Zoho UAE Data Centres: Should You Move Your Data?

The Question You Could Not Answer Last Year

A Dubai company fills in a client security questionnaire. Question eleven: where is our data physically stored?

Until this year, a UAE business running Zoho answered that question by naming a data centre somewhere else. Usually that was fine. Occasionally it stalled a deal, triggered a follow-up from the client’s security team, or produced an awkward exchange with an auditor.

In January 2026 Zoho opened its first data centres in the UAE, in Dubai and Abu Dhabi. The answer is now available locally — and with it a decision every existing UAE Zoho customer has to make at some point: do we move?

Most of the coverage has been launch news. What it has not covered is the part that determines whether this is a straightforward project or a difficult one: Zoho data centre migration is handled by request rather than as a setting, integrations do not travel with your data, and a few products do not move at all.

This article covers what launched, what UAE law actually requires, when a move is justified, when it is not, and what breaks when you do it.

What Actually Launched

Zoho Corporation opened its first UAE data centres in Dubai and Abu Dhabi in January 2026.

Scale. The facilities host more than 100 cloud services across the Zoho and ManageEngine brands — among them Zoho CRM, Desk, CRM Plus, Books, Creator, Workplace and Zoho One. The launch forms part of a previously announced Dhs100m investment in Gulf cloud infrastructure.

Certification. The data centres hold a CSP Security Standard Certificate from the Dubai Electronic Security Center, along with ISO 27001, ISO 22301 and ISO 27017 certification and CSA STAR Level 2. For a security reviewer, that list matters more than the location itself — it is what turns “hosted in the UAE” into something evidenced rather than asserted.

What Zoho said. CEO Shailesh Davey framed the launch as enabling businesses to store their data locally and strengthening data sovereignty, linking it to the UAE’s National Cybersecurity Agenda.

One practical caveat. Not every Zoho application is available in every data centre region, and Zoho’s own documentation is explicit that an app unavailable in a target region will not migrate there. Before planning anything, confirm that every application you actually use is offered in the UAE region. This is the first check, not the last.

What UAE Law Requires — and What It Does Not

This is where businesses most often act on a belief rather than a requirement, so it is worth being precise.

There is no general data localisation requirement in UAE federal law. The headline instrument, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), does not oblige businesses at large to store personal data inside the UAE. Its Executive Regulations had not been issued at the time of writing, which means several mechanisms the law refers to — including the detail of cross-border transfer routes — are not yet fully operational.

But sector-specific rules are a different matter, and they are real.

• Health data. Under Federal Law No. 2 of 2019, health data may not be stored, processed, generated or transferred outside the UAE, except by decision of the Health Authority in coordination with the Ministry of Health and Prevention. For healthcare organisations this is a genuine localisation obligation, not a preference.
• Telecoms and IoT. The TDRA’s IoT policy requires certain categories of sensitive and confidential data to be held in the UAE unless equivalent protection applies abroad, and government data to remain in the UAE.
• Federal entities. Cabinet Resolution No. 21 of 2013 restricts external storage of data.

DIFC and ADGM are separate regimes. The PDPL does not apply to entities inside them. DIFC operates under Data Protection Law No. 5 of 2020 and ADGM under the Data Protection Regulations 2021, each with its own transfer rules. Transfers between the mainland and DIFC or ADGM are treated as cross-border transfers — a point that surprises groups operating across both.

What this means in practice. If you are a healthcare provider, a government supplier or a telecoms-adjacent business, local hosting may be an obligation. If you are a trading company, a professional services firm or a retailer, it almost certainly is not — which does not make it a bad idea, only a commercial decision rather than a compliance one. Know which of those you are before you start.

Techvaria is a Zoho implementation partner, not a legal or data protection adviser. The position summarised here is general and the regulatory picture is still developing. Confirm your specific obligations with your legal adviser, and watch for the PDPL Executive Regulations.

Four Reasons to Move That Hold Up

1. You have a genuine sectoral obligation. Health data is the clearest case. If the law requires your data to stay in the UAE, the decision is made for you and the only question is sequencing.
2. Your customers are asking. Government entities, banks, large regional corporates and public-sector tenders increasingly ask where data resides, and some weight the answer in evaluation. If you are losing or slowing deals on question eleven, local hosting has a direct commercial return — and that return is measurable, which makes it an easy business case.
3. Your own governance policy requires it. Some UAE groups have adopted internal data residency standards ahead of any legal requirement, often following a parent company policy or a board-level risk decision. A standard you have set yourself is still a standard you have to meet.
4. You are procuring now anyway. If you are selecting Zoho today, or rebuilding an existing deployment, choosing the UAE region at the outset costs nothing. Doing it later costs a migration. Where there is any prospect of a future residency requirement, choosing locally now is the cheap option.

Three Reasons That Do Not

• “It must be more compliant.” Not automatically. Compliance depends on how you handle personal data — consent, purpose, retention, security, breach response — not on which country the servers are in. A business with local hosting and no data retention policy is in a worse position than one hosted abroad with its governance in order.
• “It will be faster.” Latency improvements are real but modest for typical business application use, and for most users the difference will not be perceptible. If performance is genuinely your problem, diagnose it before assuming geography is the cause — in our experience it more often turns out to be an unoptimised workflow, a heavy custom function, or a report doing far more work than it needs to.
• “Everyone is moving.” A migration has cost, downtime and an integration rebuild attached. Doing it without a stated reason means spending that for nothing. If you cannot write the reason in one sentence, you do not have one yet.

What a Zoho DC Migration Actually Involves

Here is the operational reality, drawn from Zoho’s own documentation.

It is request-based, not self-service. There is no toggle in your admin console. Migration is requested by email to Zoho’s migrations team, who then assess feasibility, confirm scope and schedule the work.

Who can request it. An organisation owner can request migration of account data for all users in the organisation, plus data in applications where they are an administrator. Ordinary organisation users cannot migrate anything.

How it works. Your data is exported from the current data centre and imported into a new account in the target data centre. You are then asked to verify the imported data. If verification is not confirmed within two weeks of follow-up, Zoho reverts the migration. Once complete, the old account is deactivated and, per Zoho’s documentation, deleted after 14 days.

Downtime is real. Users should not access the applications during migration, and anything added while it runs will not be carried over. A small number of applications — Zoho Mail, Cliq, WorkDrive and Books — offer partial transfer of changes made during the window, but you should plan on the basis that work stops.

Duration depends on data volume, and weekend scheduling can be requested. For most mid-sized UAE businesses this is the single most important planning variable, and it is why the exercise belongs over a weekend or a public holiday rather than mid-week.

Commercial effects. Your existing billing currency is no longer accepted after a regional move and pricing may change because of regional taxation. Renewal dates for migrated subscriptions stay the same. Check what the move does to your annual cost before you commit to it — this is not usually a large number, but it should not be a surprise either.

What Does Not Come With You

This is the section to read twice, because it is where migration budgets are won and lost.

Integrations do not migrate. Not between Zoho applications and third-party services, and not generally. Every connection you have built — payment gateways, e-invoicing providers, banking feeds, telephony, WhatsApp, e-commerce platforms, custom API clients — has to be reconfigured against the new account. For a lightly integrated business this is an afternoon. For a business running a connected finance and operations stack, this is the project, and it is routinely underestimated because the data migration is the part people think about.

Some products do not migrate at all. Zoho’s documentation names Zoho Directory, Zoho Voice and Catalyst by Zoho among services whose data does not transfer; their subscriptions are cancelled, with refunds handled under Zoho’s refund policy. If any of these are load-bearing in your setup, that needs a plan before anything else happens.

Applications unavailable in the target region will not migrate there. Confirm your full application list against the UAE region first.

Practical implication. Build your plan around the integration rebuild and the application availability check, not around the data copy. The data copy is Zoho’s job. Everything that touches your data is yours.

If You Are Choosing Zoho Now

The decision is far easier and the answer is usually straightforward.

Choose the data centre region deliberately at sign-up, as a documented decision rather than a default. Record why, because the next security questionnaire will ask.

Choose the UAE region if you have any sectoral residency obligation, you sell to government or regulated clients, your governance policy calls for it, or you simply expect any of those to become true. The cost today is zero; the cost later is a migration.

Confirm application availability first, so you do not select a region that lacks something you need.

Note the DIFC and ADGM point if your group spans mainland and a financial free zone, since the regimes differ and transfers between them are treated as cross-border. Build that into the architecture conversation rather than discovering it later.

Best Practices

1. Write down the reason for moving in one sentence before costing anything. No sentence, no project.
2. Confirm your legal position with your adviser, distinguishing a genuine obligation from a preference.
3. Inventory every application and check availability in the UAE region.
4. Inventory every integration. This is your real scope.
5. Identify non-migrating products early — Directory, Voice and Catalyst among them — and plan their replacement separately.
6. Schedule over a weekend or public holiday and tell users the system is closed, not slow.
7. Freeze data entry during the window. Anything added will not come across.
8. Verify the imported data promptly. Zoho reverts the migration if verification is not confirmed within two weeks of follow-up.
9. Rebuild and test integrations one at a time after the move, starting with anything touching payments or statutory filing.
10. Check the commercial impact — billing currency changes and pricing may shift with regional taxation.
11. Update your security documentation afterwards. The point of the move is to be able to answer question eleven; make sure someone writes down the new answer.

Common Mistakes

• Assuming UAE law requires local hosting. There is no general localisation mandate; some sectors have specific rules. Know which applies to you.
• Treating location as compliance. How you handle personal data matters more than where the servers sit.
• Budgeting for the data move and not the integration rebuild. The rebuild is usually the larger piece.
• Discovering mid-project that an application is not offered in the region.
• Overlooking non-migrating products until their subscriptions are cancelled.
• Running the migration mid-week. Users work, data is entered, and that data is lost.
• Missing the verification window and having the migration reverted.
• Moving because of latency without diagnosing the actual performance problem.
• Forgetting the DIFC and ADGM distinction in groups spanning mainland and a financial free zone.
• Not updating the security questionnaire response after going to the trouble of moving.

An Illustrative Scenario: An Abu Dhabi Healthcare Group

A composite illustration built from patterns common in the UAE market. It is not an account of a specific named client.

Consider a healthcare group operating several clinics in Abu Dhabi and Dubai, running Zoho CRM for patient enquiry and referral management, Zoho Desk for the patient contact centre, Zoho Books for finance, and a Zoho Creator application for internal scheduling — with the whole estate hosted outside the region since adoption three years earlier.

The Trigger

The trigger was not the data centre launch. It was a routine review in which their legal adviser confirmed the position on health data under Federal Law No. 2 of 2019, and the group recognised that elements of what sat in CRM and Desk fell within that scope. The question stopped being commercial and became an obligation.

What the Assessment Found

The application inventory was straightforward — everything in use was offered in the UAE region. The integration inventory was not. The group had connected a payment gateway, a laboratory information system via custom API, a WhatsApp channel into Desk, a bank feed into Books, and an appointment reminder service. None of those would migrate. The integration rebuild, not the data move, became the bulk of the project plan and the bulk of the cost.

The assessment also surfaced something unrelated and more urgent: patient enquiry records were being retained indefinitely with no documented retention policy. Moving them to a UAE data centre would have relocated that problem rather than solved it.

How It Was Sequenced

Retention and access governance were addressed first, as a separate workstream, on the argument that there was no sense migrating data the group should not have been holding. The migration itself was requested through Zoho’s process and scheduled across a long weekend, with clinics told the systems were unavailable rather than slow. Integrations were rebuilt one at a time over the following fortnight, with the payment gateway and the laboratory interface taken first and tested hardest.

The Outcome

The residency obligation was met. The more valuable result, in the group’s own assessment, was the governance work that the migration forced them to do first — and the fact that they could now answer a client security questionnaire with a certified local hosting position rather than an explanation.

Industry Considerations

• Healthcare. The clearest case for local hosting in the UAE, given the restrictions on health data under Federal Law No. 2 of 2019. Treat residency as an obligation to confirm with counsel, not an option. See healthcare solutions.
• Government suppliers and regulated services. Tender and vendor security requirements increasingly ask where data resides, and local hosting can affect evaluation. Here the business case is commercial and measurable.
• Financial and professional services in DIFC or ADGM. Separate data protection regimes apply and transfers to and from the mainland are treated as cross-border. Architecture decisions should reflect that from the start. See IT services ERP.
• Trading, distribution and logistics. Typically no localisation obligation, so the decision rests on client requirements and internal policy. Usually the right answer is to choose the UAE region for new deployments and not to migrate an existing one without a reason. See trading and distribution and logistics solutions.
• Retail and e-commerce. Heavy integration estates — payment gateways, marketplaces, shipping, loyalty — make the rebuild disproportionately large relative to the data move. Scope carefully. See e-commerce solutions.

Stay or Move: A Decision Table