--- title: "UAE Technology Regulations for Businesses: Guide | Listonics" description: "A plain-English map of UAE technology rules for businesses: TDRA, SIRA, data protection, e-invoicing, DIFC and ADGM, with links to every official source." canonical: "https://listonics.com/guides/uae-business-technology-regulations-guide/" source: listonics.com --- Nov 06, 2026 · 18 min read · By [Srinivasan Ramachandran](https://listonics.com/about/#author) # UAE technology rules for businesses: which regulator covers what for your IT Seven regulators touch an ordinary office's IT in the UAE. This map shows who covers what, what it means, and where the official source is. Quick answer Most UAE technology rules that touch an ordinary business come from a handful of bodies: TDRA for telecoms equipment, IoT and internet calling, SIRA for CCTV in Dubai, the federal data protection law for personal data, the Ministry of Finance for e-invoicing, and DIFC or ADGM where a firm sits in those zones. This guide maps each one to the IT decisions it affects. Key takeaways - Telecoms equipment sold in the UAE needs TDRA type approval, and a business that runs a commercial IoT service may need TDRA IoT registration as well. - CCTV in Dubai is regulated by SIRA, so installation and approval go through a SIRA-approved contractor rather than any IT company. - The federal Personal Data Protection Law applies on the mainland, while DIFC and ADGM run their own data protection regimes. - E-invoicing is run by the Ministry of Finance through accredited service providers, and it changes how billing systems produce invoices. - Each official page is the live source. Use this map to find the right one, then check the current wording before you act on it. ## Why does a UAE business need a map of technology rules? A business needs a map because the rules that touch its IT are spread across several regulators, and no single page lists them together. An office manager buying cameras, a founder setting up a phone system, a farm installing sensors and a finance team choosing an invoicing tool will each meet a different authority, often without knowing it applies until a supplier or an auditor asks. The cost of finding out late is usually small but annoying: a device that cannot be connected, a camera system that has to be redone, or a project paused while paperwork catches up. This guide is that map. For each regulator it covers what the body is responsible for, the IT decisions that fall under it, and a link to the official page that holds the current rules. It is written for owners and office managers rather than lawyers, and it is not legal advice. Where a rule is detailed or changes often, the right move is to read the official page directly, and this guide tells you which page that is. We wrote it because these questions come up in our own project work across [network, IoT, security and software](https://listonics.com/services/cybersecurity/) jobs in Dubai and the wider UAE. The same handful of questions repeat: does this device need approval, who is allowed to install cameras, where does our data sit, and what does e-invoicing ask of our system. Answering them once, with sources, is more useful than answering them one project at a time. ## The regulators at a glance The short version is that five federal or emirate-level bodies, plus two financial free zones, cover almost everything an ordinary business meets. The table below lists each one with the area it covers and the IT decision it usually affects. The sections after it explain each row in more detail, with the official source for every claim. Two points help when reading it. First, a business can fall under more than one row at once: a clinic in Dubai with cameras, a patient database and an invoicing system meets SIRA, the data protection law and the Ministry of Finance in the same year. Second, most of these rules put the paperwork on the supplier or the installer, not the business, so the practical job for the business is often to ask the right question before buying. | Regulator | What it covers for a business | IT decision it affects | | --- | --- | --- | | TDRA | Telecoms equipment approval, IoT service registration, internet calling, satellite licences | Buying routers, radios and sensors; running IoT; choosing a phone system; Starlink | | SIRA (Dubai) | Security systems, including CCTV | Who installs and approves your cameras | | Federal data protection law | Personal data on the mainland | Where data is stored, who can see it, consent records | | Ministry of Finance | E-invoicing through accredited service providers | Which accounting or billing system you use | | UAE Cyber Security Council | National cybersecurity guidance | Baseline security controls | | DIFC | Its own data protection law for firms in the centre | Microsoft 365 setup, data location, records | | ADGM | Its own regulations for firms in Abu Dhabi Global Market | Same questions as DIFC, under ADGM rules | ## What does TDRA regulate that affects your office IT? TDRA regulates telecommunications and digital services across the UAE, and for an ordinary business it shows up in four places: equipment approval, IoT registration, internet calling and satellite internet. [The Telecommunications and Digital Government Regulatory Authority](https://tdra.gov.ae/) is a federal body, so its rules apply in every emirate and in the free zones. ### Type approval for telecoms equipment Any radio or telecoms device sold for use in the UAE, from a Wi-Fi access point to a wireless microphone or a LoRaWAN gateway, needs TDRA type approval. TDRA's page on how to [register and approve telecommunication equipment](https://tdra.gov.ae/en/Services/register-and-approve-telecommunication-equipment) sets out the process. Approval is the supplier's job, not the buyer's, so the practical step for a business is to buy from a UAE distributor and, for anything unusual, ask for the device's registration certificate before ordering. Equipment bought abroad and carried in may be the wrong frequency variant or simply not approved, which is how a perfectly good device ends up unusable here. ### Registration for IoT services A business that provides a commercial Internet of Things service may need to register it with TDRA. The [TDRA IoT services registration](https://tdra.gov.ae/en/Services/internet-of-things-services-registration) page describes the service, which produces an approval certificate for the applicant and asks for details including a network connection diagram. This matters for cold-chain monitoring, smart farms, building sensors and similar projects. Our step-by-step [TDRA IoT registration guide](https://listonics.com/blog/tdra-iot-registration-dubai/) explains when it applies and what to prepare, and on our [IoT projects](https://listonics.com/services/iot/) we handle that step where it is needed. ### Internet calling and Teams Internet calling is regulated under TDRA's [VoIP regulatory policy](https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/Voice-over-internet-protocol-Regulatory-policy-pdf.ashx), version 2.0, issued in 2009. Separately, a [TDRA statement](https://tdra.gov.ae/en/media/tdra-statements/statement-by-telecommunications-regulatory-authority) lists applications available on UAE networks and names Microsoft Teams first. The statement says the list was made available exceptionally and until further notice, and that TDRA reviews it from time to time. In practice, a Teams meeting and a call to an ordinary phone number are two different questions, which our page on [Microsoft Teams in the UAE](https://listonics.com/microsoft-teams-uae/) explains in full. ### Satellite internet and Starlink TDRA has [granted Starlink a licence](https://tdra.gov.ae/en/media/press-release/2026/new-press-release) to operate a public satellite communications network and provide broadband satellite internet in the UAE. The press release says the scope reaches businesses and government entities as well as consumers, and names maritime and aviation connectivity. For a business this means Starlink is now a legitimate second line or remote-site connection rather than a workaround, which our [Starlink installation guide](https://listonics.com/blog/starlink-installation-dubai/) covers in practical detail. ## Who regulates CCTV in Dubai, and why does it change who installs it? In Dubai, security systems including CCTV are regulated by [the Security Industry Regulatory Agency (SIRA)](https://www.sira.gov.ae/en/home). The consequence for a business is that the regulated parts of a camera job, the installation and the approval of the system, are carried out through a contractor SIRA has approved. A system put in by someone without that approval can leave a business with cameras it has paid for but cannot rely on when an inspection or an incident comes. This is one of the most common surprises we see. A business asks its IT company to add cameras because the cameras sit on the network, and the IT company is happy to do it. The network side is genuinely IT work: the cabling, the switches, the power over Ethernet, the recorder's storage and the secure remote access. The camera installation and approval, though, belong to a SIRA-approved contractor. On our [CCTV and access control](https://listonics.com/cctv-access-control-installation-dubai/) projects, Listonics designs and builds the network the system depends on, and a SIRA-approved partner carries out the regulated installation. Other emirates have their own arrangements for security systems, so a business outside Dubai should check with the relevant local authority. The questions to ask any provider are the same everywhere: who carries out the regulated part, what approval the system will have at the end, and who keeps the documentation. ## How does UAE data protection law affect your systems? On the mainland, personal data is governed by the federal Personal Data Protection Law, Federal Decree Law No. 45 of 2021. The UAE government's summary of [data protection laws](https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws) explains companies' duties to keep personal data secure and confidential, people's rights over their data, and the rules on transferring it outside the country. Every business that holds customer, staff or patient records is affected, whatever its size. For IT, the law turns into a small number of concrete questions. Where is the data stored, in which system and in which country? Who can see it, and is that limited to the people who need it? How is consent recorded, for marketing messages in particular? Can a record be exported or deleted when someone asks? And what happens to data on a laptop that leaves the business? None of these needs a lawyer to answer, but each needs someone who knows how the systems are configured. The law also matters when choosing tools. A CRM, an HR system or an AI assistant that cannot say where its data sits, or cannot export it, is a risk under any data protection regime. The same applies to staff pasting customer details into public AI tools, which is why we recommend a short written policy, as set out in our guide to a [workplace AI policy](https://listonics.com/blog/chatgpt-workplace-policy-small-business-uae/). ## What do DIFC and ADGM add for firms based there? DIFC and ADGM are financial free zones with their own legal systems, and each runs its own data protection regime on top of, or in place of, the federal rules. [DIFC publishes its laws and regulations](https://www.difc.com/business/laws-and-regulations), including its Data Protection Law, and [Abu Dhabi Global Market](https://www.adgm.com/) publishes its own regulations for firms registered there. A firm in either zone should treat its zone's rules as the primary reference for personal data. In IT terms the same questions apply as on the mainland, asked with more precision: where Microsoft 365 data is hosted, who has administrator access, how long records are kept, and how a request from a data subject is handled. Our [Microsoft 365 guide for DIFC firms](https://listonics.com/guides/microsoft-365-for-difc-firms-guide/) works through those settings in detail. For the IT provider, the practical duty is to configure the tenant so that data location and access are known, controlled and documented, because those are the facts any compliance conversation turns on. Firms in other free zones, such as DMCC, Dubai Internet City or Dubai Silicon Oasis, generally follow the federal data protection law unless their zone states otherwise. When in doubt, the free zone's own business support team is the right first contact. ## What does e-invoicing ask of your accounting and billing systems? E-invoicing is run by the Ministry of Finance, and it changes invoices from documents into structured data exchanged through an accredited service provider and reported to the Federal Tax Authority. The ministry's [e-invoicing programme page](https://mof.gov.ae/en/about-us/initiatives/einvoicing/) states that a PDF, a Word file, a scan or an image is not an e-invoice, and it describes itself as the only official source on the subject. For a business, the IT consequence is that the accounting or billing system must produce invoices in the required format and connect to an accredited provider. The ministry keeps a [register of accredited service providers](https://mof.gov.ae/en/about-us/initiatives/einvoicing/einvoicing-accredited-service-providers-asps/), and the rollout is phased by business size under Ministerial Decision No. 244 of 2025 and later amendments. Custom billing tools, spreadsheets and old accounting packages are where the work usually lands. The dates and phases have been refined more than once, so confirm your own phase on the ministry page rather than relying on any summary. Our [e-invoicing IT readiness guide](https://listonics.com/guides/uae-e-invoicing-it-readiness-guide/) covers the systems side in full: what to check in your accounting package, what a custom system needs, and how to plan the change without a last-minute scramble. ## Is there a national cybersecurity standard a small business must follow? For most private small businesses there is no single mandatory cybersecurity certificate, but there is national guidance worth following. [The UAE Cyber Security Council](https://csc.gov.ae/) publishes guidance and sets national direction, and regulated sectors such as finance and health have their own requirements through their regulators. A business in a regulated sector should start with its own regulator's rules. For everyone else, recognised frameworks give a workable baseline. [The NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) is a widely used structure for thinking about security, and [the CIS Critical Security Controls](https://www.cisecurity.org/controls) list specific, prioritised controls. In practice the controls that matter most for a small office are the same everywhere: multi-factor sign-in on every account, managed and updated devices, tested backups, and staff who know how to spot a phishing message. These basics also support the data protection duties above. Keeping personal data secure is a legal obligation, and the controls that stop attackers are the same ones that keep customer records safe. Our [small office cybersecurity guide](https://listonics.com/guides/small-office-cybersecurity-uae-guide/) sets out the order to put them in place. ## A practical checklist: which rules apply to your next project? The quickest way to use this map is to start from the project, not the regulator. Work down the list below and note every line that applies. Each one points to the body and the question to ask before you buy or build. - Buying Wi-Fi, radios, sensors, gateways or wireless microphones: ask the supplier to confirm TDRA type approval, and buy through a UAE distributor. - Running a commercial IoT service, such as remote monitoring for clients or sites: check whether TDRA IoT registration applies before launch. - Choosing a phone system or internet calling: check what TDRA's VoIP policy and current statement mean for the calls you need to make. - Adding Starlink or another satellite link: use a licensed service and plan the router and failover setup properly. - Installing or extending CCTV in Dubai: use a SIRA-approved contractor for the installation and approval. - Holding customer, staff or patient data: map where it is stored, who can access it, and how consent is recorded. - Based in DIFC or ADGM: treat your zone's data protection rules as the main reference. - Issuing invoices to other businesses: confirm your e-invoicing phase and check your accounting system can connect to an accredited provider. - In a regulated sector such as finance or health: start from your sector regulator's technology requirements. If more than two lines apply, it is worth planning them together. A clinic fit-out, a new warehouse or a farm project often meets three or four of these at once, and handling them in one plan is cheaper than discovering them one at a time. ### Worked example: a clinic opening in Dubai A new clinic usually meets four of these rules in its first month. Its cameras fall under SIRA, so the CCTV installation and approval go through an approved contractor while the IT team builds the network and recorder storage. Its patient records are personal data, so the practice management system must keep data secure, limit access by role and be able to say where records are stored. Its health regulator will have its own requirements for clinical systems, which come first. And once its phase arrives, its invoices to insurers and other businesses move to e-invoicing through an accredited provider. Planned together, these fit into one fit-out schedule: the network and cabling go in with the cameras, the clinical system is chosen with data location and e-invoicing in mind, and the access rules are written before staff start. Planned separately, the same clinic can end up re-cabling for cameras or replacing a billing tool a year after opening. ### Worked example: a farm adding sensors and Starlink A farm in Al Ain, Liwa or Ras Al Khaimah installing greenhouse sensors, a LoRaWAN gateway and a Starlink link meets TDRA three times. The gateway and sensors need type approval, which the supplier should confirm before shipping. Starlink is now licensed, so the connection itself is straightforward, but the router, power and failover still need planning for heat and dust. If the farm or its contractor provides the monitoring as a commercial service to other growers, TDRA IoT registration may apply as well. If the farm adds cameras for perimeter security, SIRA rules apply in Dubai, and the relevant local authority elsewhere. The data side is lighter than at a clinic, but camera footage of people and vehicles is still personal data, so retention and access should be agreed at the start. ### Worked example: a startup in a free zone A ten-person startup in a free zone usually meets the data protection rules and e-invoicing first. If it sits in DIFC or ADGM, its zone's data protection rules are the main reference and its Microsoft 365 tenant should be set up with data location and administrator access documented from day one. Elsewhere, the federal law applies. Its phone system raises the TDRA calling question, and its customer database raises the consent question, especially if it plans to message customers on WhatsApp. The low-cost habit for a startup is to record these decisions as it makes them: which tenant region, who has admin rights, how consent is captured, and which accounting system will handle e-invoicing. That record is what investors, auditors and regulators ask for later, and it is far easier to write on day one than to reconstruct after two years of growth. ### Worked example: a warehouse with cold storage A warehouse in Jebel Ali or Dubai South adding cold-room temperature monitoring, handheld scanners and cameras meets most of this map in one project. The scanners, access points and wireless sensors need TDRA type approval, which a UAE distributor should already have. If the warehouse monitors temperatures for its clients and reports to them as a service, TDRA IoT registration is worth checking before launch, and the registration asks for a network connection diagram, so the network design needs to be documented anyway. The cameras fall under SIRA in Dubai, so they go through an approved contractor while the IT side covers the switches, recorder and remote access. Staff records, driver details and client contacts are personal data under the federal law, or the free zone's rules where they differ. And invoices to clients move to e-invoicing in the warehouse's phase, which usually means checking that the warehouse management or accounting system can connect to an accredited provider. One plan, written at the start, covers all of it. ## How should you keep up when these rules change? The safest habit is to treat every official page as the live version and every guide, including this one, as a snapshot. Regulators update their pages without much notice: TDRA reviews its list of permitted calling apps from time to time, the e-invoicing phases have been amended, and free zones revise their regulations. A rule you read about last year may have moved. In practice that means three small routines. Before a project, open the relevant official page and read the current wording. When buying equipment or software, put the compliance question to the supplier in writing, so the answer is on record. And once a year, review where your data is stored and who has access, because that is the question most rules eventually come back to. It also helps to keep one short compliance note per system: the regulator it falls under, the official page, the date you last checked it, and the person responsible. For most small businesses that note fits on a single page, and it turns a scattered set of rules into something a new office manager can pick up in an afternoon. We review this guide when one of the sources it cites changes. If you spot a rule that has moved, or want help working out which of these applies to a project, [get in touch](https://listonics.com/contact/) and we will look at it with you. ## Frequently asked questions ### Does my business need TDRA approval to buy a Wi-Fi router? No, the buyer does not apply. TDRA type approval is the supplier's responsibility, and equipment sold through UAE distributors should already be approved. The practical step is to buy locally and, for unusual devices such as long-range radios or imported gateways, ask for the TDRA registration certificate before ordering. ### Can my IT company install CCTV cameras in Dubai? An IT company can build the network, cabling, power and remote access that cameras depend on. In Dubai, the regulated installation and approval of a CCTV system go through a contractor approved by SIRA, the Security Industry Regulatory Agency. Ask any provider who carries out that regulated part before you agree a quote. ### Which data protection law applies to my company? On the UAE mainland and in most free zones, the federal Personal Data Protection Law, Federal Decree Law No. 45 of 2021, applies. Firms in DIFC or ADGM follow their own zone's data protection rules instead. If you are unsure, check with your free zone's business support team and read the official summary. ### Is a PDF invoice an e-invoice under the UAE system? No. The Ministry of Finance states that a PDF, a Word file, a scan or an image is not an e-invoice. An e-invoice is structured data exchanged through an accredited service provider and reported to the Federal Tax Authority, so your accounting or billing system has to support that format. ### Do I need to register sensors I install in my own office? Not usually for sensors you use internally, but a business that provides a commercial IoT service to others may need TDRA IoT registration. The devices themselves still need type approval. Read TDRA's IoT registration page or our step-by-step guide to see whether your project counts as a service. ### Is Starlink legal for businesses in the UAE? Yes. TDRA has granted Starlink a licence to operate a satellite network and provide broadband satellite internet in the UAE, and its press release says the scope covers businesses and government entities as well as consumers. Use the licensed service and plan the installation and router setup properly. ### Is this guide legal advice? No. It is a practical map written by an IT company to help businesses find the right regulator and the right official page. For legal questions, read the official source and speak to a lawyer or your free zone's support team. For the IT side of any of these rules, we can help. Related service Cybersecurity Services Firewall, multi-factor authentication, endpoint protection and secure remote access, the essentials that stop most attacks on small and mid-size offices. [See the service](https://listonics.com/services/cybersecurity/) Written by [Srinivasan Ramachandran](https://listonics.com/about/#author), Founder, Listonics · Published Nov 06, 2026 · Last reviewed November 6, 2026 · 3523 words ## Read next Related guides from the same part of office IT. [All guides](https://listonics.com/guides/) [DIFC Data Protection Law: The IT Checklist for Firms](https://listonics.com/blog/difc-data-protection-law-it-checklist/) (Security): The IT side of DIFC Data Protection Law compliance: what to set up in Microsoft 365, access, backup and retention, in plain terms. [Do you have to register an IoT service with TDRA, and what does it involve?](https://listonics.com/blog/tdra-iot-registration-dubai/) (Devices): Most offices installing cameras or sensors never ask whether registration applies. It is cheaper to establish the answer first. [Microsoft 365 for DIFC firms: setup, security and keeping the regulator happy](https://listonics.com/guides/microsoft-365-for-difc-firms-guide/) (DIFC): A DIFC firm can run the same Microsoft 365 as any office, but a few settings turn it from a liability into something a regulator is comfortable with. ## Talk to an engineer about Cybersecurity services for your office. [Contact us](https://listonics.com/contact/) This page is general information for Dubai businesses, not a substitute for a professional assessment of your own setup. For advice specific to your office, [book a free assessment](https://listonics.com/contact/).