# CBUAE — Data & Outsourcing Rules for Licensed Financial Institutions

Applies to **CBUAE licensees** (banks and other licensed financial institutions). Not applicable to firms regulated only by DFSA (DIFC) or FSRA (ADGM) — confirm the license first.

## Consumer Protection Regulation (Circular 8/2020) + Standards
- **Consumer and transaction data must be stored and processed within the UAE** (data residency).
- **Confidential consumer data may not be shared/transferred outside the UAE** without **CBUAE approval AND prior written customer consent**.
- Data protection duties: security safeguards, purpose limitation, retention rules, consumer consent management, complaint handling.

## Outsourcing Regulation for Banks (Circular 14/2021, effective 15 July 2021) + Standards
- **CBUAE approval for material outsourcing** (including cloud) before implementation
- **Master System of Record maintained in the UAE**; bank retains ownership/control of bank and customer data
- Mandatory contract clauses: audit and on-site inspection rights (for the bank AND CBUAE), breach/incident notification, security requirements, exit/termination and data-return provisions
- Offshoring of data processing requires the residency/consent analysis above — plan cloud architecture accordingly

## Practical workflow for a bank adopting cloud
1. Classify the data (consumer/confidential vs other) → residency constraints
2. Materiality assessment of the outsourcing → CBUAE approval path and timeline
3. Contract build: audit rights, MSoR location, notification, exit
4. Parallel privacy analysis: federal PDPL readiness posture (banking-data carve-out notwithstanding, group-wide programmes should align) and zone DP law for any DIFC/ADGM entities
5. Additional CBUAE cyber/IT expectations exist in the rulebook — verify current items on rulebook.centralbank.ae rather than citing from memory