Gulf firms must redesign data resilience after AWS war-zone outage

AWS outage exposes regional data fragility

The September disclosure that Amazon Web Services could not restore data from facilities damaged in Bahrain and the UAE has become a “hard lesson” for Gulf enterprises, according to lawyers cited by AGBI analysis. The incident forced a reassessment of where critical data and backup copies reside, especially for firms that cannot tolerate prolonged outages.

Cross-border transfers run into localisation rules

While GCC jurisdictions technically allow cross-border data flows, the UAE Federal Personal Data Protection Law 2021, the DIFC and ADGM regimes, Saudi Arabia’s Personal Data Protection Law 2023 and the Saudi Data and AI Authority’s Transfer Regulations 2023 impose strict safeguards. Transfers are permissible only if the destination offers an “appropriate level of protection” or if contractual clauses are in place. The DIFC and ADGM recognise a list of “adequate” jurisdictions—currently the EU and the UK—while onshore laws lack such lists. Penalties for non-compliance in the UAE range from AED 50,000 to AED 5 million, plus possible criminal sanctions under the Cybercrime Law.

Building resilience across jurisdictions

Legal experts advise a comprehensive review of data classification, storage, and disaster-recovery plans. For the six sectors facing heightened obligations—financial services, healthcare, government, telecoms, IoT and critical infrastructure—flexibility to move data abroad is limited. A multi-jurisdiction strategy may involve secondary copies in another approved jurisdiction, geographically separate data centres within the same country, or a multicloud/hybrid architecture. Additionally, cloud contracts often place the onus of replication on the customer under the shared-responsibility model, underscoring the need for coordinated legal, compliance, cybersecurity, procurement, operational and risk functions.

Our read: The AWS incident does not argue against Gulf cloud adoption; it underscores that resilience must be baked into compliance frameworks from day one, leveraging diversified jurisdictions and clear contractual duties.