SaaS Subscription Agreement in the UAE: Template, Key Clauses and Local Law (2026)

A SaaS subscription agreement in the UAE is the contract between a software provider and a business customer for access to cloud software for a recurring fee. The customer does not install or own the software; it subscribes to a hosted service and licenses the right to use it for the subscription term. This guide explains what a UAE SaaS contract should contain, the laws that apply, and the local points that matter, including data protection and the onshore versus free zone choice. It is general information, not legal advice. Confirm specifics with a UAE-qualified lawyer. ## What is a SaaS subscription agreement and when do you need one in the UAE? A SaaS agreement combines a licence to use software you never possess with a service commitment to keep that software running, secure and supported. Because customer data flows through the provider's systems, data protection and service levels sit at the centre of the deal. You need one whenever you provide or buy cloud software on a subscription basis in the UAE, billed monthly or annually, per user or per usage. ## Which laws govern a SaaS subscription in the UAE? There is no single SaaS statute. A UAE SaaS contract draws on several sources, and the first question is onshore or free zone. Onshore UAE: - Civil Transactions Law, Federal Decree-Law No. 25 of 2025 (effective 1 June 2026), and the Commercial Transactions Law, Federal Decree-Law No. 50 of 2022, for the contract itself.

• Copyright Law, Federal Decree-Law No. 38 of 2021, which protects software as a protected work; licensing follows the agreement attached to the program.
• Data protection under the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the PDPL), overseen by the UAE Data Office.
• Electronic Transactions and Trust Services Law, Federal Decree-Law No. 46 of 2021, and VAT at 5 percent under Federal Decree-Law No. 8 of 2017. Free zones: DIFC and ADGM apply their own common-law frameworks and their own data protection laws (the DIFC Data Protection Law 2020 and the ADGM Data Protection Regulations 2021), which are closely modelled on the EU GDPR. ## Key clauses in a UAE SaaS subscription agreement | Clause | Why it matters in the UAE | | --- | --- | | Subscription and access scope | Define users, environments and usage limits. | | Licence grant | A limited right to use, not a sale of the software. | | Service levels (SLA) | Uptime targets, support response times and credits. | | Fees, auto-renewal and VAT | Fee, renewal mechanism, notice to cancel and 5 percent VAT. | | Data protection and DPA | Address the PDPL or the relevant free zone regime. | | Security | Encryption, access controls and breach notification. | | Customer data and return | Customer owns its data and can export it on exit. | | Intellectual property | Provider keeps the software; customer keeps its data. | | Warranties and disclaimers | What is promised and what is as-is. | | Liability and caps | Note that onshore courts can adjust agreed damages. | | Term, suspension and termination | Breach, non-payment suspension and effect of ending. | | Governing law, language and forum | Onshore federal law and courts, a free zone and its courts, or arbitration. | ### Data protection under the PDPL and the free zones The federal PDPL (Federal Decree-Law No. 45 of 2021) is the UAE's main personal data law and applies to processing of the personal data of people inside the UAE, with extraterritorial reach. The UAE Data Office supervises it. Note two practical points: the PDPL's executive regulations have taken time to be finalised, so confirm the current detailed position before relying on specific procedural points; and the PDPL does not recognise legitimate interests as a processing basis, unlike the GDPR and the DIFC and ADGM laws. If the provider or customer sits in the DIFC or ADGM, the free zone data protection law applies instead of the federal PDPL, and those laws are GDPR-aligned and more fully developed. Either way, a SaaS provider hosting customer data is usually acting as a processor and needs a data processing agreement. ## UAE-specific points to get right - Onshore versus free zone. This drives the governing law, the data protection regime, the forum and the language. Decide it first.
• Data residency and transfers. The PDPL and the free zone laws set rules on transferring personal data outside the UAE or free zone. Address where data is hosted and the transfer safeguards.
• Language. Arabic is the official language and onshore courts work in Arabic; a bilingual contract with a stated prevailing version is common. DIFC and ADGM courts work in English.
• Auto-renewal. State the renewal term, renewal price and the notice needed to cancel.
• VAT. UAE VAT at 5 percent usually applies to SaaS. State whether prices include VAT. ## A simple SaaS agreement template outline for the UAE 1. Parties and definitions

2. Subscription, access and permitted use
3. Licence grant and restrictions
4. Service levels and support
5. Fees, billing, auto-renewal and VAT
6. Customer data: ownership, security and return
7. Data protection (PDPL or free zone regime, with a DPA annex)
8. Intellectual property
9. Warranties and disclaimers
10. Liability and caps
11. Term, suspension and termination
12. Confidentiality
13. Governing law, language and dispute resolution
14. Annexes: SLA, DPA, security measures ## Common mistakes to avoid - Not deciding onshore versus free zone, which sets the data protection regime.

• Signing without a data processing agreement when personal data is handled.
• Assuming GDPR-style legitimate interests applies under the federal PDPL; it does not.
• Ignoring data residency and cross-border transfer rules.
• Leaving the prevailing language unstated in a bilingual contract. ## One workspace to draft, review and track your SaaS contracts The SaaS deal does not end at signature. Someone has to watch the renewal date, keep the DPA current, and make sure each new order matches the master terms. That tracking usually sits in spreadsheets and inboxes. An AI contract workspace keeps it together: draft from your approved SaaS and DPA templates, see per-clause risk against how your company likes to contract, edit clauses in plain language, and track renewals, service levels and obligations on a live timeline. Adira is built for this, India-first today with other jurisdictions including the UAE on the roadmap, so confirm UAE-law and PDPL specifics with local counsel. The drafting, review and tracking you would otherwise do by hand can live in one workspace tuned to your business. This article is general information and not legal advice.