settings because “it’s a good brand”. See our first 10 cyber controls.

Why a vendor-agnostic partner helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. Our services page names Cisco, HP Aruba, Palo Alto and Fortinet among the vendors we work with, and our pre-sales and solutions team works across each of them. That means we can recommend what fits your office rather than a single brand. Our Networks team works from our Dubai office at Saaha Offices, Downtown Dubai.

Frequently asked questions

Is Cisco Meraki the same as Cisco?

Meraki is Cisco’s cloud-managed product line. It is part of Cisco but is managed from the Meraki dashboard rather than with the tools used for Cisco’s Catalyst range.

Which is better for Wi-Fi, Aruba or Cisco?

Both make strong enterprise Wi-Fi. The better choice for you depends on management model, licensing, your partner’s skills and local support, not on a general ranking.

Is Fortinet good for switches and Wi-Fi as well as firewalls?

Fortinet sells FortiSwitch and FortiAP products that a FortiGate firewall can manage directly. It suits businesses that want security, switching and Wi-Fi in one platform.

Do these vendors need yearly licences?

Many products use subscription licences for management, features or support. Terms vary by product, so ask for them in every quote and compare five-year totals.

Can I mix network vendors?

Yes. It can avoid lock-in, but means more than one management console and support relationship.

Talk to Softworx Services in Dubai

Comparing quotes for a new office network? Talk to the Softworx Services team for a vendor-neutral view of what fits.

Sources

• Softworx Services (vendors and approach), softworx.ae: https://softworx.ae/solutions/
• Cisco Meraki documentation, co-termination licensing FAQs: https://documentation.meraki.com/Platform_Management/Product_Information/Meraki_Licensing/Co-Termination_Licensing/Co-Termination_Licensing_FAQs
• HPE, HPE Aruba Central: https://www.hpe.com/us/en/products/networking/aruba-central.html
• HPE newsroom, HPE closes acquisition of Juniper Networks (July 2025): https://www.hpe.com/us/en/newsroom/press-release/2025/07/hewlett-packard-enterprise-closes-acquisition-of-juniper-networks-to-offer-industry-leading-comprehensive-cloud-native-ai-driven-portfolio.html
• Fortinet Document Library, FortiGate switch controller (FortiLink): https://docs.fortinet.com/document/fortigate/8.0.1/administration-guide/207379/switch-controller
• Ethernet Alliance, PoE (IEEE 802.3bt) certification technical brief: https://ethernetalliance.org/wp-content/uploads/2020/02/EthernetAlliance_Gen2PoECertProgram_techbrief-FINAL-19DEC19.pdf

Managed network services in the UAE suit growing businesses that need their network monitored, patched and fixed reliably but can’t justify a full team of network specialists. In-house IT suits firms with enough day-to-day work and specialist depth to keep skilled people busy. Many growing companies end up with a hybrid: an in-house IT lead who knows the business, plus a managed provider for monitoring, specialist engineering and out-of-hours cover.

This guide is for managing directors, finance directors and operations leads at UAE SMEs and mid-size businesses deciding whether to hire IT staff or outsource. It compares the options honestly, gives a decision framework and lists what a good managed services contract should contain.

Key takeaways

• The real comparison is not salary versus monthly fee; it is coverage, depth of skills, resilience and accountability.
• In-house wins on business knowledge and on-site presence; managed wins on breadth of skills, monitoring and cover for holidays and sickness.
• Hybrid, or co-managed IT, is common for firms with 50 to several hundred staff.
• A managed provider has privileged access to your network, so security controls and contract terms matter.
• Write scope, hours, response targets, reporting and exit terms into the contract before you sign.

What are managed network services?

A managed network service is an arrangement where a provider takes ongoing responsibility for some or all of your network: firewalls, switches, Wi-Fi, internet links and often SD-WAN. Typical elements include:

• 24/7 or business-hours monitoring and alerting;
• incident response and fault fixing, remotely and on site;
• firmware updates and security patching;
• configuration changes on request;
• licence and warranty management;
• capacity and performance reporting;
• periodic reviews and improvement recommendations.

What is included, and when, varies widely between providers, so read the scope rather than the brochure.

Managed, in-house or hybrid: how do they compare?

	In-house IT	Managed network services	Hybrid (co-managed)
Knowledge of your business	Strong	Builds over time	Strong, via the internal lead
Breadth of specialist skills	Limited to the people you hire	Access to a wider team	Wide
Cover for leave, sickness, nights	Hard for a small team	Built into the service	Built in
Monitoring and alerting	Needs tools and someone watching	Usually included	Included
On-site presence	Immediate	By arrangement	Internal lead on site
Cost profile	Salaries, training, tools, recruitment	Predictable monthly fee	Both, at smaller scale
Key-person risk	High if one person knows everything	Lower; documented service	Lower
Accountability	Internal management	Contract and service levels	Shared, must be defined

When is in-house IT the better choice?

• You have enough network and IT work to keep specialists fully occupied.
• You need people physically on site all day, for example in a hospital, a factory or a large campus.
• Your systems are unusual and depend on deep internal knowledge.
• You can recruit and retain the specialist skills you need, including cover for leave.

When does managed make more sense?

• One or two IT people are stretched across everything from laptops to firewalls.
• Nobody watches alerts at night or at weekends.
• You have several sites, and outages at branches are hard to diagnose remotely.
• You need specialist skills (firewall policy, SD-WAN, Wi-Fi design) occasionally rather than daily.
• Clients, insurers or auditors expect evidence of monitoring, patching and documented change control.

Why many growing firms choose hybrid

Hybrid keeps an in-house lead who understands the business, owns priorities and manages users, while a provider handles monitoring, patching, specialist engineering and out-of-hours response. It avoids two common failure modes: the overloaded single IT person, and the outsourced service nobody inside the business is managing. The key is a clear responsibility matrix, so both sides know who does what.

A decision framework in six questions

1. How much would an hour of network downtime cost you? The higher it is, the more monitoring and fast response are worth.
2. Who notices a failure at 2am on a Friday? If the answer is “the first person in on Sunday”, you need monitoring.
3. How many specialist skills do you need? Count firewalls, switching, Wi-Fi, SD-WAN, cloud networking and security.
4. How many sites? More sites usually means more value from central monitoring.
5. What do clients and auditors expect? Documented patching and change control are easier with a managed service.
6. Who will manage the provider? Even fully managed services need an internal owner.

A worked example

A 120-person logistics firm has a head office in Dubai, a warehouse in Jebel Ali and a branch in Sharjah, with one IT manager and one support technician. Firewall changes wait weeks, nobody monitors the warehouse link at night, and the IT manager’s holidays are a risk. A co-managed model keeps the IT manager as owner of priorities, users and suppliers, while a provider monitors all three sites around the clock, applies firmware updates monthly, handles firewall and Wi-Fi changes through an agreed change process, and sends a monthly report. The technician stays focused on laptops and users. The IT manager gains time for projects, and the business gains cover it never had.

What does a managed provider need from you, and you from them?

A managed provider has privileged access to your network. International cyber agencies, led by CISA, have published joint guidance warning that attackers target managed service providers to reach their customers. Make sure your provider:

• uses named accounts with MFA, never shared logins;
• has only the access the contract requires, which is reviewed regularly;
• logs its administrative actions and shares those logs;
• has a documented incident response process that includes notifying you;
• signs a data processing agreement if it can access personal data, as it usually can under the UAE PDPL.

What should a managed services contract include?

• [ ] Scope: exactly which devices, sites and services are covered, and which are not.
• [ ] Hours: monitoring hours, support hours and how out-of-hours requests are handled.
• [ ] Response and fix targets: by priority level, with clear definitions of each priority.
• [ ] On-site attendance: when engineers will attend, where and how quickly.
• [ ] Change management: how changes are requested, approved, tested and recorded.
• [ ] Patching: how often firmware and security updates are applied, and how emergencies are handled.
• [ ] Reporting: what you receive each month (incidents, availability, capacity, security events).
• [ ] Security: named accounts, MFA, logging and incident notification.
• [ ] Data protection: a data processing agreement and the locations data is accessed from.
• [ ] Hardware and licences: who owns them, who renews them and how warranties are handled.
• [ ] Documentation: up-to-date network diagrams, configurations and credentials that you hold.
• [ ] Exit: handover of documentation, configurations and credentials if you leave, and notice periods.

What drives the cost?

We won’t quote prices without understanding your estate. Managed service costs are typically driven by the number of sites and devices, monitoring hours (business hours or 24/7), response targets, on-site attendance commitments, the security services included and whether hardware and licences are bundled. In-house costs include salaries, recruitment, training, monitoring tools and cover for leave. Compare like with like over at least three years.

Common mistakes

• Comparing one salary with a monthly fee and ignoring cover, tools and training.
• Signing without a defined scope, then discovering that Wi-Fi or a branch isn’t included.
• No internal owner for the managed service.
• Letting the provider hold the only copy of passwords and configurations.
• No exit plan.

If you are also choosing new equipment or connecting more sites, see our guides to Cisco vs Aruba vs Fortinet and SD-WAN in the UAE.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. We offer managed services in Dubai, alongside our Networks team’s pre-sales, project delivery, engineering and support. Our team can work as an extension of yours, whether you want us to run the network or support your in-house lead. Our Dubai office is at Saaha Offices, Downtown Dubai.

Frequently asked questions

What are managed network services?

An arrangement where a provider takes ongoing responsibility for monitoring, maintaining and fixing your network, such as firewalls, switches, Wi-Fi and internet links, under a contract with defined service levels.

Is managed IT cheaper than hiring in-house staff?

It depends on your size and needs. Compare the full cost of in-house staff, including cover, tools and training, with the managed service’s scope and service levels over several years.

What is co-managed IT?

A hybrid model where your in-house IT team and a managed provider share responsibilities, typically with the provider covering monitoring, specialist work and out-of-hours response.

What should be in a managed services SLA?

Scope, support hours, response and fix targets by priority, on-site attendance, reporting, security obligations and exit terms.

Can a managed provider support multiple sites in the UAE?

Many can. Ask how they monitor remote sites, how quickly engineers can attend each location and how branch outages are diagnosed.

Talk to Softworx Services in Dubai

Weighing up managed services against hiring? Talk to the Softworx Services team about what a managed or co-managed model could look like for your network.

Sources

• CISA and partners, “Protecting Against Cyber Threats to Managed Service Providers and their Customers” (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
• Australian Cyber Security Centre, joint advisory on managed service providers: https://www.cyber.gov.au/advisory/protecting-against-cyber-threats-to-managed-service-providers-and-their-customers
• Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
• CIS Critical Security Controls, Implementation Group 1 (service provider management): https://www.cisecurity.org/controls/implementation-groups/ig1
• Softworx Services (approach and capabilities), softworx.ae: https://softworx.ae/solutions/

SD-WAN in the UAE is the usual answer for businesses that have outgrown a handful of site-to-site VPNs but don’t want to pay for private MPLS circuits everywhere. Software-defined WAN combines two or more internet or private links at each site, steers each application over the best path, and manages every branch from one central policy. For a business with offices in several emirates, or across GCC countries, it brings resilience, visibility and consistent security.

This guide is for IT and operations leads at UAE mid-size businesses with branches, warehouses or showrooms in several locations. It explains what SD-WAN is, when it beats the alternatives, how to secure branches, what changes across borders, and how to plan a rollout.

Key takeaways

• SD-WAN uses multiple links per site and steers traffic by application, with central management.
• It is usually compared with MPLS (private circuits) and plain site-to-site VPNs; many businesses end up with a mix.
• Security needs to be designed in: a firewall at each branch or cloud-delivered security, consistent policy and segmentation.
• Across GCC borders, data protection rules differ by country. Take local advice before moving personal data between sites.
• Roll out in phases: pilot two sites, measure, then scale.

What is SD-WAN?

A traditional WAN connects sites with fixed circuits and routes all traffic the same way. SD-WAN adds a software layer on top of whatever connections you have (fibre broadband, dedicated internet, 4G or 5G, MPLS) and treats them as one pool. The industry body MEF publishes a standard (MEF 70) that defines SD-WAN services in terms of application-aware policies, virtual connections and the underlying links, which is a useful vocabulary when comparing offers.

In practice, an SD-WAN edge device at each site:

• monitors the quality of every link in real time;
• sends voice and video over the cleanest link and bulk traffic over another;
• fails over automatically if a link drops or degrades;
• builds encrypted tunnels between sites and to cloud services;
• takes its configuration from a central controller, so a new branch can be set up quickly.

Do I need SD-WAN, MPLS or just VPNs?

	Site-to-site VPNs	MPLS	SD-WAN
Underlying links	Internet	Private circuits from a carrier	Any mix: internet, 4G/5G, MPLS
Resilience	Manual or basic failover	Depends on circuit design	Automatic, per application
Visibility	Limited	Carrier-dependent	Per-application, central dashboard
Cloud access	Often backhauled via head office	Usually backhauled	Direct to cloud from each site
Management	Box by box	Carrier-managed	Central policy
Typical fit	Two or three sites, simple needs	Strict performance needs, private paths	Many sites, cloud-heavy, real-time apps

Stick with VPNs if you have two or three sites, little real-time traffic and someone comfortable maintaining them.

Keep or add MPLS where you need a private path with carrier-backed performance, for example between a head office and a data centre.

Choose SD-WAN when you have several sites, rely on cloud applications, run voice or video between sites, or need branches to survive a single link failure.

How do you keep branch connections secure?

SD-WAN changes where security happens. When branches reach the internet directly rather than through head office, each branch needs protection too. There are two broad approaches:

• Security at the edge: an SD-WAN device with an integrated next-generation firewall at each site. Several firewall vendors build SD-WAN into their appliances.
• Cloud-delivered security: branches send traffic to a cloud security service, an approach often called SASE (secure access service edge).

Whichever you choose:

• apply one central security policy rather than configuring each site separately;
• segment branch networks so tills, cameras and guest Wi-Fi are isolated from staff systems;
• require MFA for administrator access to the SD-WAN controller;
• log centrally so you can investigate an incident across sites;
• keep edge devices patched.

Our first 10 cyber controls for Dubai businesses apply at every branch, not just head office.

What changes when sites span GCC countries?

Connecting a Dubai head office to branches in Riyadh, Doha, Manama or Muscat adds three things to plan for.

Connectivity and providers. Each country has its own licensed operators. You will usually buy local internet links in each country, and lead times and service levels vary.

Data protection. The UAE PDPL controls transfers of personal data rather than banning them, but other GCC countries have their own laws, including Saudi Arabia’s Personal Data Protection Law, Qatar’s Law No. 13 of 2016, Bahrain’s Law No. 30 of 2018 and Oman’s Royal Decree 6/2022. Rules on cross-border transfers differ, so take local advice before centralising personal data from several countries in one place. Our guide to UAE PDPL compliance covers the UAE side.

Equipment and support. Check that the SD-WAN hardware you choose can be imported, supported and replaced in each country, and how quickly.

How to plan a multi-site rollout

1. Inventory every site: users, applications, current links, contracts and renewal dates.
2. Classify applications: which are real-time (voice, video, contact centre), business-critical (ERP, POS) or bulk (backups, updates).
3. Design the links: ideally two diverse links per site from different providers or technologies, such as fibre plus 5G.
4. Choose the security model: firewall at the edge or cloud-delivered, and how policy is managed.
5. Pilot two sites: head office and one representative branch. Measure call quality, failover time and application performance.
6. Roll out in waves, with a rollback plan for each site.
7. Hand over: documentation, monitoring, alerting and who responds to what. Many firms choose a managed network service for this stage.

A worked example

A retailer with a Dubai head office, eight showrooms across the UAE and a warehouse in Jebel Ali runs POS, a cloud ERP and Teams calling. Today each showroom has one broadband line and a VPN back to head office, and a line fault closes the tills. An SD-WAN design gives each showroom fibre plus a 5G backup, sends POS and voice over the healthiest link, lets cloud traffic go direct rather than through head office, and puts tills on a separate segment from guest Wi-Fi. The pilot measures whether a cable cut at one showroom goes unnoticed by staff.

What to ask an SD-WAN provider

• Which link types does the edge device support at each site, including 4G and 5G?
• How quickly does it fail over, and does a live voice call survive the switch?
• Is security built into the edge device, delivered from the cloud, or both?
• Where is the controller hosted, and what happens to branches if it is unreachable?
• Which licences are needed for the features we asked for, and what happens if they lapse?
• Can the hardware be supported and replaced in every country where we have sites?
• What reporting do we get: per-application performance, link health, security events?
• Who monitors the network after go-live, and during which hours?

What drives the cost?

The main drivers are the number of sites, the edge devices and their licences, the security model, the number and type of links at each site, whether you keep any MPLS, and who manages the service afterwards. Link costs vary widely by provider and country.

Common mistakes

• Two links from the same provider over the same duct, which fail together.
• Turning on direct internet access at branches without branch security.
• Skipping the pilot and discovering voice issues across every site at once.
• Forgetting to plan who watches the dashboard once it is live.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach, working with vendors including Fortinet, Cisco, Palo Alto and HP Aruba. Our Networks team can design and deliver multi-site networks, with ongoing monitoring and support through our managed services in Dubai. Our Dubai office is at Saaha Offices, Downtown Dubai. For choosing the platform, see our guide to Cisco vs Aruba vs Fortinet.

Frequently asked questions

What is SD-WAN in simple terms?

Software that combines several internet or private links at each site, sends each application over the best one and manages every site from one place.

Is SD-WAN better than MPLS?

Not always. SD-WAN is usually more flexible and cloud-friendly; MPLS gives a private path with carrier-backed performance. Many businesses use both.

Is SD-WAN secure?

It encrypts traffic between sites, but branches that reach the internet directly also need firewalling or cloud security and consistent policy.

Can SD-WAN connect offices in different GCC countries?

Yes, using local links in each country. Plan for local providers, equipment support and each country’s data protection rules.

How many internet links does each site need?

Two diverse links are the usual minimum for resilience, ideally from different providers or technologies.

Talk to Softworx Services in Dubai

Connecting more sites, or tired of branch outages? Talk to the Softworx Services team about a multi-site design.

Sources

• MEF (Mplify Alliance), MEF 70.2 SD-WAN Service Attributes and Service Framework: https://www.mplify.net/resources/mef-70-2-sd-wan-service-attributes-and-service-framework/
• Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
• Saudi Personal Data Protection Law (English translation): https://misa.gov.sa/app/uploads/2025/08/PersonalDataProtectionLaw.pdf
• Oman Royal Decree 6/2022 issuing the Personal Data Protection Law: https://decree.om/2022/l20220006/
• Qatar National Cyber Security Agency, Law No. 13 of 2016 on Personal Data Privacy Protection: https://assurance.ncsa.gov.qa/en/library/privacy
• Bahrain Personal Data Protection Authority, Law No. 30 of 2018: https://www.pdp.gov.bh/en/regulations.html
• CIS Critical Security Controls, Implementation Group 1: https://www.cisecurity.org/controls/implementation-groups/ig1

Good meeting room AV in Dubai comes down to five things: a display everyone can read, a camera that frames everyone, audio that picks up every voice clearly, a reliable wired network connection and a simple way to start the meeting. Most failed rooms fail on audio and network, not on the screen.

This guide is for office and facilities managers equipping meeting rooms in a new or refreshed Dubai office. It gives a checklist by room size, explains the common audio problems in glass-heavy offices, compares Teams Rooms, Zoom Rooms and bring-your-own-device setups, and ends with a test you can run before handover.

Key takeaways

• Choose the platform first (Teams Rooms, Zoom Rooms or bring your own device), then the hardware certified for it.
• Size displays from the furthest seat, using a recognised method such as AVIXA’s display image size standard.
• Glass walls and hard floors make rooms echo. Budget for acoustic treatment as well as microphones.
• Wire every room system to the network and put AV on its own network segment.
• Test every room with a real call, from the far end, before you accept it.

What does a modern meeting room need?

Every video-enabled room needs the same building blocks, scaled to its size:

• Display: large enough for the furthest seat to read shared content.
• Camera: a field of view that frames everyone at the table, not the ceiling.
• Microphones: coverage for every seat, with echo cancellation.
• Speakers: clear speech at a comfortable level for everyone.
• Compute or room system: certified for your meeting platform.
• Control: a touch console or one-touch join so nobody needs IT to start a call.
• Network: a wired connection with enough capacity and priority for real-time media.
• Booking: calendar integration and, ideally, a panel outside the door.

Checklist by room size

• [ ] Huddle room (2 to 4 people): all-in-one video bar with built-in camera, microphones and speakers; one display sized for the far seat; wired network point; a single cable or wireless option for content sharing.
• [ ] Small meeting room (4 to 6 people): video bar or camera plus soundbar; one display; touch console for one-touch join; booking panel outside the door.
• [ ] Medium meeting room (6 to 12 people): dedicated camera with a wide field of view or speaker tracking; table or ceiling microphones so every seat is covered; one large or two displays; touch console; booking panel; acoustic treatment for glass and hard surfaces.
• [ ] Boardroom (12+ people): multiple cameras or intelligent framing; ceiling or distributed microphones; dedicated speakers and DSP for echo cancellation; dual displays or a large display sized for the back of the room; control system; acoustic design reviewed by an AV engineer.
• [ ] Every room: wired network connection on the AV segment; power planned at display, table and ceiling positions; cable containment from table to display; a labelled support contact in the room.

Treat these as starting points. Room shape, ceiling height and how the room is actually used (presentations, hybrid workshops or board meetings) change the design.

How big should the display be?

Size the display from the furthest viewer, not from the room’s floor area. AVIXA’s display image size standard for 2D content (DISCAS) gives a repeatable method based on viewing distance and the kind of content people need to read, from slides to detailed spreadsheets. Its online calculators are a useful sanity check before you order. If people at the back can’t read a spreadsheet, the screen is too small or the content too dense.

Why does audio fail in Dubai meeting rooms?

Many Dubai offices use glass partitions, hard flooring and exposed ceilings. They look great and sound terrible, because hard surfaces reflect sound and make rooms echo. Microphones then pick up reverberation and air-conditioning noise as well as voices, and remote participants hear a muddy, hollow sound.

Practical fixes:

• add soft surfaces: acoustic panels, ceiling baffles, rugs and fabric;
• choose microphones designed for the room size, with good echo cancellation;
• place microphones close to people and away from AC vents;
• keep speakers and microphones properly separated, or use a system that manages both;
• for larger rooms, have an AV engineer measure the room before you choose kit.

Teams Rooms, Zoom Rooms or bring your own device?

Option	How it works	Suits	Watch-outs
Microsoft Teams Rooms	Dedicated room system certified by Microsoft, with a touch console	Organisations that run on Microsoft 365	Needs Teams Rooms licensing and certified hardware
Zoom Rooms	Dedicated room system on Zoom-certified hardware	Organisations standardised on Zoom	Needs Zoom Rooms licensing and certified hardware
Bring your own device (BYOD)	Users connect a laptop to the room camera, microphones and display via USB-C or a wireless dongle	Mixed-platform users, client meetings on many platforms	Less consistent; more support calls; depends on each laptop

Many organisations use dedicated Teams or Zoom rooms for their main platform and keep a BYOD option for client calls on other platforms. Microsoft publishes a list of certified Teams Rooms systems and peripherals, and Zoom publishes its own certified hardware list; buy from those lists.

In the UAE, Microsoft Teams and Zoom are on TDRA’s approved list of VoIP applications. Our business phone system UAE guide explains what changes when those platforms also handle external phone calls.

What does the network need?

Room systems are real-time video devices and are only as good as the network under them.

• Wired connections: Microsoft strongly recommends connecting Teams Rooms devices to a wired network. Use Wi-Fi only where wiring is impossible.
• Bandwidth: enough for the highest-quality video your rooms use, at the same time as every other room and desk.
• Quality of service: settings that prioritise meeting traffic over downloads and backups.
• Firewall rules: the URLs and ports your meeting platform needs must be open; check them during installation, not on the day of a board meeting.
• Segmentation: room systems, displays and booking panels on their own AV network segment.
• PoE: booking panels, some cameras and microphones are powered over the network, so plan switch power budgets.

If you are still at fit-out stage, our guide to office Wi-Fi and cabling in Dubai shows how to plan data points and containment for each room.

How to test a room before handover

Run this test in every room before you accept the installation:

1. Book the room from a calendar and check the panel and console show the booking.
2. Start the meeting with one touch.
3. Join from outside the office, on a laptop in another room or at home.
4. Have someone speak from every seat. Check the far end hears each person clearly.
5. Check the camera frames everyone and adjusts when people move.
6. Share content from a laptop, both wired and wireless.
7. Run the call with the air conditioning at full power.
8. Leave a call running for 30 minutes and watch for drops or quality warnings.
9. Confirm the room shows healthy in the management portal, and that someone receives alerts.
10. Leave a quick-start card and a support contact in the room.

What drives the cost?

The main drivers are room size and count, the platform and its licences, dedicated room systems versus BYOD, microphones and acoustic treatment for larger rooms, containment and power works, control systems, and the support arrangement after handover. Standardising room designs across the office usually reduces both cost and support calls.

Common mistakes

• Choosing the screen first and the microphones last.
• Running room systems on guest Wi-Fi.
• Skipping acoustic treatment in glass rooms.
• Buying hardware that isn’t certified for your meeting platform.
• No test from the far end before handover.

How Softworx Services helps

Softworx Services provides audio-visual solutions for meeting rooms of every size, and our Networks team makes sure the network underneath can carry real-time video. We take a vendor-agnostic approach, and our Dubai office is at Saaha Offices, Downtown Dubai.

Frequently asked questions

What equipment does a video meeting room need?

A display, a camera, microphones and speakers with echo cancellation, a room system or compute certified for your platform, a touch console, a wired network connection and calendar booking.

How big should a meeting room screen be?

Size it from the furthest seat and the detail people need to read. AVIXA’s DISCAS standard and calculators give a repeatable method.

Should meeting rooms use Wi-Fi or a wired connection?

Wired. Microsoft strongly recommends wired connections for Teams Rooms devices, and the same applies to other platforms.

Why do remote participants say our meeting room echoes?

Hard surfaces such as glass and tiled floors reflect sound. Add acoustic treatment and microphones suited to the room size.

Can one room support both Teams and Zoom?

A dedicated room system is built around one platform, but many can join other platforms’ meetings, and a BYOD option covers the rest. Check each system’s interoperability features.

Talk to Softworx Services in Dubai

Fitting out meeting rooms? Talk to the Softworx Services team about room designs that work for your platform and your space.

Sources

• AVIXA, Display Image Size for 2D Content (DISCAS): https://www.avixa.org/resources/standards/display-image-size-for-2d-content
• Microsoft Learn, Teams Rooms certified systems and peripherals: https://learn.microsoft.com/en-us/microsoftteams/rooms/certified-hardware
• Microsoft Learn, Prepare your environment for Teams Rooms: https://learn.microsoft.com/en-us/microsoftteams/rooms/rooms-prep
• Microsoft Learn, Quality of service on Teams devices: https://learn.microsoft.com/en-us/microsoftteams/devices/qos-on-teams-devices
• Zoom Support, Zoom Rooms system requirements: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0060469
• TDRA FAQs, VoIP section: https://tdra.gov.ae/en/faqs
• TDRA statement on approved apps including Microsoft Teams and Zoom (Arabic), 30 March 2020: https://tdra.gov.ae/ar/media/tdra-statements/additional-apps-for-distance-learning

A cloud contact centre in the UAE, also called contact centre as a service (CCaaS), runs on a provider’s platform and is accessed over the internet, usually paid per agent on a subscription. An on-premise contact centre runs on hardware and software your business owns and maintains. For most UAE businesses the real choice is between four options, and the deciding factors are where your data must live, what your network can support and how you want to pay.

This guide is for customer service and operations leads at UAE SMEs and mid-size businesses whose phone or contact centre system is reaching end of life, or who need remote agents and channels such as web chat and WhatsApp.

Key takeaways

• There are four realistic options: international cloud, UAE-hosted cloud, on-premise and hybrid.
• The PDPL has no general rule that personal data must stay in the UAE, but health data generally must, and some contracts and sector rules require local hosting.
• Cloud contact centres live or die on the network: bandwidth, quality of service and a second internet line matter as much as features.
• UAE phone numbers and public network connectivity should come through the licensed operators or their authorised partners.
• Ask every provider, in writing, where recordings, transcripts and customer data are stored.

What is the difference between cloud and on-premise contact centres?

With a cloud contact centre, the provider runs the platform. You configure queues, routing, IVR menus and reporting through a web console, and agents log in from a browser or app. With on-premise, the servers and software sit in your building or data centre, and your team or a partner looks after them.

	Cloud (CCaaS)	On-premise
Cost model	Ongoing subscription, usually per agent	Upfront purchase, plus maintenance and support
Setup	Typically quicker; no servers to install	Hardware and software to install and configure
Scaling	Add or remove agents through the console	Limited by hardware and licences you own
Remote agents	Built in; agents need a good connection	Possible, but needs remote access set up
New features	Released by the provider	Upgrade projects on your timetable
Control	Shared with the provider	Full control of infrastructure and data

Neither column is “better”. The right answer depends on your data, your people and your plans.

What are the four options for a UAE business?

Cloud in an international region

The platform and its data are hosted outside the UAE. This usually gives the widest choice of platforms and features.

Suits you if: you have no contractual or sector requirement to keep data in the UAE, and you want the broadest choice.

UAE-hosted cloud

The platform is cloud-based, but data is stored in a UAE region or local data centre. Availability varies by provider and by feature, so check exactly which data (recordings, transcripts, analytics, backups) stays in the UAE.

Suits you if: you handle health data, or your clients, contracts or sector rules expect local hosting, but you still want a subscription model.

On-premise

You own and run the platform on your own infrastructure.

Suits you if: your regulator, contracts or internal policy require full control of infrastructure and data, or you have a large recent investment that still has life in it.

Hybrid

Some parts run in the cloud and some on-premise. For example, you might keep an existing on-site telephony platform and add cloud digital channels, or keep recordings on-site while agents use a cloud desktop.

Suits you if: you want to move in stages, or parts of the operation have different requirements.

A decision framework in five questions

1. Must any data stay in the UAE? If yes, rule out international-only cloud and test UAE-hosted options in detail.
2. Is your current platform supported for at least another two to three years? If not, the case for moving now is stronger.
3. Do agents work from home or across several sites? Cloud handles this natively.
4. Which channels do customers actually use? If WhatsApp and web chat are growing, check how each platform handles them.
5. Can your network carry real-time voice reliably? If not, fix that first, whatever you choose.

Where should my contact centre data live?

Contact centres hold a lot of personal data: call recordings, transcripts, chat logs and customer records. That data falls under the UAE data protection law, the PDPL, which has been in force since 2 January 2022.

There is no general rule under the PDPL that business personal data must be stored in the UAE. The law controls cross-border transfers rather than banning them. Health data is the clear exception: under Federal Law No. 2 of 2019, it generally must be stored and processed in the UAE unless a listed exception applies. Some sector regulators, government contracts and licence terms may also require local hosting. Our guide to UAE PDPL compliance for IT teams covers the wider picture.

Practical steps:

• ask every provider, in writing, where recordings, transcripts, analytics and backups are stored;
• check whether a UAE or GCC hosting option is available for each type of data;
• ask for a data processing agreement that covers processor terms, sub-processors and transfers;
• check your own contracts for hosting clauses.

This section is general information, not legal advice.

What about WhatsApp and other channels?

Many UAE customers would rather message than call. Most CCaaS platforms connect to WhatsApp through Meta’s WhatsApp Business Platform. Under Meta’s rules, a business can reply freely within a 24-hour customer service window after the customer’s last message; outside that window it must use pre-approved message templates. Check how each platform handles templates, hand-over between bot and agent, and where message history is stored.

What does the network need for a cloud contact centre to work well?

This is the part vendor comparisons tend to skip, and where many cloud rollouts go wrong. A cloud contact centre is only as good as the network under it.

• Bandwidth: enough capacity for every agent’s voice (and video, if used) at peak time, on top of normal office traffic. Microsoft, for example, publishes per-user bandwidth figures for Teams audio and video that are a useful benchmark.
• Quality of service (QoS): settings that prioritise voice, so a large download doesn’t make calls break up.
• Latency, jitter and packet loss: real-time voice is sensitive to all three; measure them before go-live, not after complaints.
• Resilience: a second internet line from a different provider with automatic failover, so agents stay online if one line drops. SD-WAN can manage this across several sites.
• Wi-Fi: coverage designed for real-time voice, or wired connections at agent desks.
• Headsets: good noise-cancelling headsets make a noticeable difference.
• Home workers: guidance on home connections and secure access to the platform.

How are UAE phone numbers provided?

VoIP is a regulated activity in the UAE. Voice services come from the licensed operators, from providers working with them, or from providers approved by TDRA. Using an approved platform doesn’t make every connection behind it compliant: ask exactly who supplies your UAE numbers and the trunk to the public phone network. Our business phone system UAE checklist covers this, along with call-recording consent and outbound calling rules.

What should I ask a provider before signing?

• Where are recordings, transcripts, analytics and backups stored? Put it in the contract.
• Will you sign a data processing agreement, and who are your sub-processors?
• Who supplies our UAE numbers and connection to the public phone network?
• Which CRM and business systems do you integrate with, and how?
• Which channels are included: voice, email, web chat, WhatsApp, social?
• Can we set retention periods and see who has accessed recordings?
• What support hours do you offer, in which time zone, and how do we escalate?
• What happens when we leave: how do we get our data and recordings back, and in what format?

What drives the cost?

We won’t quote prices, but the main drivers are the number of named or concurrent agents, the channels and features you license (recording, quality management, workforce management, AI features), call volumes and any telephony charges, integration work with your CRM, and the network upgrades needed to support it. On-premise adds hardware, data centre space and upgrade projects; cloud adds an ongoing subscription.

Common mistakes

• Choosing on features and discovering the network can’t carry the calls.
• Assuming “UAE region” covers every type of data the platform stores.
• Forgetting exit terms until it is time to leave.
• Moving every queue on one weekend instead of piloting with one team.

How Softworx Services helps

Softworx Services is a systems integrator with a vendor-agnostic approach. Our CCaaS and UCaaS team helps organisations choose and integrate scalable, resilient platforms that fit their wider communications setup, and our Networks team makes sure the network underneath is ready. Our Dubai office is at Saaha Offices, Downtown Dubai.

Frequently asked questions

What is a cloud contact centre?

A contact centre platform run by a provider and accessed over the internet, usually paid per agent per month. It is also called contact centre as a service, or CCaaS.

Can my contact centre data stay in the UAE?

It depends on the provider. Some offer UAE hosting and others don’t, and coverage can differ by data type. Ask in writing where each type of data is stored.

Is a cloud contact centre secure?

It can be, but security is shared. The provider secures the platform; you are responsible for user access, MFA, configuration and who can listen to recordings.

Can agents work from home?

Yes. Cloud contact centres are built for it. Agents need a reliable connection, a good headset and secure access.

Can a contact centre handle WhatsApp?

Many CCaaS platforms connect to the WhatsApp Business Platform, but features vary. Check template handling and where message history is stored.

Talk to Softworx Services in Dubai

Weighing up a new contact centre? Talk to the Softworx Services team about your options and whether your network is ready.

Sources

• Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
• Federal Law No. 2 of 2019 on the use of ICT in health fields, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1209/download
• TDRA FAQs, VoIP section: https://tdra.gov.ae/en/faqs
• Meta for Developers, WhatsApp Business Platform pricing and customer service windows: https://developers.facebook.com/docs/whatsapp/pricing/
• Microsoft Learn, “Prepare your organization’s network for Teams” (bandwidth and network guidance): https://learn.microsoft.com/en-us/microsoftteams/prepare-network

Choosing a business phone system in the UAE is mostly about who delivers the service. VoIP is a regulated telecom activity here: voice services come from the licensed operators, from providers working with them, or from providers approved by TDRA, and apps on TDRA’s approved list, such as Microsoft Teams and Zoom, can be used. An approved app doesn’t make every setup compliant, though. Your UAE numbers and connection to the public phone network should come from a licensed operator or its authorised partner, not a foreign trunk provider.

This guide is for UAE SMEs and mid-size businesses replacing an old PBX, moving to Teams or Zoom calling, or adding a contact centre. It covers what is allowed, six things to confirm before you sign, call recording, outbound sales rules and how to decide between cloud and an on-site PBX.

This article is general information, not legal advice. Speak to a qualified UAE lawyer about your own obligations.

Key takeaways

• VoIP is legal in the UAE but regulated. Using an approved service needs no telecom licence; providing or reselling voice does.
• Teams and Zoom are on TDRA’s list of approved apps, but calls to ordinary landlines and mobiles depend on how numbers and trunks are supplied.
• Get it in writing who provides your UAE numbers and trunk, and where recordings and transcripts are stored.
• Recording a call without consent can be a criminal offence. Announce recordings and get clear consent.
• Outbound sales calls must follow Cabinet Resolution No. 56 of 2024, including a Do Not Call Registry check and calling only between 9am and 6pm.

Is VoIP legal for businesses in the UAE?

Yes, but it is regulated. TDRA’s FAQs say VoIP services are telecommunications services and, where offered to subscribers, are regulated activities under the Telecom Law that require a licence or an exemption. Licensees, which in practice means e& (formerly Etisalat) and du, can provide VoIP, and third parties can provide it in collaboration with a licensee or with TDRA’s approval. TDRA also keeps a list of approved VoIP applications.

TDRA warns that using a VoIP service that isn’t provided by a licensee, delivered with one, or approved “may be” a criminal offence, and that licensees will most probably block illegal traffic. In practice that means an unapproved service may simply stop working.

The distinction that matters is using versus providing. Using an approved service doesn’t need a telecom licence. Providing or reselling voice services does. For most businesses the question isn’t “are we allowed to use VoIP?” but “is the service we’re buying delivered the right way?”

Can we use Microsoft Teams or Zoom as our phone system?

Microsoft Teams and Zoom are on TDRA’s published list of approved apps, so using them for meetings and internal calls is fine. Turning them into a full phone system, with calls to and from ordinary landlines and mobiles, is a separate step.

Teams Phone and Zoom Phone connect to the public phone network through options such as an operator-provided service or Direct Routing via a session border controller. The app being approved doesn’t make every connection behind it compliant. Your UAE numbers and the trunk to the public network should come from a licensed operator or its authorised partner.

That is why a cheap overseas SIP trunk quote deserves a second look. It isn’t automatically lawful here, and if the traffic is blocked you are left with a phone system that doesn’t work.

The checklist: 6 things to confirm before you sign

Take this list into every supplier conversation and ask for the answers in writing.

1. Is the platform approved, or delivered with a licensed operator?

Check whether the platform is on TDRA’s current approved list, or is delivered together with a licensed operator. The list changes, so check it on the day rather than relying on a sales deck.

2. Who provides the UAE numbers and trunk?

Find out exactly who supplies your UAE phone numbers and the connection to the public network, and whether you can keep (port) your existing numbers. If the answer is vague, or the trunk comes from outside the UAE, treat it as a warning sign.

3. Where are recordings, transcripts and CRM data hosted?

Ask where call recordings, voicemail, transcripts and linked CRM data are stored, and whether a UAE or GCC hosting region is available. Local hosting is required for health data and may be required by sector rules or government contracts.

4. Will the vendor sign a PDPL-ready data processing agreement?

Your phone provider processes personal data on your behalf. Ask for a data processing agreement that covers processor terms under the UAE PDPL, lists sub-processors and explains how cross-border transfers are handled.

5. Are there consent prompts, retention controls and access logs?

If you will record calls, check the platform can play a consent prompt, set retention periods per queue or user, and log who has listened to or downloaded recordings.

6. For sales teams: is there DNCR screening and calling-hour and retry control?

If your team makes outbound sales calls, check the platform can screen numbers against the Do Not Call Registry and enforce calling hours and retry limits automatically.

Can we record business calls in the UAE?

Only with consent, outside the cases the law allows. Article 431 of the UAE Crimes and Penalties Law (Federal Decree-Law No. 31 of 2021) makes it an offence to record or transmit a phone conversation without consent, except where the law permits. Penalties include imprisonment and a fine, and the court can order devices to be confiscated and recordings deleted.

Good practice is to:

• announce the recording at the start of the call;
• get clear consent;
• keep proof that consent was given;
• offer an alternative for callers who decline.

Don’t assume a short “this call may be recorded” message is always enough on its own. Explicit consent is the safer route, and it is worth confirming your approach with a lawyer.

A recording is also personal data, so the PDPL applies to how you store, secure and share it. Our guide to UAE PDPL compliance for your IT setup covers that side.

Rules for outbound sales calls

Cabinet Resolution No. 56 of 2024 on telemarketing applies to all companies licensed in the UAE, including those in free zones, that market through phone calls. It requires, among other things:

• prior approval for telemarketing from the competent authority;
• local numbers issued by a UAE-licensed telecom operator and registered under the company’s commercial licence;
• no marketing calls to numbers on the Do Not Call Registry (DNCR);
• identifying the company and the purpose at the start of the call;
• recording marketing calls and telling the consumer at the start;
• calls only between 9:00am and 6:00pm;
• no call-back after a consumer refuses, and no more than one retry a day and two a week if a call goes unanswered or is ended.

These rules shape your phone system choice as much as your sales script. A platform that can’t screen numbers, restrict calling hours or limit retries leaves the burden on your team.

Cloud (UCaaS) or keep a PBX: how to decide

A cloud phone system, or UCaaS, moves calling, voicemail, meetings and messaging onto a provider’s platform. It is usually easier to scale and suits hybrid working. An on-site PBX keeps the hardware in your office, under your own control and maintenance.

Question	Points towards cloud	Points towards keeping a PBX
Is your PBX near end of support?	Yes	No, it has years of support left
Do staff work from home or several sites?	Yes	Mostly one site, desk-based
Do you live in Teams or a CRM all day?	Yes, integration matters	Little integration needed
Do you want predictable monthly costs?	Yes	You prefer to own the asset
Is your network ready for real-time voice?	Yes, or can be made ready	Not yet, and no budget to fix it

Whichever way you go, check the network. Cloud calling needs enough bandwidth, quality-of-service settings that prioritise voice, and ideally a second internet line with automatic failover. Microsoft publishes target figures for latency, jitter and packet loss for Teams media that are a useful benchmark for any platform.

If you are also replacing a call centre, our comparison of cloud and on-premise contact centres goes into more depth, and our meeting room AV checklist covers the rooms where Teams or Zoom calls happen.

Common mistakes

• Buying on price per user without asking who provides the numbers and trunk.
• Forgetting number porting, and discovering late that existing numbers can’t move on your timetable.
• Turning on recording everywhere without consent prompts or retention limits.
• Ignoring the Wi-Fi. Calls on a congested wireless network sound bad on any platform.

How Softworx Services helps

Softworx Services is a systems integrator with a vendor-agnostic approach. Our CCaaS and UCaaS team designs and integrates communications platforms, and our Networks team makes sure the network underneath is ready for voice and video. Our Dubai office is at Saaha Offices, Downtown Dubai. We can help you compare options, ask suppliers the right questions and plan the move.

Frequently asked questions

Is VoIP banned in the UAE?

No. It is regulated. Services are provided by licensed operators, with them, or with TDRA approval, and apps on TDRA’s approved list can be used.

Can I use Microsoft Teams for business calls in the UAE?

Teams is on TDRA’s approved list. For calls to the public phone network, your numbers and connectivity should come through a licensed operator or its authorised partner.

Do I need a telecom licence to use a cloud phone system?

Not to use an approved service. Providing or reselling voice services needs a licence or an exemption.

Is it legal to record business calls in the UAE?

Only with consent, outside the cases allowed by law. Announce the recording, get clear consent and keep proof.

What are the rules for telemarketing calls in the UAE?

Cabinet Resolution No. 56 of 2024: prior approval, a DNCR check, calls only from 9am to 6pm from a number registered to the company, and limits on call-backs and retries.

Does call data have to be stored in the UAE?

There is no general rule. Health data generally must be, and some contracts or sector rules may require local hosting.

Talk to Softworx Services in Dubai

Planning a new phone system or moving to Teams calling? Talk to the Softworx Services team in Dubai for a vendor-agnostic review of your options before you sign.

Sources

• TDRA FAQs, VoIP section: https://tdra.gov.ae/en/faqs
• TDRA statement on approved apps including Microsoft Teams and Zoom (Arabic), 30 March 2020: https://tdra.gov.ae/ar/media/tdra-statements/additional-apps-for-distance-learning
• Cabinet Resolution No. 56 of 2024 Concerning the Telemarketing Regulations, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/2519/download
• DIFC Registrar guidance on Cabinet Resolution No. 56 of 2024: https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/business-section-documents/operating-a-business/operating-business—handbook-fees/difc-cr-gl-04-rev01-guidance-on-telemarketing-regulations.pdf
• Federal Decree-Law No. 31 of 2021, Crimes and Penalties Law (English text, FAOLEX): https://faolex.fao.org/docs/pdf/uae244494E.pdf
• Legal 500, “Can You Record A Call In The UAE (And Use It In Court)?”: https://www.legal500.com/intelligence/united-arab-emirates/privacy/can-you-record-a-call-in-the-uae-(and-use-it-in-court)
• Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
• Microsoft Learn, “Prepare your organization’s network for Teams”: https://learn.microsoft.com/en-us/microsoftteams/prepare-network
• Microsoft Learn, “PSTN connectivity options” for Teams Phone: https://learn.microsoft.com/en-us/microsoftteams/pstn-connectivity

Getting ISO 27001 in the UAE starts with a focused scope, a list of the information assets inside it and a risk assessment. From that you write a Statement of Applicability, which records which Annex A controls apply, then put those controls in place and test them with an internal audit and management review before an accredited certification body audits you.

This guide is for managing directors and operations leads at UAE SMEs and mid-size businesses who have just seen “ISO 27001 certificate required” in a tender or client questionnaire and want to know what is involved, which parts are IT work and how to pick a certification body.

Key takeaways

• ISO/IEC 27001:2022 is the current edition. Certificates against the 2013 edition had to expire or be withdrawn by 31 October 2025.
• We are not aware of any UAE law that makes ISO 27001 mandatory for private businesses in general. Clients, tenders and partners usually drive it.
• Start small: a tight scope is easier to certify and can be widened later.
• Roughly half the work is decisions and documents; the other half is technical controls such as access, logging, network security and backups.
• In the UAE, the Emirates International Accreditation Centre (EIAC) accredits certification bodies for ISO 27001.

What is ISO 27001?

ISO/IEC 27001 is the international standard for an information security management system, or ISMS: the policies, processes and controls a business uses to manage information security risk. The main clauses (4 to 10) describe how the management system must work: context and scope, leadership, planning and risk assessment, support, operation, performance evaluation and improvement.

Annex A is a reference list of controls. In ISO/IEC 27001:2022 it contains 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You don’t have to implement all 93; you decide which apply based on your risks and record that decision.

Do UAE companies need ISO 27001?

We are not aware of any UAE law that requires private businesses in general to hold ISO 27001 certification. More often it is asked for by clients, tenders and partners as evidence that you take security seriously, especially when you handle their data or connect to their systems.

Some sectors have their own mandatory security standards instead. The UAE Information Assurance Standard applies to government entities and critical information infrastructure, and ADHICS applies to Abu Dhabi healthcare. These are separate schemes from ISO 27001, although the UAE Cyber Security Council states that the IA Standard aligns with ISO/IEC 27001.

If you handle personal data, the work also supports UAE PDPL compliance, which asks for appropriate security measures but doesn’t require a certificate.

Where do I start?

1. Set a small, sensible scope

Your scope says which parts of the business the ISMS covers. For a first certification, a focused scope is easier: for example, the managed service a key client buys from you, or the systems that hold client data. Write it down clearly, including locations, teams, systems, and any outsourced or cloud services. If your Dubai office relies on systems run from another country, say so.

2. List your information assets

Inside the scope, list the information and the things that hold it: devices, servers, cloud services, applications, network equipment, paper records and the people who use them. Give each one an owner. If you’ve already worked through the first 10 cyber controls, your asset list is a head start.

3. Run a risk assessment

For each important asset, ask what could go wrong (a lost laptop, phishing, ransomware, a supplier failure), how likely it is and how bad it would be. Decide how to treat each risk: reduce it, accept it, avoid it or transfer it. Use a method you can repeat, because you will run it again as the business changes.

4. Write your Statement of Applicability

The Statement of Applicability (SoA) lists the Annex A controls, says which apply to you and why, and whether each is in place. It links your risk assessment to the work you actually do, and it is one of the first documents an auditor reads.

5. Implement, measure and review

Put the chosen controls in place, decide how you’ll measure them, run an internal audit, and hold a management review that looks at the results. Only then are you ready for certification.

Which parts are IT work and which are paperwork?

This is where many first projects stall. Some steps are management decisions and documents; others are hands-on technical work.

Step	Mainly	Typical owner
Scope and objectives	Decisions	Management
Information security policy	Documents	Management
Asset inventory	Both	IT, with business owners
Risk assessment and treatment plan	Both	Management and IT
Statement of Applicability	Documents	Management, with IT input
Access control and MFA	IT work	IT or technical partner
Network security and firewalls	IT work	IT or technical partner
Logging and monitoring	IT work	IT or technical partner
Backups and recovery testing	IT work	IT or technical partner
Supplier security	Both	Procurement and IT
Staff awareness training	Both	Management and HR
Internal audit	Review	Independent internal or external auditor
Management review	Decisions	Management

The technical rows are where a systems integrator can do the heavy lifting, so your own team can focus on the decisions and documents only you can write.

A worked example: a 40-person consultancy

A Dubai consultancy is asked for ISO 27001 by a bank client. Rather than certifying the whole company, it scopes the ISMS to “the delivery of advisory services to clients, including the Microsoft 365 tenant, the document management system and the Dubai office network”. Its risk assessment highlights phishing, lost laptops and a single administrator account shared with its IT provider. Its treatment plan: enforce MFA, encrypt laptops, give the IT provider named accounts with MFA, centralise logs and test backups quarterly. The SoA records those controls, plus why physical controls for a data centre don’t apply (it has none). That’s a scope an auditor can follow and a small team can maintain.

How does certification work?

An accredited certification body runs a Stage 1 audit of your documentation and readiness, then a Stage 2 audit of how the controls work in practice. Certificates are typically valid for three years, with surveillance audits in between and a recertification audit at the end of the cycle.

Many businesses choose a gap assessment before Stage 1, so they know what is missing before an auditor finds it. How long the whole process takes depends on your scope and starting point. Be wary of anyone who promises a fixed timeline, or a guaranteed certificate, before they have seen your business.

What drives the cost?

We won’t quote figures, but cost depends on the size and complexity of the scope, the number of sites, how many controls are already in place, how much outside help you use, and the certification body’s audit days, which are themselves based on scope and headcount.

How do I choose a certification body in the UAE?

In the UAE, EIAC accredits certification bodies for ISO/IEC 27001 (against ISO/IEC 27006-1, the standard for bodies that certify information security management systems). Ask whether your certification body is accredited by EIAC or by another IAF-member accreditation body, and check its accreditation scope covers ISO/IEC 27001. Make sure any certificate references the 2022 edition.

Also ask about experience with businesses of your size and sector, and how they schedule Stage 1, Stage 2 and surveillance audits. Keep roles separate: the body that certifies you shouldn’t be the one that built your ISMS.

Common mistakes

• Scoping the whole business on day one. It multiplies the work and delays the certificate.
• Buying a template pack and stopping there. Auditors test whether controls operate, not whether documents exist.
• Leaving IT out of the risk assessment. The people who run the systems know where the gaps are.
• Forgetting suppliers. Cloud and managed service providers are usually inside your risk picture.
• Treating certification as the finish line. Surveillance audits check the system is still working.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. Through our Cyber & Compliance and Networks teams we help businesses put the technical controls in place: network security, firewalls, access control, logging and resilient backups. Our Dubai office is at Saaha Offices, Downtown Dubai.

We are not a certification body and we don’t issue ISO 27001 certificates. We work alongside your consultant or internal lead on the technical side.

Frequently asked questions

Is ISO 27001 mandatory in the UAE?

We are not aware of any UAE law that makes it mandatory for private businesses in general; it is usually driven by clients and tenders. Some sectors have their own schemes instead, such as the UAE IA Standard and ADHICS.

How long does ISO 27001 take for an SME?

It depends on your scope and starting point. A focused scope and good existing controls make it quicker; a gap assessment gives you a realistic plan.

What is a Statement of Applicability?

A document listing the Annex A controls, which apply to your business and why, and whether each is in place.

What changed in ISO 27001:2022?

Annex A was restructured into 93 controls in four themes. Certificates against the 2013 edition had to expire or be withdrawn by 31 October 2025.

Who accredits ISO 27001 certification bodies in the UAE?

The Emirates International Accreditation Centre (EIAC). Bodies accredited by other IAF-member accreditation bodies are also recognised internationally.

Talk to Softworx Services in Dubai

Asked for ISO 27001 and not sure where the technical gaps are? Talk to the Softworx Services team about the controls your ISMS needs.

Sources

• ISO/IEC 27001:2022, International Organization for Standardization: https://www.iso.org/standard/27001
• IAF MD 26, Transition requirements for ISO/IEC 27001:2022, International Accreditation Forum: https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf
• Emirates International Accreditation Centre, certification bodies accreditation: https://eiac.gov.ae/services/certification-bodies/
• UAE Information Assurance Standard, UAE Cyber Security Council: https://csc.gov.ae/en/w/uae-information-assurance-standard
• ISACA Journal, “Navigating the ISO/IEC 27001:2022 Transition” (Annex A themes and counts): https://www.isaca.org/resources/isaca-journal/issues/2024/volume-3/navigating-the-iso-iec-27001-2022-transition-a-90-day-challenge
• TÜV Rheinland UAE, ISO 27001 certification process and certificate cycle: https://www.tuv.com/united-arab-emirates/en/iso-27001-certification.html

Good cyber security for Dubai businesses starts with ten controls, done in order: an asset list, multi-factor authentication, a properly managed firewall, patching, no everyday admin rights and tested backups, followed by separate networks for guests and devices, phishing awareness, controls on supplier access and a one-page incident response plan.

This guide is for owners, office managers and the one stretched IT person at a Dubai SME or mid-size business with no dedicated security team. Perhaps you have had a phishing scare, a client security questionnaire or a question from an insurer. Each control below has a “done when” test, so you know when to move on.

Key takeaways

• Most attacks on smaller firms exploit stolen passwords, unpatched systems and over-privileged accounts. The first six controls deal with those.
• Each control has a clear finish line. “Done when” beats “in progress”.
• The UAE Information Assurance Standard is mandatory for government and critical infrastructure, but clients and contracts increasingly ask other firms for the same basics.
• The list lines up with the CIS Controls Implementation Group 1, the international “essential cyber hygiene” baseline.
• Spread the work over three months and give every control an owner.

Do Dubai businesses have to follow a national cyber standard?

The UAE Information Assurance (IA) Standard, issued by the UAE Cyber Security Council (version 2.1, November 2025), sets security controls for government entities and organisations that run critical information infrastructure. It replaced the UAE IA Regulation v1.1 published by TDRA in 2020, which grew out of the earlier NESA standards and is still often called “NESA”. In Dubai, the Dubai Electronic Security Center (DESC) also publishes its own Information Security Regulation and standards for Dubai government entities, which often reach suppliers through contracts.

Other businesses may be asked to meet parts of these by clients, contracts or their sector regulator, so check which applies to you. The Council states that the IA Standard aligns with ISO/IEC 27001, NIST SP 800-53 and the CIS Controls. That’s useful: the basics below are good practice under all of them, whether or not you are formally bound.

What are the first 10 controls to put in place?

1. Know what you have

You can’t protect what you don’t know about. List every laptop, phone, server, network device and cloud service, the accounts that use them and the important data each holds. Include the forgotten things: the old NAS in the comms cupboard, the shared admin login, the former employee’s mailbox that still forwards to a personal address.

Done when: you have one current list, with an owner for each item and a person responsible for keeping it up to date.

2. Multi-factor authentication on email and admin accounts

Many break-ins start with a stolen or guessed password. Multi-factor authentication (MFA) asks for a second proof, such as an app prompt or a hardware key, so a password alone isn’t enough. Start with email, then every admin account, remote access, the firewall’s management login and finance systems. Avoid SMS codes where an app or key is available.

Done when: MFA is enforced, not optional, for all email and admin accounts, and there’s a documented process for lost devices.

3. A properly managed firewall at the office edge

A firewall controls what traffic gets in and out. The router your internet provider supplied isn’t the same thing. A business firewall that is kept up to date, configured with documented rules and actually monitored is one of the most valuable controls you can have. The brand matters less than the care it gets; our guide to choosing between Cisco, Aruba and Fortinet explains how to decide.

Done when: a supported business firewall is in place, its firmware is current, management access is restricted and uses MFA, its rules are documented and someone is responsible for reviewing alerts.

4. Patching and supported software only

Attackers routinely target known weaknesses in out-of-date software and network equipment. Turn on automatic updates where you can, set a monthly routine for the rest, and replace anything that is out of vendor support, including old switches, Wi-Fi access points and VPN appliances.

Done when: every item on your asset list is supported and has a patch schedule, and urgent fixes for internet-facing systems are applied within days, not months.

5. Least privilege: no everyday admin rights

If staff browse and read email with admin rights, any malware they open gets admin rights too. Give people only the access they need, and keep separate admin accounts for admin tasks.

Done when: nobody uses an admin account for day-to-day work, and access is reviewed whenever people join, move or leave.

6. Backups you have tested restoring

A backup you have never restored is a hope, not a plan. Follow a simple rule: several copies, on different media, with at least one copy offline or immutable so ransomware can’t reach it. Remember cloud services: Microsoft 365 and similar platforms don’t replace your own backup of business-critical data.

Done when: you have restored a real file and a real system from backup and written down how long it took.

7. Separate guest, staff and device networks

Guests, staff laptops, printers, CCTV and meeting-room kit don’t need to see each other. Splitting them onto separate virtual networks (VLANs), with firewall rules between them, limits how far an attacker or a compromised device can reach. This is easiest to build in during a move; see our guide to office Wi-Fi and cabling for a Dubai fit-out.

Done when: guest Wi-Fi can’t reach internal systems, and cameras, printers and AV kit sit on their own segments.

8. Staff phishing awareness

People are a strong line of defence when they know what to look for and feel safe reporting mistakes. Short, regular training on spotting phishing and invoice fraud, plus a one-click way to report suspicious emails, goes a long way. Add a rule that any change to supplier bank details is confirmed by phone on a known number.

Done when: every member of staff has had training this year, and everyone knows how to report a suspicious email without fear of blame.

9. Supplier and third-party access control

IT providers, software vendors and contractors often have remote access to your systems. Know who they are, give them only what they need, require MFA and remove access when the work ends. International cyber agencies, led by CISA, published joint guidance in 2022 on exactly this risk with managed service providers.

Done when: you have a list of every third party with access, and each one is limited, protected with MFA and reviewed at least twice a year.

10. A one-page incident response plan

When something goes wrong, people need to know who decides, who to call and what to do first. One page that people can find in a hurry is better than a binder no one reads. Include your IT provider’s emergency contact, your insurer, and who talks to clients.

Done when: the plan names who to call internally and externally, what to isolate first and who handles communication, and you have walked through it once as a table-top exercise.

How do these map to the UAE IA Standard?

The table shows where each control broadly sits in the UAE IA Standard’s control families. It is a guide to help you talk to clients or auditors, not a formal compliance mapping.

Control	Indicative UAE IA Standard family (names per v1.1)
1. Asset list	T1 Asset Management
2. MFA	T5 Access Control
3. Managed firewall	T4 Communications (network security)
4. Patching	T7 Information Systems Acquisition, Development and Maintenance (technical vulnerability management)
5. Least privilege	T5 Access Control
6. Tested backups	T3 Operations Management (backup)
7. Network segmentation	T4 Communications (network security)
8. Phishing awareness	M3 Awareness and Training
9. Supplier access	T6 Third Party Security
10. Incident response plan	T8 Information Security Incident Management

Family names are taken from the UAE IA Regulation v1.1 published by TDRA; version 2.1 keeps the same 15-family structure of six management and nine technical families.

What should I do first if I have no security team?

Spread the work over three months so it actually happens, and give each month a named owner.

Month	Controls	Typical owner
1	Asset list, MFA on email and admin accounts, remove everyday admin rights	Operations lead with IT provider
2	Firewall review, patch routine, separate guest and device networks, backup restore test	IT provider or network partner
3	Phishing training, supplier access review, incident plan and table-top walk-through	Management with IT

Firewall configuration and network segmentation are where a specialist partner tends to save the most time, because getting them wrong can either leave gaps or break things people rely on. If you prefer someone else to watch alerts and keep things patched, compare managed network services with in-house IT.

What drives the cost?

We won’t quote prices without seeing your setup, but the main cost drivers are predictable: the number of users and devices, how many sites you have, whether your firewall and switches are still supported, how much of your estate is in the cloud, and whether you want monitoring out of hours. Fixing configuration usually costs far less than replacing hardware, so start with a review before buying anything.

Common mistakes

• Buying tools before knowing what you have. Without an asset list, new tools protect half the estate.
• Optional MFA. If it is optional, the accounts attackers want are the ones without it.
• Untested backups. Many businesses discover during an incident that backups were failing or too slow to restore.
• One flat network. A single compromised printer or camera can see everything.
• No owner. Controls without a named owner quietly decay.

If personal data is involved, these controls are also the practical core of UAE PDPL compliance.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach. Our Cyber & Compliance and Networks teams work with vendors including Palo Alto, Fortinet, Cisco and HP Aruba, and our Dubai office is at Saaha Offices, Downtown Dubai. We can help you put the technical controls on this list in place, from firewalls and MFA to network segmentation and backup design.

Frequently asked questions

Is cyber security a legal requirement for Dubai businesses?

It depends on your sector, clients and contracts. Government entities and critical infrastructure must follow the UAE IA Standard, and Dubai government suppliers may meet DESC requirements through their contracts. If you handle personal data, the PDPL requires appropriate security measures.

What is the minimum cyber security a small business in Dubai should have?

At least MFA on email and admin accounts, a supported and managed firewall, patching, no everyday admin rights and tested backups. Those five deal with the most common ways smaller firms are attacked.

What does MFA mean and do I need it?

Multi-factor authentication asks for a second proof of identity on top of a password, such as an app prompt. Yes: turn it on for email, remote access and every admin account.

How often should backups be tested?

Test restores on a regular schedule, and after any significant change to your systems. Record how long the restore took, because that is how long you will be down.

Is the UAE IA Standard the same as NESA?

Broadly, yes. The current UAE IA Standard is issued by the UAE Cyber Security Council and descends from the earlier NESA standards, so many people still call it NESA.

Talk to Softworx Services in Dubai

Want a second pair of eyes on where to start? Talk to the Softworx Services team about your current setup and the controls that matter most for your business.

Sources

• UAE Information Assurance Standard, UAE Cyber Security Council: https://csc.gov.ae/en/w/uae-information-assurance-standard
• UAE Information Assurance Regulation v1.1, TDRA (control families): https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/UAE-Information-Assurance-Regulation-v1-1-pdf.ashx
• Dubai Electronic Security Center, regulations and standards: https://www.desc.gov.ae/
• CIS Critical Security Controls, Implementation Group 1: https://www.cisecurity.org/controls/implementation-groups/ig1
• CISA and partners, “Protecting Against Cyber Threats to Managed Service Providers and their Customers” (AA22-131A): https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
• Federal Decree-Law No. 45 of 2021 (PDPL), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972

UAE PDPL compliance is no longer a future project. The UAE’s federal data protection law, the PDPL (Federal Decree-Law No. 45 of 2021), has been in force since 2 January 2022 and applies to most businesses that handle personal data in the UAE, plus many abroad that handle data about people here. What is still missing is the detail: at the time of writing, the Executive Regulations and the Cabinet decision on penalties have not been published.

This guide turns the law into practical IT work for SMEs and mid-size businesses: what to change, what evidence to keep and a 90-day plan.

This article is general information, not legal advice. Speak to a qualified UAE lawyer about your own obligations.

Key takeaways

• The PDPL has applied since 2 January 2022. Once the Executive Regulations are issued, businesses get six months to comply, and the Cabinet can extend that (Article 29).
• It reaches businesses outside the UAE that process personal data of people in the UAE.
• DIFC and ADGM have their own data protection laws. Most other free zones, including DMCC, DSO and JAFZA, fall under the PDPL.
• There is no fixed PDPL breach deadline yet. The “72 hours” often quoted online is not in the law.
• The law already asks for appropriate security measures, processor contracts, records of processing and a way to report breaches. All of that is IT work you can start now.

What is the UAE PDPL, and is it in force?

The Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. It was issued on 20 September 2021 and took effect on 2 January 2022, according to the official UAE Legislation portal, which lists it as active.

The law sets out principles and obligations, but it leaves a lot of operational detail to Executive Regulations: breach notification timing, the approved cross-border transfer mechanisms and the thresholds for appointing a Data Protection Officer. Fines are left to a separate Cabinet decision. Neither had been published at the time of writing.

Who regulates it?

The UAE Data Office was set up under Federal Decree-Law No. 44 of 2021 as the PDPL regulator. On 14 June 2026, the UAE announced the Artificial Intelligence and Data Authority, which reports directly to the Cabinet. According to the Emirates News Agency (WAM), it brings together the functions of the UAE Data Office, the Office of Artificial Intelligence, Digital Economy and Remote Work Applications, and the digital government sector of the Telecommunications and Digital Government Regulatory Authority (TDRA). How the new authority will supervise and enforce the PDPL has not yet been set out.

Does the PDPL apply to my business?

In most cases, yes. Article 2 covers controllers and processors based in the UAE, whether the people whose data they handle are inside or outside the country. It also reaches controllers and processors outside the UAE that process personal data of people in the UAE. A company with a head office in London or Glasgow and staff or customers in Dubai should assume it is in scope.

What about free zones?

Free zone companies are not automatically exempt. The exclusion only covers free zones with their own data protection legislation. In practice that means the DIFC (DIFC Data Protection Law No. 5 of 2020) and ADGM (Data Protection Regulations 2021), plus health data in Dubai Healthcare City. Most other free zones, such as DMCC, DSO and JAFZA, follow the PDPL.

What is excluded?

Government data and entities, security and judicial authorities, and purely personal use are excluded. Health and banking data are excluded only where their own legislation regulates them, so a clinic or finance firm is usually still under the PDPL for data such as employee records.

What does the PDPL ask of your IT and security setup?

The law describes outcomes, not products. Nobody can sell you “a PDPL firewall”. The table below turns each obligation into the IT work behind it and the evidence that shows it is working.

PDPL obligation	What it means in IT terms	Evidence to keep
Security of processing (Art. 20): appropriate technical and organisational measures, with examples such as encryption and pseudonymisation	MFA, device and data encryption, network segmentation, a managed firewall, patching, tested backups, regular security testing	Configuration records, restore test results, test reports
Breach notification (Art. 9): tell the regulator, and affected people, about a breach that could harm their privacy or security; processors tell the controller	Logging and monitoring that can detect a breach; a written incident response plan	Log retention settings, incident plan, incident register
Processors: use processors that give sufficient guarantees, under a contract	Data processing agreements (DPAs) with cloud, managed service and SaaS providers	Signed DPAs and a supplier register
Records of processing	An inventory of systems, data types and where each is held	Data and system inventory
DPO and impact assessments for high-risk processing (Art. 10)	Spot high-risk processing: new technology, large volumes, sensitive data	Assessment notes; DPO decision
Cross-border transfers (Arts. 22–23)	Know which countries your data is stored in or accessed from	Data location map, supplier hosting regions

Expect some detail to change once the Executive Regulations set security standards, DPO thresholds and transfer mechanisms. The evidence column is what you will show a client, auditor or regulator who asks.

A worked example: a 60-person trading company in JAFZA

Picture Microsoft 365, a cloud CRM hosted in Europe, an on-site file server, Teams for calls and an outsourced IT provider with remote access. That business would:

1. list each system, the personal data in it and where it is hosted;
2. get a signed data processing agreement from each provider, including the IT provider;
3. record that CRM and email data leave the UAE, and the transfer basis relied on;
4. enforce MFA on Microsoft 365, the CRM and the IT provider’s remote access;
5. back up the file server with a copy ransomware can’t reach, and test a restore;
6. write down who decides and who notifies if a laptop is lost or a mailbox is compromised.

None of this depends on the Executive Regulations.

Is there a 72-hour breach deadline?

Not under the PDPL, at least not yet. Article 9 requires notification but sets no fixed deadline; the timing is left to the Executive Regulations. The free zone regimes are different:

• ADGM expects notification to its Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• DIFC expects notification as soon as practicable in the circumstances.

Either way, be able to detect, assess and report a breach quickly: searchable logs, alerts that reach a person and a named decision-maker.

Do we have to keep data in the UAE?

Not as a general PDPL rule. The law controls cross-border transfers rather than banning them. Transfers are allowed to countries with adequate protection, or through safeguards such as contracts and consent; the approved mechanisms and any adequacy list are still pending.

There are important exceptions outside the PDPL. Under Federal Law No. 2 of 2019 on the use of ICT in health fields, health data generally must be stored and processed inside the UAE, with limited exceptions set by ministerial resolution. Some sector regulators, government contracts and licence terms may also require local hosting. Check your contracts and sector rules before you pick a cloud region.

Don’t forget phones, Teams and call recordings

Personal data isn’t only in your CRM and file shares. Call recordings, voicemail, meeting recordings and transcripts are personal data too. If your phone system or contact centre records calls, the PDPL applies to where those recordings are stored, who can access them, how long you keep them and which processors handle them.

Recording a call without consent can also be a criminal offence under UAE law, separate from the PDPL. Our guide to choosing a business phone system in the UAE covers recording consent and what to ask suppliers, and our comparison of cloud and on-premise contact centres covers where contact centre data can live.

What should an SME do first? A 90-day plan

You don’t need to wait for the Executive Regulations. Most of the work below is good security practice that the law already points to, and it lines up with the first 10 cyber security controls for Dubai businesses.

Days 1 to 30: know what you have
- List systems, devices, cloud services and the personal data each holds.
- Record where each service is hosted and who your processors are.
- Enforce multi-factor authentication on email and every admin account.

Days 31 to 60: lock down and back up
- Remove everyday admin rights and review who can access what.
- Review firewall rules and separate guest, staff and device networks.
- Test a restore from backup and write down how long it took.
- Request data processing agreements from cloud, managed service and SaaS suppliers.

Days 61 to 90: prepare for the bad day
- Write a one-page incident response plan: who decides, who notifies, who fixes.
- Check logging captures enough to investigate an incident, and that logs are kept long enough.
- Schedule regular security testing and keep the reports.
- Decide whether any processing is high-risk and needs an impact assessment.

If a client or tender is also asking for a recognised certification, the same inventory, risk work and controls feed straight into ISO 27001.

Common mistakes

• Waiting for the regulations. The six-month window starts when they are issued. Building an inventory, signing DPAs and fixing access control takes longer than that in most firms.
• Forgetting the IT provider. Your managed service provider almost certainly processes personal data on your behalf and needs a contract that says so.
• Quoting fines, deadlines or decision numbers from blogs. If it can’t be traced to the UAE Legislation portal or the Official Gazette, don’t rely on it.

How Softworx Services helps

Softworx Services is a systems integrator and network services provider with a technology-led, vendor-agnostic approach, working with vendors including Palo Alto, Fortinet, Cisco and HP Aruba. From our Dubai office at Saaha Offices, Downtown Dubai, our Cyber & Compliance and Networks teams can review your network, firewall, access and backup setup against the security measures the PDPL points to, and help put the technical controls in place.

We don’t give legal advice, and no technology on its own makes a business “PDPL compliant”. That also takes your own policies, contracts and legal advice.

Frequently asked questions

Is the UAE PDPL in force?

Yes. Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022. Its Executive Regulations and the Cabinet decision on penalties had not been published at the time of writing.

Does the PDPL apply to companies outside the UAE?

Yes, if they process personal data of people in the UAE (Article 2). A foreign head office that handles UAE staff or customer data should assume it is in scope.

Are free zone companies exempt from the PDPL?

Only those in free zones with their own data protection law: DIFC and ADGM, plus DHCC for health data. Most free zones, including DMCC, DSO and JAFZA, fall under the PDPL.

What is the PDPL breach notification deadline?

There is no fixed deadline yet; it is left to the Executive Regulations. Notify the regulator and affected people when a breach could harm their privacy or security, and have a plan that lets you do that quickly.

Do we need to host our data in the UAE?

Not as a general PDPL rule. Health data generally must stay in the UAE under the health ICT law, and some sector rules and contracts require local hosting.

Do we need a Data Protection Officer?

The PDPL requires one for certain high-risk processing, such as large volumes of sensitive data or new technologies (Article 10). The exact thresholds are still to be set.

Talk to Softworx Services in Dubai

Not sure where your network, cloud or phone setup stands against the PDPL? Talk to the Softworx Services team in Dubai for a vendor-agnostic review of your technical controls.

Sources

• Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972
• PDPL full text (download), UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1972/download
• “Mohammed bin Rashid approves establishing Artificial Intelligence and Data Authority”, WAM, 14 June 2026: https://www.wam.ae/en/article/c0pz7ku-mohammed-bin-rashid-approves-establishing
• Dubai Media Office announcement, 14 June 2026: https://mediaoffice.ae/en/news/2026/june/14-06/mohammed-bin-rashid-approves-establishing-artificial-intelligence-and-data-authority
• ADGM Office of Data Protection, personal data breach notifications: https://www.adgm.com/operating-in-adgm/office-of-data-protection/data-breach-notifications
• DIFC Data Protection Law No. 5 of 2020: https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/laws–regulations/data-protection-law.pdf
• Federal Law No. 2 of 2019 on the use of ICT in health fields, UAE Legislation portal: https://uaelegislation.gov.ae/en/legislations/1209/download
• Chambers Data Protection & Privacy 2026, UAE trends and developments: https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/uae/trends-and-developments/