Data centres have become a new asset class as the appetite for consuming data is increasing at a rapid pace and this has aggravated due to new types of workers and job roles becoming increasingly diverse for the last four months due to Covid-19.
The pandemic underscored the importance of digital transformation across the globe and the dependence on information technology increased to keep businesses afloat, driven by today's data-focused economy.
However, Keri Watkins, Senior Lawyer at Baker McKenzie Habib Al Mulla, said that legal systems in the Gulf Cooperation Council (GCC) countries should carefully be considered when seeking to expand into the region.
“With foreign ownership laws and restrictions over owning real estate at play in the UAE, the most popular structure adopted in the UAE is the leasehold type model,” she said.
Moreover, she said that careful consideration also needs to be given to the term of the lease, as the Dubai Land Department adopts a view that leases with a term of 10 years or more (known as long-term lease contracts), amount to Real Property Rights (which are limited to UAE citizens, nationals of GCC countries, companies wholly owned by qualified nationals and public joint-stock companies).
Therefore, in addition to being subject to the foreign ownership restrictions, she said that long-term lease contracts require registration with the Dubai Land Department and the approach varies from Emirate to Emirate.
Watkins said that there has never been a time or a greater need for internet providers, connectors and data centres to host the computer systems and supplementary components.
Big tech companies such as Amazon, Microsoft, SAP, Oracle, Alibaba and Equinix have shown interest in the region, especially in the UAE and Saudi Arabia, to open data centres.
The pandemic has impacted several industries such as transportation, hospitality and manufacturing but certain sectors like education, media and communication, government, healthcare, and retail aggressively accelerated their adoption of cloud.
According to research firm International Data Corporation, spending on public cloud services in the UAE is expected to grow 27.4% year on year in 2020 to reach over $400 million.
In terms of cloud deployment models, IDC said that infrastructure-as-a-service (IaaS) has seen significant growth during the crisis, with spending to increase 30% year on year in 2020 while the combined growth of both SaaS and PaaS is at 26.1% over the same period.
In Saudi Arabia, Khaled Zowayed, Senior Lawyer at Baker McKenzie, said that leases have been the most common model applied for the transactions and this could be due to the restrictions on foreign ownership compared to the generally unregulated leasing market.
Zowayed said the leasing market in Saudi Arabia, generally, allows freedom of contract but there are restrictions from Sharia on passing on obligations that are typically landlord obligations such as structural repairs, ownership taxes and property insurance onto the tenant and these must be carefully navigated to achieve the commercial outcome desired.
“There are also restrictions from Sharia on limiting future losses, indemnities and late payment penalties that often require standard form data centre agreements to be revisited,” he said.
Bahrain adopts a more liberal foreign ownership model than the UAE and Saudi Arabia, he said and this has led to AWS to announce its first availability zone in the Middle East.
“The structures available in Bahrain are therefore not restricted and can range from ownership, joint ventures and leasehold interests,” he said.
Industry experts chalk out the legal issues to consider when operating a data centre.
The Dubai Landlord and Tenant law prohibits a tenant (data centre operator) from subletting the premises without the prior approval of the landlord (data centre owner), unless or otherwise agreed between the parties.
As the data centre operator will normally have standard agreements with its customers, there must be an absolute right for the operator to enter into such contracts without the need for the data centre owner to approve each contract.
While explicit prohibitions do not necessarily exist in Saudi Arabia and Bahrain, it is better if clear subleasing rights are provided in the underlying documents, if it is based on a leasehold structure.
There is no federal standalone data protection law in the UAE, however, the data protection concepts are captured in various other laws and regulations.
Saudi Arabia does not have a standalone data protection law but the principles of privacy of information and personal data do exist in Sharia.
Bahrain has passed a personal data law recently and it exists along with other data protection provisions from other laws in the areas of banking, telecommunications and employment. A new Personal Data Protection Authority is also to be established in accordance with the law with inspection rights to ensure compliance.
There are, however, some sector-specific data protection obligations that exist in regulations about certain sectors, including cybersecurity, telecommunications, and employment. Careful consideration should be given to each of these regulations as well as the basic principles derived from Sharia that protect personal and private information.
Both the data centre owner and operator should also consider the implications of the EU General Data Protection Regulation which captures the transfer and use of personal data outside of the EU (including Middle East).
Regulatory and licensing requirements are an important consideration for both data centre owners and operators, and each should ensure that they fully understand the position.
The Telecommunications Regulatory Authority (TRA) is the body responsible for governing the sector in the UAE.
Ensuring compliance with the security requirements, as imposed by the National Electronic Security Authority, is also a mandatory requirement.
In Saudi Arabia, the Communications and Information Technology Commission (CITC) regulates data centres while there is no single regulator for data centres in Bahrain.
A careful approach to full compliance with all applicable regulations, in relation to doing business and commercial registration, must be carefully considered in all of these jurisdictions.
Service level agreement
Service level agreements (SLAs) are commonly used in the UAE and Saudi Arabia, like they are used elsewhere in the globe, and are typically incorporated into the lease agreement by way of a schedule.
The data centre operator should ensure that the services that will be provided by the owner and/or the facility manager are acceptable (including the power availability, temperature, network infrastructure, commitments and maintenance).
The agreements governing the relationship between the data centre owner and the operator will typically address the circumstances within which the owner and operator can terminate their relationship.
Most agreements in the region have very limited termination rights in favour of a data centre operator. While this recommendation appears obvious, the importance of carefully reading the draft agreements between the parties before signing the final form cannot be overemphasised.
Governing law and disputes
The parties should pay particular attention to the governing law provisions of the agreement and the forum to which disputes should be referred.
Generally, parties entering into contracts in the UAE are entitled to opt for a foreign law to govern the relationship - however, this is not the case for matters pertaining to a property located in the UAE.
Local law dictates that property located in the UAE is a matter of public policy and the 'laws of the land' must govern the agreement between the parties.
Any disputes over the lease agreement in Dubai should be referred to the Rental Dispute Settlement Centre at the Dubai Land Department. There is controversy around the arbitrability of real estate disputes in Dubai, as real estate is an area that has been regarded by the UAE courts as a public order matter.
Similar provisions also apply in Saudi Arabia and Bahrain, if the subject matter of the agreement is real estate in the country. However, if the underlying agreement relates to services or any other aspect of the data centre other than specifically real estate, foreign governing law provisions are generally permitted.
The ordinary courts settle leasing disputes in both these jurisdictions.
While some agreements include a pre-agreed sum of damages in the event of termination without cause, most lease type agreements do not.
In the latter case, this does not usually mean that there are no damages payable but actually that a wronged party may be able to claim damages in the amount of the full fees they would have received had the agreements not been unlawfully terminated. The governing law provision is also a key consideration when quantifying damages as different jurisdictions have varying positions on the ability to award damages for future economic loss.
In the UAE, for example, damages are typically awarded based on the actual loss of the party claiming relief and while contractual provisions are likely to be generally applied by a Bahraini court.
In Saudi Arabia, regardless of the text of the contract, only direct and actual losses are usually awarded.