Cybersecurity companies in the UAE – how to set up and obtain approvals to undertake cybersecurity work in the UAE
Cybersecurity companies in the UAE are increasing in importance and significance. More than 91% of the UAE population have access to the internet. This is accompanied by a boom in the internet-based economy. New developments such as the cloud, the internet of things and smart cities make use of the interconnectivity provided by the ever-growing cyberspace. These developments allowed the public and private sectors to create and curate products and services tailored to individual needs. Hence, a greater segment of the population and the UAE economy are being exposed to cyberspace.
With the expansion of cyberspace to encompass daily lives, social interactions and economic interactions, cyber-attacks are becoming increasingly sophisticated and prominent. Between January and March 2019, the United Arab Emirates alone experienced 1.1 million instances of phishing attacks and 23 million instances of attempted malware incursions.
Under Federal Law No. 5 of 201, the UAE has made the act of utilising the internet to invade the privacy of another individual, recording a conversation in audio or video form and photographing others without permission, a criminal offence punishable by law.
Key industries that rely heavily on cybersecurity technologies are those that have been increasingly targeted due to the nature of the confidential information associated with them. Health and banking sectors are information-rich industries storing thousands of electronic records holding personal and financial information. Government departments, such as the military, labour and immigration departments and company licencing authorities are also liable for cyberattacks.
Why an increasing number of cybersecurity companies are setting up in the UAE
Worldwide, the cybersecurity industry is estimated to worth around USD 150bn. This number is expected to grow to USD 208bn by 2023. The UAE progressively continues to place itself as a leading tech hub, representing 35% of the regional market and is expected to be worth USD 85B by 2024. International reputation, ideal geographical location, low tax environment and supportive business culture are among several factors that sets the UAE as an attractive market for cybersecurity companies to set up their business.
How to start a cybersecurity company in the UAE
The main challenge is whether to choose between a UAE mainland location or one of the country’s many freezones. Where you decide to set up your company will depend on your organisational needs, the location of your target clients and your staffing and visa requirements.
UAE mainland company setup
Foreign investors have attractive options when setting up their business in the UAE mainland. The key benefit for cybersecurity companies setting up in the mainland is the ability to bid for UAE government and semi-government contracts and tenders. A company set up in a UAE freezone company is not normally able to do business with the mainland and not able to approach UAE government work, or pre-qualify for government and mainland tenders.
The recently implemented Information Security Regulations (ISR) issued by the government of Dubai is a good opportunity for cybersecurity companies to be part of Dubai’s Cybersecurity Strategy. Dubai’s Cybersecurity Strategy is designed to implement a common protection baseline for public and semi-public organisations.
It is important to note that mainland businesses require a local partner or sponsor to hold 51% of the company’s shares. However it is possible to utilise a local corporate sponsor such as PRO Partner Group, using a corporate nominee platform to hold the shares to ensure that the foreign party retains full control of operations, assets, IP and 100% of the revenue.
Additionally, mainland cybersecurity entities offering their services across the UAE, also have full access to the global market and have the ability to diversify their organisational structure. UAE mainland also has 0% corporate and personal tax and full capital and profit repatriation possible with no restrictions.
The UAE has over 40 Freezones distributed across the country each with its own rules and regulations. Entrepreneurs, companies and multinationals setting up a cybersecurity company in one of UAE freezones retain full 100% ownership of their businesses, with 0% corporate and personal tax and full capital and profit repatriation.
Different freezones offer benefits tailored to specific industries. Here are some of the most popular freezones among cybersecurity companies to set up:
Dubai Internet City (DIC) covers over 1.5 million square foot providing access to approximately 1600 business partners across the tech sector, including cybersecurity, big data, the Internet of Things (IoT), artificial intelligence (AI), and more.
As the only technology park in the region that provides both a working and living integrated community, Dubai Silicon Oasis (DSO) provides a hi-tech ecosystem to encourage and foster innovation. Within DSO, cybersecurity startups and existing companies are supported by incubation centres, venture capitalist units and accelerator programs.
Located at Jebal Ali, the heart of Dubai’s industrial zone, Dubai TechnoPark covers an area of 21 million square foot. TechnoPark is home to some of the world’s most high-profile companies specialising in technology, oil, gas, and other industries, lending cybersecurity startups golden collaborative opportunities.
DTEC is home to a vast network of mentors, advisers, and educators offering opportunities for collaborations, pitches, and investments. The 10,000 square foot facility provides an integrated ecosystem for hundreds of startups, SMEs and technology entrepreneurs from around the world. DTEC hosts a range of networking events for collaboration and engagement, including Partner Labs, the Corporate Partner Network, an annual pitch competition, and several acceleration programs.
Steps to take when setting up a cybersecurity company in the UAE
Like other sectors in the country, cybersecurity services are regulated by a number of laws and government departments in the UAE. Here is what you need to know about the prerequisites to set up a cybersecurity company in the UAE.
Firstly, it is essential to identify your specific business activities and match them with the chosen mainland DED activity list or the activity list from the relevant Freezones Authority.
Once you identify the correct activities for the company, match the description of the activity with the actual intended work that you plan to undertake. It can also be worth checking any pre-qualification criteria, particular for Government tenders, as the tender documentation may specify that the company needs a p[articular activity or location in order to qualify for government work.
Once you have matched the relevant activities then look into the specific activity requirements as this may then trigger the requirement to undertake secondary regulatory approvals in order to obtain the licence – for example Telecom Regulatory Authority Approvals (TRA), Supreme Petroleum Council (SPC) Approvals (to work with ADNOC and within Oil and Gas sector), CICPA approval, Health Authority Approval, Civil Defence Approval, and if you are undertaking training in the Cybersecurity space then you may also need ACTVET approval in Abu Dhabi or KHDA approval in Dubai to undertake this training.
The business activity may also require that the company rent a specific type, size and location for commercial space. Renting an office and obtaining the Municipality licence (Ejari / Tawtheeq) is essential to obtain the Trade Licence and set up the company.
Mainland companies can rent commercial space anywhere in that specific Emirate. Freezone companies must rent commercial space within that Freezone only. Freezone commercial space therefore tends to be much more expensive than mainland office space due to greater choice in the mainland.
Choosing a company name is required as part of the initial approval phase to set up the company in the UAE mainland or a Freezone location. In the mainland the name will need to make sense in English and Arabic and will also normally need to contain the chosen activity(s) within the name. The company will also need to check if that name is not already being used, and for example a Limited Liability Company will need to add the suffix “LLC” onto the name.
A company name needs to abide by several conventions:
- Only full names are allowed, no abbreviations – acronyms are allowed
- Cannot include any potentially offensive or blasphemous words
- Some words are restricted to use by UAE government
- The name must be available to register and not conflict with an existing company or trademark
See links here on some advice for deciding on a Trade Name for an LLC in the UAE
The key steps to set up a Cybersecurity company in Dubai, Abu Dhabi and the wider UAE
The main considerations for setting up a Cybersecurity company in mainland UAE, Dubai and Abu Dhabi, as well as the various Freezones are as follows:
- Company set up requirements – search and define the correct activities
- Choose the company name – conflict check the name
- Choose the type of commercial entity to set up – LLC, Sole Establishment or Foreign Branch
- Choice of location and jurisdiction within the UAE – Dubai vs Abu Dhabi / Mainland vs Freezone
- Location of end user / clients / purchaser – where are the clients based (this will drive the above decisions)
- Preparation of correct required documentation – local documents, foreign company documents and individual documents
- Analysis of associated taxes – VAT, import tax, foreign country tax
- Overview of all costs and fees – for set up and ongoing
- Commercial space requirements – is a physical space required
- Local UAE government department regulatory compliance – dependant on location and activity type, will trigger other requirements above (e.g. specific commercial space)
- Undertake set up application process will all relevant government departments
To ensure a time-efficient and cost effective set up of a Cybersecurity business it is always advisable to seek professional help.
Foreign company documents will need to be notarised, legalised and attested via a three-step process:
- Notarised in the country of origin, true copy and Ministry of Foreign Affairs (MOFA) attested.
- Verification by the UAE Embassy’s exclusive verification agent in country.
- Submission of the verified paperwork to UAE Embassy and the respective Consulate covering the state in which the company is based.
Note that PRO Partner Group has a network of agents in various countries and can assist with the processing of foreign documents. PRO Partner Group can also assist once the documents arrive in the UAE to obtain MOFA stamping here
Cybersecurity Licence application
When filing for a cybersecurity licence companies intending to set up their cybersecurity business are required to provide the standard corporate documentation as well as a business plan and experience certificates and individual staff and managers qualification documents. Being aware of the regulatory requirements and completing all the necessary documents can be both difficult and time-consuming.
PRO Partner Group will fully liaise with the respective authorities to ensure a swift and seamless set up for a cybersecurity licence. Our team of company formation experts can guide you through all aspects of the company formation process, including licence elements and regulatory approvals.
Please get in touch with us on +971 (0)4 456 1761 for Dubai or +971 (0)2 448 5120 for Abu Dhabi, email us at firstname.lastname@example.org or complete the contact form below and we will be delighted to assist you.