The Gulf Data Centre Opportunity and Legal Landscape in the GCC

The Infrastructure Moment Is Now

‘Data’, much like what had been oil in the past, has become one of the most important resources in the modern economy today. Every transaction, movement and interaction generates data, giving rise to significant questions such as who controls it, where does it sit, which law governs the processing thereof and, lastly, is ‘personal data’ really ‘personal’. In the Gulf, intersection of these questions with the unique circumstances of the region presents a major infrastructure opportunity.

The data centre capacity in the Gulf Cooperation Council is projected to significantly increase in the coming years, with the Kingdom of Saudi Arabia (KSA) and United Arab Emirates (UAE) accounting for most of such capacity. Key drivers that are enabling and pushing this growth include:

• national digital transformation strategies (such as Saudi Vision 2030, UAE Centennial 2071, Qatar National Vision 2030, etc.) backed by government policy;
• rising AI workload demand;
• data localization requirements; and
• Gulf's geographic position serving Africa, South Asia and Eastern Europe.

Interested parties have recognized this opportunity and made / committed to make investments, which includes and is not limited to: (a) Microsoft’s multi-billion-dollar strategic investment in UAE’s AI and cloud ecosystem (including G42 partnership), with Google Cloud and Oracle Government Cloud also entering the market; (b) the launch of HUMAIN, a Saudi sovereign fund-backed entity in 2025, with a target of up to 500 MW of AI-optimized capacity in partnership with NVIDIA, and a separate joint venture with AMD and Cisco targeting up to 1 GW of AI infrastructure by 2030; (c)  G42-backed Khazna, the largest data centre operator in MENA, planning to expand in Saudi with a 200 MW Saudi campus. These headlines clearly illustrate that investors and large corporations are increasingly viewing the Gulf as one integrated market. While it is an exciting time for the data centres market in the region, the legal landscape requires careful attention.

Unpacking the Regulatory Landscape

Data and data centres are subject to overlapping layers of regulation: national / federal legislations, freezone rules and regulations (applicable in the case of the UAE), sector-specific rules, data localization requirements and laws of the region where cloud services are physically hosted.

Because the freezones are legally distinct/common-law jurisdictions with independent regulatory frameworks, UAE’s legal landscape is inevitably multilayered. Amongst others, the prominent freezones in Dubai and Abu Dhabi are Dubai International Financial Center (DIFC) and Abu Dhabi Global Market respectively, with each having its own set of laws, including the data protection rules (DPRs). In practice for example, this may mean that an operator with a presence in the DIFC and mainland Dubai both will need to navigate two frameworks at the same time.

In Saudi Arabia, there is a single unified system. The Personal Data Protection Law limits cross-border data transfers to jurisdictions with equivalent protection (much like DIFC and ADGM’s DPRs) or with approved safeguards, which has real implications for standard cloud routing. Cybersecurity controls restrict government data to leave the country, and the Government Cloud First Policy also means government entities cannot build their own infrastructure — all government data is generally required to be hosted within Saudi Arabia, often through approved cloud providers and national infrastructure frameworks.

Considerations for Market Entrants

For those looking to enter this market, a few practical points are worth keeping in mind from the outset.

1. Legal Structure. While freezones offer a straightforward route for international operators, a mainland licence may still be required for government and other regulated-sector work. Licence portability should also be considered i.e. whether a DIFC-licensed operator can automatically serve mainland clients without further authorization or not.
2. Factoring in ‘Power’. Data centre power demand is expected to double by 2030, but access to clean energy is constrained. Energy tariffs, including variable surcharges and project-specific pricing, should be clearly addressed in long-term agreements.
3. Facilities Flexibility. AI hardware moves fast — roughly every 12 to 18 months. Tenants are likely to push for upgrade or break provisions in longer leases, so operators should factor that into their financial modelling and think about modular design from the start.
4. Take ESG Seriously. With their own separate clean, green and sustainability agendas, Gulf countries are serious about ensuring that ESG standards are adhered. Moreover, power and water efficiency metrics are also increasingly becoming central to how lenders assess projects in this space, and sustainability-linked financing is becoming more common.

If you are in this space, this is an exciting place and time to be in. The region faces its own set of challenges, however, the opportunity is real. To do well, careful planning is warranted, including a thorough analysis and understanding of the regional regulatory and operational considerations.