Canvas, Blackboard and Google Classroom: Setting Up an LMS or EdTech Company in the UAE

The three versions below differ in who the customer is, who holds the student data and which authority's rules reach the contract.

The first is the implementation partner. It configures a vendor's platform for a school, trains staff, builds integrations with the student information system and runs a help desk. Its customer relationship is a services contract, and the vendor's partner terms decide how it may describe itself.

The second is the managed host. It runs the platform for the customer and so holds the data. This is where the data protection and hosting questions arrive early, and where a cloud managed service provider structure often fits better than a pure consultancy.

The third is the content and training company that uses an LMS as its delivery channel. It is no longer selling software at all. It is selling learning, and that is closer to the territory of a professional training and certification institute, where the authority that approves the training matters more than the platform it runs on.

Many founders start as the first, drift into the second and are surprised to be the third. Writing down which of the three the company is, and which it deliberately is not, saves a licence amendment later.

The federal government describes a split of responsibility. For schools, the Ministry of Education and local authorities share oversight. In Dubai that local authority is KHDA, which has the power to inspect schools in the emirate. In Abu Dhabi the Department of Education and Knowledge (ADEK) shares the role, and in Sharjah the Sharjah Private Education Authority does. In Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah the Ministry supervises schools through its regional branches.

For higher education, the CAA is described as the national body responsible for the quality of higher education institutions. It licenses institutions and accredits their academic programmes. KHDA also certifies degrees from licensed universities in Dubai.

None of this means a software vendor needs an education licence to sell to these institutions. It means the customer lives under rules that will shape the contract. A school will ask whether your platform can produce the records its regulator expects, where those records are stored and who can see them. If you cannot answer, the sale stalls, and no incorporation route fixes that.

The line to hold is simple. Supplying a tool to a licensed institution sits on one side. Operating as a school, a university or an accredited training provider sits on the other. A company that wants both should plan for two entities or a clear partner, and should talk to the relevant authority before it markets anything.

Federal Decree Law No. 45 of 2021 came into force on 2 January 2022. It applies to processing of personal data through electronic systems inside or outside the UAE. It prohibits processing without the data owner's consent, subject to exceptions, lets people ask for corrections and for processing to be restricted or stopped, and sets requirements for sending personal data across borders. A UAE Data Office, established under Federal Decree Law No. 44 of 2021, acts as the federal data regulator.

Three points in an LMS contract and licence choice carry the data law: who controls the data, where it travels, and which regime applies to the licence location.

First, the contract has to say who is the controller of the student data and who only processes it on instruction. A school is normally the party deciding why the data is collected. Your company, as the platform operator or host, should not behave as though it owns the records.

Second, an LMS built on a vendor's overseas cloud sends data across borders every time a student logs in. That transfer needs to fit the rules in the law, and the customer will want it documented.

Third, free-zone data regimes exist alongside the federal law. The government's data protection page lists the Dubai International Financial Centre's Data Protection Law, DIFC Law No. 5 of 2020, among related laws. A company licensed in a financial centre may find its own regime applies as well as, or instead of, the federal one depending on the activity, so the licence location should be chosen with the data flows in view.

Parents of younger learners add a consent layer to every enrolment flow. The sensible approach is to let the school collect and confirm consent and to make your platform a processor that follows its instructions.

A company selling to Dubai schools can often operate from a free-zone company if its customers are institutions it will contract with directly. Where the business needs to sell widely into the local market, or to government-linked schools, a mainland company is the structure to compare, and the free zone versus mainland guide sets out the trade-offs. The decision turns on who signs the contract, where the staff sit and whether the customer expects a local entity.

Implementation work puts engineers and trainers inside schools, so check residence visas for the founding team and the number of visas a licence allows before the entity is chosen. Each free zone sets its own quota: at DMCC, a flexi desk carries up to 3 visas and a physical office one visa for every 9 square metres. How Velarozone works is to compare these routes against the activity you intend to carry out, not against a package price.

Procurement teams at institutions rarely start with the licence. They ask about references, data location, uptime, accessibility and support hours in the school day. A new UAE company with no track record can borrow credibility by being an authorised partner of a known platform, which is why the vendor agreement matters so much. Without it, the company cannot honestly present itself as a Canvas, Blackboard or Google Classroom specialist.

Lead times can be long. Ask each prospective school when it takes purchasing decisions and plan the entity timeline around that date, because a supplier that arrives after term starts may wait months for the next window.