A UAE insurance company migrates its policy management system to a cloud platform. The data centre is in Europe. The IT team chose it because it was the most cost-effective option from their global technology provider. The system works well. Performance is acceptable.
Then CBUAE (Central Bank of the UAE) Notification Ref CBUAE/MCS/2026/2058, dated 17 April 2026, lands. All licensed financial institutions, including insurers now consolidated under the CBUAE under Federal Decree-Law No. 6 of 2025, are required to store and maintain customer and transaction data within the UAE.
The insurer’s hybrid cloud architecture, built for cost and performance, was not built for this. The remediation project takes months and costs significantly more than a compliant architecture from the start would have.
This is not an unusual story in UAE insurance IT in 2026. It is the predictable consequence of building hybrid cloud architectures without mapping them against CBUAE data residency requirements before the first workload migrates.
What Hybrid Cloud Means for UAE Insurance Companies
?
A hybrid cloud architecture combines on-premise infrastructure, meaning servers and storage the insurer owns and operates in its own facilities or colocation space, with cloud-based infrastructure from providers such as AWS, Microsoft Azure, or Google Cloud. The two environments connect over private or encrypted network links and operate as a single logical environment from the application’s perspective.
For UAE insurance companies, hybrid cloud is the dominant architectural direction in 2026. Over 55% of UAE enterprises are expected to adopt multi-cloud management systems by 2026. The appeal is genuine: cloud environments provide scalability for variable workloads like open enrolment periods or catastrophe claims surges, cost efficiency for development and test environments, and access to AI and analytics services that on-premise infrastructure can’t match economically.
But hybrid cloud creates a security challenge that on-premise environments don’t have at the same level: the network path between the on-premise environment and the cloud is a boundary that data crosses continuously, and every crossing is a potential exposure point if the boundary isn’t secured correctly.
The Regulatory Requirements That Shape the Architecture
UAE insurance companies now operate under a layered set of data security obligations that directly affect hybrid cloud design.
The CBUAE’s notification requiring all customer and transaction data to remain within the UAE has immediate architectural consequences. Any cloud workload handling policyholder personal data, claims history, medical information for health policies, or payment records must run in a UAE-resident cloud region. AWS has an operational region in the UAE, the Middle East UAE Region. Microsoft Azure has two UAE regions, UAE North and UAE Central. These are the compliant cloud destinations for UAE insurance customer data. Workloads running in European, US, or other Asian cloud regions cannot host UAE insurance customer data under this requirement without specific CBUAE approval.
The CBUAE is also introducing dedicated cybersecurity and data protection requirements for UAE insurers with a Q2 2027 compliance deadline. These require advanced encryption across the entire data lifecycle, covering collection, storage, transmission, and deletion of policyholder data. This isn’t a point-in-time encryption implementation. It requires a managed encryption programme with key management, audit logging, and documented evidence of encryption coverage across every environment where customer data resides.
The CBUAE Cybersecurity Framework, which now applies to insurers as CBUAE-licensed financial institutions, requires compliance across nine domains including architecture, identity management, data protection, and third-party risk. For hybrid cloud environments, the architecture domain requires that the cloud portions of the environment are assessed and secured to the same standard as on-premise infrastructure.
Frequently Asked Questions
Q. Can UAE insurance companies use international cloud regions for any workloads?
A. Yes, for workloads that don’t handle UAE customer or transaction data. Development and test environments, non-customer analytics, and global enterprise applications without UAE customer data can run in international regions. Workloads handling UAE policyholder personal data, claims history, or transaction records must use UAE-resident cloud infrastructure under CBUAE Notification CBUAE/MCS/2026/2058.
Q. What encryption is required for UAE insurance customer data in cloud environments?
A. The CBUAE requires advanced encryption across the full data lifecycle. This means encryption at rest, meaning data stored in databases, file systems, and backups is encrypted, and encryption in transit, meaning all data moving between systems uses current TLS (Transport Layer Security, the encryption protocol for data in transit) standards. Customer-managed encryption keys, where the insurer rather than the cloud provider controls the keys that protect the data, provide a stronger compliance posture under the CBUAE’s data ownership requirements.
Q. What is the Q2 2027 CBUAE insurance cybersecurity deadline about?
A. The CBUAE is introducing dedicated cybersecurity and data protection requirements specifically for UAE-licensed insurance companies, building on the broader consolidation of insurance under CBUAE supervision since Federal Decree-Law No. 6 of 2025. The Q2 2027 deadline requires insurers to implement advanced encryption standards, obtain internationally recognised certifications, and build documented compliance programmes. The preparation timeline means insurers should be executing gap assessments and remediation now.
Q. How should UAE insurers handle policyholder data shared with reinsurers outside the UAE?
A. Sharing UAE policyholder data with overseas reinsurers requires compliance with CBUAE’s cross-border data transfer requirements, which mandate equivalent safeguards and, in some cases, prior CBUAE approval. Insurers should document the legal basis for each cross-border data transfer, the safeguards applied, and maintain evidence of the arrangements for CBUAE examination.
Â
How Brilyant Delivers CBUAE-Compliant Storage Architecture
The hybrid cloud security gaps we most consistently find in UAE insurance environments aren’t in the cloud security tools. They’re in the network path between environments that was never secured to the standard the CBUAE requires, the encryption that covers the primary database but not the backup copies, and the third-party API connections that were deployed for commercial reasons without a security assessment.
Brilyant works with UAE insurance companies from our Business Bay, Dubai office to design hybrid cloud security architectures that map directly to CBUAE data residency, encryption, and cybersecurity framework requirements. We are a certified partner with Check Point, Palo Alto Networks, CrowdStrike, and SonicWall for security, and with AWS and Microsoft Azure for UAE-resident cloud connectivity, and we implement the network security, identity management, and continuous monitoring layers as an integrated programme.
Talk to Brilyant’s UAE team about hybrid cloud security for your insurance operations.
Frequently Asked Questions
Can a Dubai bank use a data centre outside the UAE as its DR site?
No. Under CBUAE Circular 14/2021, Article 6.1, the Master System of Record including all confidential customer data must be stored within the UAE continuously. A DR site outside the UAE would breach this requirement unless specific prior CBUAE approval has been obtained.
What is the difference between RTO and RPO and why do they matter for DR architecture?
RTO (recovery time objective) is how quickly your systems need to be back online after a failure. RPO (recovery point objective) is the maximum amount of data you can afford to lose. These two figures directly determine which storage replication method and which DR architecture model is appropriate. Tight RTO and RPO requirements point toward active-active synchronous replication. More tolerance allows for active-passive with asynchronous replication.
Is cloud-based DR compliant for UAE banks?
It can be, provided the cloud infrastructure is located within the UAE, the data processing agreements meet CBUAE requirements, and the arrangement has received prior CBUAE approval as a material outsourcing decision. Both AWS and Microsoft Azure have operational regions within the UAE that can support DR workloads.
How often should banks test their DR setup?
The CBUAE’s operational risk framework expects documented DR testing. Industry practice for banks is at minimum one full failover test annually, with partial or component tests more frequently. Test results should be documented and remediation tracked.
Where Brilyant Can Help
The DR projects that go wrong aren’t usually the ones with bad intentions. They’re the ones where the storage architecture was designed for cost efficiency rather than regulatory compliance, or where the network redundancy between sites wasn’t validated before the first real failure occurred.
Brilyant works with banks across Dubai and Abu Dhabi to design and implement storage and DR architectures built for CBUAE compliance from day one. We’re a certified partner with NetApp, Pure Storage and Dell on the storage side, and with AWS and Microsoft Azure for cloud-based DR workloads. We design the replication topology, validate the network paths, and build the testing framework alongside the implementation.
Talk to Brilyant’s infrastructure team about DR architecture for UAE banks.
More Articles
We are here to help
Get in touch with our in-house experts to find the right solution for your IT Infrastructure