Move Bitrix24 from Cloud to Self-Hosted in the UAE: Keep Personal Data In-Country

The 2026 Wake-Up Call: Enforcement Has Teeth

As of 2026, the UAE Data Office can impose administrative fines from AED 50,000 up to AED 5,000,000 per violation, order a halt to data processing that could suspend your operations entirely, and pursue criminal liability for wilful mishandling of sensitive data - making foreign-cloud CRM storage a board-level risk, not just an IT footnote.

For years, storing CRM data in an overseas SaaS cloud was an accepted trade-off. Two things changed simultaneously, making that trade-off untenable for UAE businesses:

1. Enforcement arrived. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") is now actively enforced. The UAE Data Office has published binding regulations on cross-border data transfers. Sector regulators - UAE Central Bank, the health authorities, insurance supervisors - have their own localisation mandates with fines of AED 500,000-700,000 for breaches.

2. The in-country alternative became practical. Sovereign and in-country cloud infrastructure is now widely available in the UAE (including offerings from major hyperscalers operating UAE-resident nodes). There is no longer a technical excuse for keeping regulated data offshore.

The net result: continuing to run your CRM in a foreign data centre carries real, quantifiable legal and operational risk, exactly when moving it to UAE soil has become straightforward.

General information only - not legal advice. Confirm your specific obligations with UAE-qualified legal counsel and/or your free-zone regulator.

What UAE Law Actually Requires (Precise, Tiered)

UAE data-localisation requirements are not uniform - your legal exposure depends on your industry and the type of data you process, ranging from a strict legal "must store in UAE" obligation for healthcare and banking, to a strong risk-mitigation case for everyone else.

Understanding the tiers prevents both over-compliance and dangerous under-compliance:

What the PDPL says about transfers: The federal PDPL does not mandate blanket data localisation for all businesses. It regulates cross-border transfers via adequacy decisions, standard contractual clauses, explicit consent, or Data Office approval. If your vendor's servers are in a country without an adequacy decision and you haven't put SCCs in place, every data transfer is a potential violation. For Tier 1 industries, sector law goes further and requires in-country storage regardless of transfer mechanisms.

Why Bitrix24 Cloud Cannot Keep Your Data in the UAE

Bitrix24 Cloud's SaaS infrastructure has no UAE data region - as of 2026, all cloud portal data is processed and stored on servers located outside the UAE, meaning any UAE company using Bitrix24 Cloud is by definition transferring personal data to a foreign jurisdiction every time the system processes a record.

This is not a configuration option or a premium add-on. It is an architectural fact:

• Bitrix24 Cloud data centres are located abroad (in data regions outside the UAE).
• There is no "UAE region" selector in Bitrix24 Cloud account settings.
• No standard contractual clause or consent mechanism changes where the data physically sits - it only provides a legal wrapper for the transfer.
• For Tier 1 industries (healthcare, banking, insurance), that legal wrapper is not sufficient - the law requires in-country storage, full stop.

The implication is stark: the only way to run Bitrix24 with data resident inside the UAE is to deploy the self-hosted (on-premise) edition on UAE-based infrastructure.

The Target Picture: Self-Hosted Bitrix24 on UAE Infrastructure

Self-hosted Bitrix24 deployed on a UAE-resident server - whether a UAE sovereign cloud node, a local colocation data centre, or physical on-premise hardware - gives your business complete control over where data is stored, processed, and backed up, satisfying both sector localisation mandates and PDPL cross-border transfer obligations simultaneously.

A self-hosted deployment on UAE infrastructure differs from a standard cloud setup in terms of data flow and compliance boundaries.

flowchart LR
    SITE[Website / Landing Pages] --> B24
    PHONE[VoIP / Telephony] --> B24
    WA[WhatsApp Business API] --> B24
    subgraph UAE["🇦🇪 UAE Infrastructure Boundary"]
        B24[Self-Hosted Bitrix24\nUAE Server / Sovereign Cloud]
        DB[(Database\nUAE-Resident)]
        BACKUP[Backup Storage\nUAE Data Centre]
        B24 --- DB
        B24 --- BACKUP
    end
    B24 <--> ERP[Local ERP / Accounting]
    B24 --> ESIGN[E-Signature / Document Portal]
    B24 --> BI[BI / Reporting Tools]

Infrastructure options for UAE deployment

• UAE Sovereign Cloud (e.g. hyperscaler nodes operating UAE-resident infrastructure): managed, scalable, no physical hardware to own - strong fit for most businesses.
• Local colocation data centre (UAE-based DC): dedicated servers in a UAE facility, good for organisations with strict physical-security requirements.
• On-premise physical server: hardware owned and operated in your UAE office or private server room - maximum control, higher operational overhead.

Minimum server specification (from our project data)

For a portal under moderate load without large file storage volumes:

• CPU: 4-core server-grade processor (e.g. Intel Xeon E3-class or equivalent)
• RAM: 8-12 GB (12 GB recommended for comfortable headroom)
• Storage: 80-128 GB SSD (database + files)
• OS: CentOS Stream 9 (bare-metal install) or a supported VM image (VMware / VirtualBox compatible)
• Web server: Apache 2.4.x (recommended) or nginx 1.16.x+
• PHP: 8.2 minimum (as of March 2024); OPcache accelerator recommended
• Required open ports: 80, 443 (portal access), 22 (SSH administration)
• Push & Pull server: required for real-time chats, tasks, calendar, telephony, and mobile app

For larger deployments, see our hardware sizing guide for 50-1,000 users.

Who Must Act Now: Industry Decision Table

Healthcare providers, banks, fintechs, insurance companies, DIFC/ADGM-licensed entities, and government contractors face the clearest legal imperative to migrate immediately; real estate agencies, law firms, and education institutions face mounting regulatory and contractual pressure that makes migration a near-term risk decision, not a future aspiration.

Use this table to locate your organisation and assess urgency:

If your sector appears in the top five rows and you are currently on Bitrix24 Cloud, you are likely in breach of your sector regulator's requirements today.

For real estate businesses specifically, see how Bitrix24 for real estate in the UAE handles KYC funnels and property databases - all of which become compliant only when the underlying data is in-country.

Do You Need to Migrate? A Compliance Checklist

Run through this checklist: if you tick any of the first five items, migration from Bitrix24 Cloud to self-hosted on UAE infrastructure is not optional - it is a legal requirement or an imminent legal risk.

• We operate in healthcare, banking/finance, or insurance in the UAE
• We hold a DIFC or ADGM licence
• We are a government contractor with data-residency clauses in our tender/contract documents
• We store patient records, medical histories, or clinical data in our CRM
• We store financial transaction data or KYC/AML identity documents in our CRM
• We have received or expect to receive a UAE Data Office inquiry about cross-border transfers
• Our clients or enterprise customers contractually require data to be stored in the UAE
• We process personal data of minors (students, children's services)
• Our legal/compliance team has flagged PDPL cross-border transfer obligations as unresolved
• We have not documented an adequacy decision, SCCs, or Data Office approval for our current Bitrix24 Cloud transfers

If you ticked 1 or more boxes: a structured migration plan is warranted. If you ticked 3 or more: the risk of operating Bitrix24 Cloud without a migration timeline is significant.

The Migration Path at a Glance

A cloud-to-self-hosted Bitrix24 migration follows a structured sequence - server preparation, platform deployment, data transfer, integration reconnection, and parallel-run validation - and typically completes within three weeks for a standard-sized portal, based on our project experience.

Here is the standard workflow ACP Group follows:

Phase 1 - Discovery & server preparation (Days 1-3)

• Audit current Bitrix24 Cloud portal: user count, data volumes, active integrations, automations
• Define UAE infrastructure target (sovereign cloud, colo, or on-premise)
• Client provides SSH (root) access to the target server, or ACP Group recommends a UAE-based hosting provider
• Server provisioned with CentOS Stream 9 or approved VM image; ports 80, 443, 22 opened; domain pointed to dedicated IP; SSL certificate configured

Phase 2 - Platform deployment (Days 3-5, ~7 hours of engineering)

• Self-hosted Bitrix24 installed and licence key registered
• Test data removed; Push & Pull server configured for real-time chats and mobile
• System email configured for notifications
• Backup jobs configured to UAE-resident storage
• Admin test user created for client verification

Phase 3 - Data migration (Days 5-12)

Bitrix24's migration tooling transfers CRM entities while preserving relational links (Contact → Company → Deals → Tasks):

• What migrates fully: Leads, Contacts, Companies, Deals (field settings, pipeline stages, custom fields, access rights, automation robots and business processes), Tasks and Projects, Smart Processes, user accounts and organisational structure, document templates (reconfigured for new field IDs), files up to 300 MB per record
• Known limitations: Activity history (calls, comments, emails logged against records), files stored in "File type" CRM fields, and task comments/creation dates do not transfer via standard tooling - document these gaps with your team before go-live
• Employee passwords cannot be bulk-exported; new credentials are distributed via a prepared spreadsheet

Phase 4 - Integration reconnection (Days 10-14)

• Website lead forms reconnected via webhooks to the self-hosted portal
• Third-party integrations (WhatsApp, telephony, e-signature, ERP) pointed to the new UAE-resident URL
• SSL and domain validated end-to-end

Phase 5 - Parallel run & go-live (Days 14-21)

• Client team validates all functionality mirrors the previous cloud portal
• One month of post-migration support included for issues within scope of the migration plan

For a detailed technical walkthrough, see our step-by-step cloud-to-self-hosted migration guide.

Once live, you will also want to address security hardening for your self-hosted instance and establish a backup and disaster recovery strategy - both critical for a production portal holding regulated UAE data.

Why ACP Group

ACP Group is a Bitrix24 Gold Partner with experience across 1,300+ implementation and migration projects - and a specific practice serving UAE and MENA businesses that need compliant, UAE-resident CRM infrastructure.

What this means for your migration:

• Pre-migration audit: We assess your current cloud portal, map data volumes, identify integration dependencies, and flag compliance gaps before a line of work is scoped.
• UAE infrastructure guidance: We work with UAE-based hosting and sovereign cloud providers and can recommend the right infrastructure tier for your sector and user count.
• End-to-end delivery: Server preparation, platform deployment, data migration, integration reconnection, and a post-go-live support period - all under a single engagement.
• Compliance-aware configuration: We understand the difference between Tier 1 and Tier 2 sectors and configure data handling, backup locations, and access controls accordingly.
• Ongoing platform management: Self-hosted Bitrix24 requires updates, patches, and infrastructure oversight. We offer ongoing managed support so your IT team is not carrying this alone.

For organisations evaluating the total cost of running self-hosted versus cloud, our 3-year TCO analysis provides a structured framework - particularly relevant when factoring in regulatory-risk costs that don't appear on a cloud invoice.

If you are also considering how self-hosted Bitrix24 compares to the cloud edition in terms of customisation and feature parity, see what becomes possible beyond cloud limits.

The information in this article is general in nature and does not constitute legal advice. UAE PDPL obligations, sector-specific localisation requirements, and free-zone data protection rules vary by organisation. Always confirm your specific compliance position with qualified UAE legal counsel and/or your free-zone regulator before making infrastructure decisions.

Working with a partner on self-hosting. Want the control of self-hosted Bitrix24 without running the server yourself? ACP Group can deploy and operate it for you - see managed self-hosted Bitrix24, support & maintenance plans, or request a turnkey deployment quote.

Planning this move in the UAE? ACP Group INT is a Bitrix24 (Alaio) Gold Partner in Dubai Silicon Oasis - see Bitrix24 implementation in the UAE and Middle East.