B2B Software Consulting in Dubai
A Dubai group holding a mainland licence, a JAFZA FZCO and a DIFC entity sits under three data-protection regimes and two payroll systems at once. ERPStack is remote-first: we design the tenancy, the Peppol PINT AE e-invoicing path and the WPS payroll split, then deploy into AWS me-central-1.
Quick Answer
In short: Dubai splits three ways: mainland PDPL under Federal Decree-Law No. 45 of 2021, DIFC Data Protection Law No. 5 of 2020, and ADGM. ERPStack builds one custom ERP that carries all three consent models, emits Peppol PINT AE e-invoices before the 1 January 2027 phase, and runs on PostgreSQL and Next.js in AWS me-central-1 with me-south-1 for recovery.
Regional Compliance
- Federal Decree-Law No. 45 of 2021 (UAE PDPL) — Executive Regulations unissued
- DIFC Data Protection Law No. 5 of 2020, amended July 2025
- ADGM Data Protection Regulations 2021
- UAE eInvoicing: Peppol PINT AE, DCTCE five-corner
- Federal Decree-Law No. 47 of 2022 Corporate Tax; 5% VAT; FTA Audit File
- Federal Law No. 2 of 2019 Article 13: health data residency
Security & Compliance Architecture
Dubai is not one compliance jurisdiction, and most Dubai ERP and CRM vendor pages state it wrongly. Federal Decree-Law No. 45 of 2021, the UAE PDPL, has bound mainland Dubai since 2 January 2022, but its Executive Regulations remain unissued, so the fine schedule deferred to a Cabinet decision does not yet exist.
The free-zone split is the architecture
A DIFC company sits outside the federal PDPL and inside DIFC Data Protection Law No. 5 of 2020, in force since 1 July 2020 and consolidated in July 2025 by Amendment Law No. 1 of 2025: its own Commissioner of Data Protection, its own DIFC Courts, its own Article 26 adequacy list. An ADGM entity answers to the ADGM Data Protection Regulations 2021 of 14 February 2021; JAFZA, DMCC and DAFZA stay federal. Multi-tenant Architecture in Dubai is a licensing question before it is a PostgreSQL question.
Model adequacy as data, not as code
PDPL Article 10 ties transfers out of Dubai to an adequacy determination the UAE Data Office has not published, so ERPStack holds destinations in a versioned PostgreSQL table read by the export API through Drizzle ORM. DIFC Article 41 wants the approximate count of data subjects and records breached, so the ERP enumerates rows per entity. DIFC Schedule 2 caps fines at USD 100,000; the Article 62(3) general fine is uncapped.DIFC Regulation 10 covers your models
Effective 1 September 2023, DIFC Data Protection Regulation 10 governs autonomous and semi-autonomous systems processing personal data. A Dubai credit-scoring or approval-routing model inside a DIFC entity needs an appointed autonomous systems officer and a register of necessity, proportionality and third-party safeguards — that is RBAC, audit schema, Zero-Trust Security and an OpenTelemetry Observability trace on every automated decision inside the ERP — not a policy PDF.Payroll is where Dubai ERP builds die
MOHRE takes a Wage Protection System SIF batch every cycle, and Ministerial Resolution No. 0340 of 2026 makes wages overdue on day 2, suspends work permits on day 5, fines on day 11 and reaches prosecution referral by day 21. Article 51 of Federal Decree-Law No. 33 of 2021 accrues gratuity at 21 days’ basic wage a year and 30 days after five years, capped at two years’ wage. DIFC staff are not on that curve: DEWS funds 5.83% or 8.33% monthly. Two liability engines, one PostgreSQL ledger — the gap Oracle NetSuite, Microsoft Dynamics 365, Sage X3 and Epicor leave in spreadsheets.Health and Dubai government data cannot leave
Article 13 of Federal Law No. 2 of 2019 forbids storing, processing, generating or transferring UAE health data abroad, with narrow exceptions under Ministerial Decision No. 51 of 2021, so a Dubai healthcare group loses cross-region replication and me-central-1 becomes its only write path. Dubai government work adds the DESC Information Security Regulation under Dubai Law No. 11 of 2014, whose thirteen domains bind contractors. ERPStack builds API-first systems auditable against SOC 2 and ISO 27001; we hold neither.- Residency is a deployment topology, not a policy pageA licence boundary only holds if the infrastructure enforces it. Each entity gets its own isolated network in AWS me-central-1, its own PostgreSQL cluster reached through Drizzle ORM, and Rediscaches that never cross it — so a DIFC company’s rows stay unreadable from the mainland tenant.Terraform holds the whole layout, Zero-Trust Security governs access between tiers, and an Immutable Audit Trail records every read, which is what a DFSA or ADGM examiner actually asks to see.
Engineering Blueprint
A Dubai group is rarely one company. A mainland LLC, a JAFZA FZCO clearing through Jebel Ali Port, a DMCC commodities entity and a DIFC arm are four legal persons under three data-protection regimes and two payroll systems, so the opening question in Dubai custom ERP development is which of them owns a row — not which SAP S/4HANA or Oracle NetSuite module to licence.
Tenancy follows the trade licence
ERPStack partitions Dubai deployments by licence, not by business unit: one PostgreSQL schema per entity, the governing regime on every row, because a DIFC record and a mainland record fail different transfer tests — DIFC Article 26 adequacy against PDPL Article 10. Drizzle ORM enforces it at query time. A flat multi-tenant table cannot express a Dubai licence structure, and that is where an Odoo or Zoho Creator rollout starts accruing Technical Debt.
// Drizzle ORM + PostgreSQL: the Dubai licence is a column, not a config flag
export const regime = pgEnum('regime', ['mainland', 'difc', 'adgm', 'jafza', 'dmcc']);
export const invoices = pgTable('invoices', {
licenceRegime: regime('licence_regime').notNull(),
trn: varchar('trn', { length: 15 }), // 15-digit FTA Tax Registration Number
vatRate: numeric('vat_rate').default('0.05'), // 5% UAE VAT since 1 January 2018
pintAeDocId: varchar('pint_ae_doc_id'), // Peppol PINT AE document identifier
});The Peppol PINT AE outbound path
The UAE Ministry of Finance is a listed Peppol Authority, and Dubai e-invoicing runs a decentralised DCTCE five-corner model: supplier, the supplier’s Accredited Service Provider, the buyer’s ASP, the buyer, and the Federal Tax Authority. Above AED 50 million turnover the ASP was due by 30 October 2026 and go-live is 1 January 2027; smaller Dubai businesses follow on 1 July 2027, government entities on 1 October 2027. ERPStack ships an idempotentREST queue with Redis retries, an Immutable Audit Trail and Zod-validated PINT AE fields.
me-central-1 first, me-south-1 for the copy
A Dubai logistics or retail group’s write path belongs in AWS me-central-1 — open since 29 August 2022 with three Availability Zones, provisioned by Terraform, with Bahrain me-south-1 as the recovery pair 482 km away. On Microsoft Azure, uaenorth (Dubai) carries availability zones but uaecentral (Abu Dhabi) is restricted-access, so a Dubai design that stays on Microsoft Azure has no freely usable second in-country region the way london or frankfurt does. The same Next.js 16, TypeScript 5.9 and Drizzle ORM stack served from AWS eu-west-1 crosses 5,900 km and puts a 59 ms floor under every PostgreSQL round trip. Those figures are engineering targets, not measured SLAs.
What you own at handover
Every Dubai build ships as source you own outright: a Next.js 16 and React 19 application in TypeScript 5.9, a PostgreSQL schema behind Drizzle ORM 0.45, Terraform for the AWS me-central-1 account, and Sentry plus OpenTelemetry Observability wired in from day one. No runtime licence, no per-seat fee, and no vendor holding the DIFC or mainland data.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Dubai
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyOrder-to-Cash & GST Compliance Engine
GST-compliant invoicing, consignment settlement, and receivables automation for a D2C handcraft brand
Read Case StudyTarget Industries in Dubai
Frequently Asked Questions
Only to DIFC Data Protection Law No. 5 of 2020. A DIFC entity sits outside Federal Decree-Law No. 45 of 2021 and answers to the DIFC Commissioner of Data Protection and the DIFC Courts. A Dubai holding company that also runs a mainland LLC is under both regimes at once, so the ERP must record which licence owns each PostgreSQL row.
Dubai logistics, retail and construction businesses at AED 50 million revenue or above had to appoint an Accredited Service Provider by 30 October 2026 and issue through the system from 1 January 2027. Smaller businesses follow on 1 July 2027 and government entities on 1 October 2027. The voluntary pilot opened 1 July 2026.
Not with one liability model. Mainland Dubai staff accrue gratuity under Article 51 of Federal Decree-Law No. 33 of 2021 and are paid through the MOHRE Wage Protection System. DIFC staff are funded monthly into DEWS at 5.83% or 8.33% of basic salary, so nothing accrues. One ERP, two payroll engines, one consolidated PostgreSQL ledger.
If that Dubai company holds one mainland licence and sells business-to-business, a localised Microsoft Dynamics 365 or Odoo deployment plus an Accredited Service Provider is cheaper and faster, and ERPStack will say so. Custom ERP development earns its cost when a group spans mainland, JAFZA and DIFC entities and needs the Emiratisation and WPS reporting those packs leave in spreadsheets.
It depends on the data class, not the company. Ordinary personal data may leave Dubai under PDPL Article 10 once an adequacy determination exists, but the UAE Data Office has published none, so most Dubai controllers keep the write path in AWS me-central-1. Health data is absolute: Article 13 of Federal Law No. 2 of 2019 bans transferring it abroad.
Federal Decree-Law No. 45 of 2021 has bound Dubai since 2 January 2022 even though its Executive Regulations remain unissued. What is missing is the fine schedule deferred to a Cabinet decision and a fully operating UAE Data Office. Build the consent, retention and transfer logic now, and hold the adequacy list as PostgreSQL configuration rather than code.
DIFC Laws Amendment Law No. 1 of 2025 took effect on 8 July 2025. Data subjects can now sue a controller or processor directly in the DIFC Courts without first going to the Commissioner, sub-processors are explicitly in scope, and foreign authority requests must be tested for validity and proportionality. A Dubai DIFC tenant therefore needs per-row PostgreSQL lineage and a logged disclosure decision.
Yes, if the entity running it is incorporated in the DIFC. DIFC Data Protection Regulation 10 took effect on 1 September 2023 and covers autonomous and semi-autonomous systems processing personal data. High-risk commercial use needs an appointed autonomous systems officer and a register of necessity, proportionality, data-subject access and third-party safeguards. In a Dubai ERP that register is a PostgreSQL table.
Dubai private-sector employers with 50 or more staff must raise skilled Emirati headcount by 2% a year toward 10% by 2026, and the contribution for an unfilled skilled role reached AED 9,000 a month, AED 108,000 a year. Firms with 20 to 49 staff in fourteen priority sectors face AED 108,000 from January 2026. The ERP classifies skilled roles and snapshots headcount at each deadline.
The Federal Tax Authority expects tax accounting software to produce an FTA Audit File at invoice level in comma-separated form, and lists accredited vendors after a AED 10,000 EmaraTax registration. MOHRE audits Wage Protection System files under Ministerial Resolution No. 0340 of 2026. In the DIFC the Commissioner of Data Protection enforces Law No. 5 of 2020 alongside the DFSA, and Dubai government contracts add the DESC Information Security Regulation.