EU Data Act for Dubai Cloud and SaaS Vendors: Switching Fees Hit Zero on 12 January 2027

Regulation (EU) 2023/2854 — the EU Data Act — has applied since 12 September 2025, and on 12 January 2027 every switching charge a cloud or SaaS provider levies on an EU customer drops to zero, data egress included. It binds providers "irrespective of their place of establishment", so a Dubai-headquartered SaaS company with one paying customer in Germany is squarely in scope. If you sell software or connected hardware into Europe from the UAE, your contracts, exit tooling and pricing model all need work before that date.

Here is the part most UAE vendors have missed. The phrase "irrespective of their place of establishment" appears three separate times in Article 1(3). No office test, no revenue threshold, no local-presence trigger. Place a connected product on the EU market, or provide a data processing service to a customer in the Union, and the Regulation reaches you from Dubai Internet City exactly as it reaches a provider in Frankfurt. The Cyber Resilience Act taught a lot of Dubai founders that lesson in September. The Data Act is the same lesson with a sharper commercial edge, because this one changes what you are allowed to charge.

Why a Dubai software business should care at all

Three numbers set the stakes. Gartner puts Middle East and North Africa IT spending at USD 169 billion in 2026, data centre systems the fastest-growing line at +37.3% year on year — the regional cloud estate is being built right now, under contracts signed right now. Worldwide sovereign cloud IaaS spending reaches USD 80 billion in 2026, up 35.6%, with the Middle East and Africa fastest-growing at +89%. On the demand side, UAE–EU non-oil trade ran at USD 67.6 billion in 2024, up 3.6%, the EU taking 8.3% of all UAE non-oil trade.

Dubai's software sector is not a bystander in that flow. The emirate hosts more than 2,300 technology companies, and the Dubai Chamber of Digital Economy supported 485 digital startups in the first half of 2026 alone, up 57.5% year on year, of which 51% were international. International means EU customers. EU customers mean the Data Act.

There are two distinct ways it lands on a UAE business, and they have different deadlines:

• You run a data processing service — IaaS, PaaS or SaaS — with any customer in the Union. Chapter VI switching duties apply to you now; the full charge ban lands 12 January 2027.
• You make a connected product or related service sold into the EU. Article 3(1) access-by-design already bites: it applies to connected products and their related services placed on the EU market on or after 12 September 2026. Your current model is caught; the one already on shelves before that date is not.

The four clocks, and what each one actually does

Article 50 staggers the Regulation deliberately. Getting these dates wrong is how a compliance budget gets spent in the wrong quarter.

Date	What switches on	Who it hits
12 Sep 2025	General application. Chapter VI switching contract terms, cost-based switching charges only, Chapter IV unfair-terms test on new contracts	All in-scope providers and data holders
12 Sep 2026	Article 3(1) access-by-design: connected products and related services must let users get their data out in a secure, comprehensive, machine-readable format	Products placed on the EU market on or after this date
12 Jan 2027	All switching charges removed, including data egress charges for the switch	Every provider of data processing services to EU customers
12 Sep 2027	Chapter IV unfair-terms test extends to older contracts of indefinite duration, or expiring 10+ years after 11 January 2024	Legacy enterprise agreements

What Chapter VI forces into your contract

The switching rules are not a vague interoperability aspiration. Article 25 writes hard numbers into the agreement itself:

• A maximum notice period of two months for the customer to initiate a switch.
• A mandatory maximum transitional period of 30 calendar days during which you keep the service running and actively assist the migration — continuity, reasonable assistance to the customer and to the incoming provider, disclosure of continuity risks, and a maintained security posture throughout.
• If 30 days is technically unfeasible, you must say so within 14 working days, explain why, and name an alternative period that cannot exceed seven months.
• After the transition ends, the customer gets at least a further 30 calendar days to retrieve exportable data and digital assets.
• The contract must expressly state the right to switch and set out the migration procedure.

Then Article 30 splits by delivery model, and that distinction decides your engineering bill. The duty to facilitate functional equivalence — re-establishing a minimum level of functionality on the destination service for shared features — applies only to IaaS, expressly not to other delivery models, and even for IaaS only to features both source and destination offer independently. SaaS and PaaS get a lighter but still real obligation: open interfaces free of charge, compatibility with harmonised standards once published in the Union repository, and export in a structured, commonly used, machine-readable format.

For multi-tenant SaaS sold from Dubai, that means a documented, free, complete export API — not a CSV dump of three tables and a support ticket. Tenant-scoped export is an architecture decision, not a feature you bolt on in December.

The AED number: what an exit costs today

Switching charges are not theoretical in the UAE, because egress out of the local regions is priced at the high end globally. AWS Middle East (UAE), me-central-1, bills data transfer out to the internet at USD 0.18 per GB. Azure UAE North sits in Bandwidth Zone 3 — alongside Brazil and South Africa — at USD 0.181 per GB for the first 10 TB, more than double the Zone 1 rate. Both give the first 100 GB per month free. At the pegged AED 3.6725, that is roughly AED 0.66 per GB leaving a Dubai region.

Data to move out	At USD 0.18/GB	AED (at 3.6725)	From 12 Jan 2027, EU customer
5 TB	USD 900	AED 3,305	AED 0
50 TB	USD 9,000	AED 33,053	AED 0
200 TB	USD 36,000	AED 132,210	AED 0
1 PB	USD 180,000	AED 661,050	AED 0

Add 5% VAT where a UAE-resident entity invoices you. That last column is the whole point of the Regulation: the financial penalty for leaving is what made lock-in enforceable, and for EU customers it is being legislated to zero.

The hyperscalers already blinked. Read the small print.

Most Dubai teams assume exit fees are still a wall. They are not, and have not been since 2024 — but the free-exit programmes are narrower than the headlines suggested.

Google Cloud moved first, in January 2024, dropping egress charges for customers transferring data out when switching provider. In September 2025 it added Data Transfer Essentials for EU and UK customers: no-cost transfer between Google Cloud and competing clouds — but only for "in-parallel" processing of workloads belonging to the same organisation across two or more providers. Intra-organisation traffic only, nothing serving outside users, and you must opt in with a configuration naming the services and destinations.

AWS followed in March 2024 with free data transfer out to the internet when moving off AWS. The conditions matter: you must contact AWS Support to request the credits, the account must be in good standing and a designated payer account, non-EU customers get 180 days to finish the migration, and repeat applications draw extra scrutiny. You need not close the account. EU customers are pointed at the AWS EU Data Act Addendum instead.

Microsoft was last, on 13 March 2024, allowing free egress for customers taking data out of Azure over the internet to switch to another provider.

Three things these programmes are not. Not automatic — AWS in particular is a support-ticket credit, not an absence of charge. Not a licence to run ordinary traffic for free; standard egress and cross-region transfer stay billable. And from 12 January 2027 they stop being a vendor favour you negotiate and become a legal floor for EU customers, which changes the conversation at renewal.

What the ban does not do

This is where good advice separates from blog noise. From 12 January 2027 the prohibition covers switching charges and charges for parallel multi-cloud use. It does not:

• Abolish everyday egress billing. Serving your users, replicating across regions, running a CDN origin pull — all still metered. Our FinOps guide for Dubai teams remains the relevant document for that bill.
• Void your committed spend. Reserved instances, savings plans and fixed-term enterprise agreements survive intact. You can leave without an exit fee and still owe the commitment.
• Do the engineering. Rebuilding on a new platform is the same project it always was — see the realistic bands in our Dubai cloud migration cost breakdown.
• Guarantee feature parity. Functional equivalence is IaaS-only, and only for features both sides already offer. A managed proprietary service has no counterpart to be made equivalent to.

Penalties, and why they are not a rounding error

Article 40 leaves penalty levels to Member States, which had to notify their rules by 12 September 2025, and requires them to be effective, proportionate and dissuasive. Authorities weigh the gravity, scale and duration of the infringement, remediation, prior breaches, gain or loss avoided, and annual EU turnover. Crucially, for infringements of Chapters II, III and V, data protection supervisory authorities may reach for the GDPR Article 83 fining powers — a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. At about AED 4.14 to the euro, that fixed ceiling alone is roughly AED 82.8 million.

For a Dubai vendor the realistic risk is rarely a headline fine. It is a European enterprise buyer's procurement team running a Data Act clause check, finding no Article 25 switching schedule and no documented export path, and removing you from the shortlist. That is the loss that actually shows up in your pipeline.

There is no UAE equivalent, and that matters locally

The UAE has nothing comparable for business-to-business cloud switching. Federal Decree-Law No. 45 of 2021, the PDPL, gives a data subject the right to receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller — an individual right, not a commercial switching right — and its Executive Regulations remained unpublished as of October 2026, more than four and a half years after the law came into force, leaving thresholds and procedures inoperative. Our UAE PDPL compliance checklist covers what is actually enforceable today.

The practical consequence for a Dubai buyer: your strongest lever on an incumbent vendor is not UAE law, it is whether that vendor also serves EU customers. If it does, it is building Article 25 exit machinery anyway — so insist the same terms appear in your UAE contract.

How Aquarius handles this

We treat Data Act readiness as four workstreams, not a legal review. Scope mapping: which product lines are data processing services, which are connected products, and which EU customers actually trigger the Regulation. The contract layer: Article 25 notice, transition and retrieval clauses, plus an honest technical-unfeasibility position if 30 days does not work for your architecture. The engineering: a complete, documented, free export path in a structured machine-readable format, tenant-scoped and tested by actually restoring it somewhere else. Then pricing, because a line item you can no longer charge an EU customer from 12 January 2027 has to come out of the model before it comes out of margin.

Shortcut on the contract layer: the European Commission published a Recommendation on 20 November 2025 carrying non-binding Model Contractual Terms for data access and use — four drafts, from data holder to user through to voluntary sharing — plus Standard Contractual Clauses for cloud computing contracts. Starting from those beats drafting from scratch, and a European buyer recognises them on sight.

FAQ

Does the EU Data Act apply to a Dubai company with no EU office?

Yes, if you provide a data processing service to a customer in the Union or place a connected product on the EU market. Article 1(3) uses the phrase "irrespective of their place of establishment" three times. There is no establishment or turnover threshold.

Do I have to stop charging egress fees to UAE customers too?

No. The Regulation protects customers in the Union. In practice the hyperscalers standardised free-exit programmes globally rather than run two models, and large UAE buyers increasingly demand the EU terms by reference — so expect the commercial norm to converge even where the law does not reach.

My product is already on sale in Europe. Does access-by-design apply?

Article 3(1) applies to connected products and their related services placed on the EU market on or after 12 September 2026. A unit placed on the market before that date is outside it, but the next model or variant you launch is caught — which is why this belongs in the current hardware roadmap, not a later one. If you also ship firmware, read it alongside the EU Cyber Resilience Act timeline.

What is the maximum time I can take to migrate a customer out?

30 calendar days as the default mandatory transitional period. If that is technically unfeasible you must notify the customer within 14 working days with reasons and propose an alternative period, capped at seven months. The customer then has at least 30 further calendar days to retrieve exportable data.

Is SaaS really in scope, or only infrastructure?

SaaS is in scope for the switching and charge rules. What SaaS escapes is the Article 30(1) functional-equivalence duty, which is limited to the IaaS delivery model. SaaS and PaaS still owe free open interfaces, standards compatibility once harmonised standards are published, and structured machine-readable export.

Where to start this quarter

Pull your three largest EU customer contracts and search them for a switching clause. If there is no notice period, no transitional period and no retrieval window, you are already outside Chapter VI and have been since 12 September 2025. Then price the gap: what does your export API not export, and what does the switching line item contribute to revenue that will be illegal to bill an EU customer from 12 January 2027.

We scope that in a fixed-fee review and come back with the clause set, the export-path gaps and the AED cost of closing each. See pricing, browse what we build, or tell us which EU customers you have and we will tell you which clocks are running.