UAE PDPL and Data Residency: Keeping Bitrix24 CRM Data In-Country

What UAE PDPL Actually Requires from a CRM

The UAE PDPL does not order every business to keep data in the country. It controls cross-border transfers: personal data may leave the UAE for countries with adequate protection or under listed exceptions. Your CRM server location therefore decides how much transfer paperwork you carry.

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. It defines personal data broadly: any information that identifies or could identify a natural person. In a CRM that covers contact names, phone numbers, email addresses, deal values linked to individuals and the whole communication history.

The obligations that matter most for a CRM deployment:

• Cross-border transfers (Articles 22-23). Data may go to a country whose protection level is approved by the UAE Data Office. Outside that list, a transfer needs one of the exceptions in the law, such as a contract with the recipient or the data subject's express consent. Every sync from your CRM to a foreign data centre is such a transfer.
• Data subject rights. Customers can ask for access, correction or erasure, and your team must be able to find and act on one person's records quickly.
• Security measures. Controllers must apply appropriate technical and organisational measures. Server location alone does not satisfy this.
• Breach notification. The controller notifies the UAE Data Office and affected individuals about breaches.

Free zones are different. Companies licensed in DIFC and ADGM fall under their own data protection laws (DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021), not the federal PDPL. Both have their own transfer rules, so check which regime applies to your licence first.

General information only, not legal advice. Confirm your obligations with UAE-qualified counsel or your free-zone regulator.

Sector Rules: Who Must Keep CRM Data in the UAE

On top of the PDPL, sector rules in healthcare and finance push data into the country. The strictest is the federal health ICT law. Banks, insurers and government contractors face regulator expectations or contract clauses. Everyone else mainly needs a lawful transfer mechanism.

The exposure depends on your industry and the type of data your CRM holds. Grouping sectors in tiers helps avoid both over-engineering and under-compliance:

For Tier 1, contractual wording around a foreign cloud rarely closes the question: the auditor will ask where the data physically sits. For real estate specifically, see how Bitrix24 for real estate in the UAE handles KYC funnels and buyer databases.

Where does Bitrix24 Cloud store your data?

Bitrix24 Cloud has no data centre in the UAE. Accounts in the .ae zone are hosted in the European Union, in Frankfurt, and .com accounts in the United States. A UAE company on Bitrix24 Cloud therefore transfers CRM data abroad with every record it saves.

According to the vendor's GDPR page and sub-processor list, Bitrix24 runs on Amazon Web Services in two regions:

• Frankfurt, Germany - accounts in .eu, .ae and other European zones;
• N. Virginia, United States - .com and .com.br accounts, under the EU-U.S. Data Privacy Framework.

Commercial customers can ask support to move an account to the EU data centres, but there is no UAE region to choose. A data processing agreement does not change where the data sits: it gives the transfer a legal basis.

AI features add a second flow. CoPilot uses third-party providers, and under the Bitrix24 AI Tools Terms requests handled by OpenAI are transmitted to the USA. For the full picture of AI data flows and how to restrict CoPilot, see where Bitrix24 AI processes your data.

The practical conclusion: to keep Bitrix24 data resident in the UAE, you run the self-hosted edition on UAE infrastructure.

Is cloud CRM or on-premise CRM better for UAE data residency?

For a Tier 1 sector, on-premise wins because you can show a regulator the server, the logs and the backups. For an ordinary SMB, a cloud CRM with a documented transfer basis is often enough and cheaper. The decision depends on data type, not on technology preference.

The audit question decides most cases: can you show today exactly where every customer record is stored and who opened it? With a self-hosted system the answer is yes. Cost is a separate question: at 50 users self-hosted is usually more expensive than cloud over three years, as the 3-year TCO comparison shows.

Self-Hosted Bitrix24 on UAE Infrastructure

Self-hosted Bitrix24 installs on a server you choose: a UAE colocation data centre, an in-country cloud region or your own server room. CRM records, files, chats and backups then stay on that server, and you decide who reaches it.

Infrastructure options in the UAE

• In-country cloud region - for example AWS Middle East (UAE), Azure UAE North, or local providers such as Core42 (G42) and Khazna Data Centers. No hardware to own, good fit for most companies.
• Colocation or dedicated server in a UAE data centre - dedicated hardware in a certified facility, for strict physical-security requirements.
• Your own server room - maximum control, highest operating effort.

Minimum server specification (from our project data)

For a portal of 50-100 users:

• CPU: 4+ server-grade cores
• RAM: 12-16 GB; a 16-core server with 47 GB RAM comfortably runs a mid-size portal with a ~28 GB database
• Storage: 128 GB+ SSD for database and files
• OS and stack: CentOS Stream 9 or a supported VM image, nginx or Apache, PHP 8.2+, MySQL 8.0+ or Percona
• Network: ports 80 and 443 for users, 22 for administration from an allowlist; a Push & Pull server for real-time chats and the mobile app

For larger teams, see the hardware sizing guide. For cloud deployments, see self-hosted Bitrix24 on AWS, Azure or a private cloud.

Licence model

Self-hosted Bitrix24 is sold as a 12-month licence in two editions, Business (50 to 500 users) and Enterprise (1,000+ users). The first year is paid at full price, each following year renews at 50% of the edition price, and after a 14-day grace period an expired copy locks. Current tiers are in our editions and licensing guide, and a full budget with server and implementation is in what a turnkey self-hosted deployment costs.

Where Each Data Element Lives in a Self-Hosted Deployment

In a self-hosted deployment the CRM core - contacts, deals, files, chats and activity history - lives on your server. Data leaves it only through services you connect yourself: mail, telephony, web forms and AI. Each of those connections needs its own check.

The last row surprises many teams. CoPilot works on self-hosted Bitrix24 through the AI Integration module, which sends requests to the Bitrix24 AI proxy, so prompts leave your server. If AI must stay inside your perimeter, restrict CoPilot and use a custom integration with your own model endpoint.

Security Hardening: Compliance Is More Than Server Location

The PDPL asks for appropriate technical measures, and a badly configured server in Dubai is a bigger risk than a well-run cloud abroad. These gaps come up most often in our security audits of on-premise Bitrix24 portals.

1. Outdated web environment - old OS, PHP, nginx or database versions. Keep the stack current.
2. PHP errors shown in production - display_errors leaks paths and SQL. Turn it off in php.ini.
3. No two-factor authentication - enable OTP for every user, administrators first.
4. No HSTS and no forced HTTPS - configure both on the web server.
5. Admin panel open to the internet - allow it only from a defined IP list.
6. No frame protection - enable anti-framing against clickjacking.
7. Database structure errors - run the built-in check and fix every error.
8. Proactive protection below standard - the built-in scanner should show zero critical issues.

The full list is in our 25-point security hardening checklist, and backups are covered in the backup and disaster recovery guide.

Moving from Bitrix24 Cloud to a UAE Server

A move from Bitrix24 Cloud to a self-hosted portal in the UAE takes 2 to 4 weeks: audit, server preparation, data transfer, reconnecting integrations and a test run. Some history stays behind, so export what you need before the switch.

The project follows four steps:

1. Audit of the cloud portal - users, data volume, pipelines, automations, integrations. This step sets the scope and the price.
2. Server and platform - the UAE server is prepared, Bitrix24 is installed and the licence registered, SSL, mail, Push & Pull and backups to UAE storage are configured (about 7 hours of engineering).
3. Data and integrations - CRM entities move with their fields, stages, automations and permissions; website forms, telephony, WhatsApp and ERP are reconnected to the new address.
4. Test and go-live - your team checks the portal, the domain is switched, and one month of support follows.

What does not transfer with standard tools: activity history on the right side of CRM cards (comments, calls, emails), internal chat history, files attached to tasks and task comments. Have team leads export critical threads before the cutover date.

Budget. Based on our projects, the migration service for a standard portal costs USD 900-2,000, depending on data volume and the number of integrations. Add the licence and UAE hosting. The step-by-step plan with hours per module is in our cloud to self-hosted migration guide.

Deployment Architecture for UAE In-Country Compliance

In a compliant UAE deployment, all primary CRM data stays inside the UAE boundary. Website, telephony, WhatsApp and ERP connect through the REST API or native connectors, backups go to UAE storage, and administrators reach the server only through a VPN or an IP allowlist.

Where uptime is itself a regulatory concern, as in healthcare and banking, a master-replica cluster removes the single point of failure while keeping every node in the UAE. See the high availability cluster guide.

Related: Self-Hosted Bitrix24 for Banks and Financial Services

Do you need to move your CRM data into the UAE?

Tick the boxes below. One tick in the first five means in-country hosting is a legal or contractual requirement for you. Ticks only in the rest mean you need a documented transfer basis, and self-hosting is one way to remove that work.

• We operate in healthcare, banking, payments or insurance in the UAE
• We hold a DIFC or ADGM licence
• Our tenders or client contracts contain data-residency clauses
• Our CRM stores patient records or medical history
• Our CRM stores KYC documents or financial transaction data
• We cannot say in which country every CRM record and backup is stored
• We have not documented the PDPL basis for transfers to our current CRM vendor
• We cannot export or erase all data about one person on request
• Our team uses CoPilot or other AI tools on customer data

If you are not sure about the first answers, start with an audit: we map your data, sector rules and integrations, then propose the hosting option and budget. Related reading: GDPR-compliant self-hosted CRM in the EU and the Saudi Arabia data residency guide.

Working with a partner on self-hosting. Want the control of self-hosted Bitrix24 without running the server yourself? ACP Group can deploy and operate it for you - see managed self-hosted Bitrix24, support and maintenance plans, or request a turnkey deployment quote.

Need this mapped to your setup? ACP Group is a Bitrix24 Gold Partner in Dubai delivering Bitrix24 implementation in the UAE and Middle East, including self-hosted deployments for data-residency requirements.