Tencent Cloud-Based Businesses Entering the UAE: Entity, Data and Partner Models

Tencent Cloud describes 25 regions and 70 availability zones on its global page, with a Middle East entry for Riyadh. Arab News reported on 20 September 2025 that Tencent was finalising its first Middle East cloud region there, as part of a USD 150 million investment, and that it was still working to secure the approvals and certifications needed to serve public and private sector clients in Saudi Arabia.

A UAE-based customer asking for local hosting is therefore likely to be served from outside the UAE, from Riyadh at best or from a region further away. A business selling a Tencent Cloud-based service in the UAE must describe that accurately. Calling the service UAE-hosted when the servers are in another country is a contract risk and a reputational one.

The same report named one UAE link: Tencent's digital human technology is already deployed by Abu Dhabi's tourism department. That is a deployment by a customer, not a UAE region, and should not be used to suggest local infrastructure.

For businesses that need hosting inside the UAE, the answer may be a different provider, a multi-cloud design, or a partner. The guide on cloud managed service providers sets out how those service companies are structured, and the one on sovereign and private AI hosting covers the case where data may not leave the country.

Tencent Cloud's global page links to a Partner Network but does not describe a reseller programme in detail. A business should obtain the terms directly from the provider. The questions are specific.

If the UAE company bills cloud consumption, it takes the credit risk and the foreign-exchange exposure, and its balance sheet shows both. If it only refers customers and the provider bills them, it earns a fee and carries far less. The answer decides the capital, banking and tax profile of the UAE entity, and it is why the contract should come before the licence.

A business that implies an official partnership without one is making a claim that the provider can contradict. Keep claims to what the paper supports.

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022. The UAE Government describes it as applying to processing of personal data through electronic systems inside or outside the country. It prohibits processing without the data owner's consent, subject to exceptions, and gives individuals rights to correct inaccurate data and to restrict or stop processing. The law also sets requirements for the cross-border transfer and sharing of personal data.

The UAE Data Office, set up under Federal Decree-Law No. 44 of 2021, is the federal data regulator. The Dubai International Financial Centre (DIFC) has its own law, DIFC Law No. 5 of 2020, so a business in that centre looks at a different text.

For a cloud service the practical point is that the law follows the data, not the servers. A UAE company that stores customer data in Riyadh or elsewhere is still a processor or controller of that data under UAE rules if the data belongs to people the law covers. The government page summarises the law and does not set out the transfer conditions. A business should read the full text and the relevant sector rules, or ask a lawyer, before it promises anything about cross-border data.

The UAE Cybersecurity Council's National Cloud Security Policy has a Data Location and Sovereignty domain. For cloud service providers it asks for transparency about where data is processed and stored. Customers in regulated sectors may add their own requirements, so the contract should show who holds privileged access and from where. The guide on managed cybersecurity and SOC companies is useful where the service includes monitoring.

TDRA's site shows licences for trust service providers and qualified trust service providers, registration for manufacturers and suppliers who trade in telecom equipment, and authorisations for wireless services. It also provides a cloud infrastructure (IaaS) service to government entities on FedNet, the federal government network.

That last item is not a general licence for cloud businesses. TDRA's page does not describe a licensing requirement for ordinary cloud or ICT service providers, and a founder should not infer one. The useful step is to list each function the UAE company performs and ask whether any of them is a trust service, a telecom function or a government connection. Managed hosting for private customers usually falls outside the first two. Selling to a government entity may bring procurement rules instead.

If a function does sit inside TDRA's remit, the company needs the authority's approval for it, in addition to a trade licence.

With the resale contract, the hosting location and the regulatory perimeter written down, the entity choice gets simple. A sales and customer-success office for an overseas software company needs less than a managed-service business with staff on call. The mainland company and free-zone company routes both exist for technology firms, and the comparison between them is easier to read once the customer list is known.

A UAE-resident founder or engineer will need residence visas through the company. A business that bills UAE customers also needs the FTA registrations: the FTA site shows a 5% VAT rate in its calculator and lists VAT and Corporate Tax registration services. The way Velarozone works is to settle these questions in writing before a form is filed.