Data Backup and Disaster Recovery in the UAE and Saudi Arabia: What Actually Protects You
Published · PRO TECHnology Enterprise IT
Most companies discover their backup does not work on the day they need it. This is a practical guide to the 3-2-1 rule, air-gapped archiving, encrypted portable storage and recovery testing, from the division PRO TECHnology has run since 1998.
- The rule
- 3-2-1: three copies, two media types, one kept off-site; ransomware guidance adds one offline
- Why air gap matters
- Ransomware encrypts what it can reach, including connected backups
- Long term archive
- Disk Archive ALTO disk-based cold storage as an alternative to tape
- Portable data
- Kanguru hardware encrypted USB and SSD, AES 256-bit, FIPS certified models
- Remote control
- KRMC can disable a lost or stolen managed drive when it next connects to a computer that can reach the console
- Creative and media
- LaCie storage for video editing, post-production and photography
- Device layer
- FileWave manages and re-images endpoints across macOS, Windows and mobile
- The test
- A backup you have never restored from is a hypothesis, not a backup
- Retention
- Match retention to your regulatory obligation, not to disk cost
- Division
- PRO TECHnology Enterprise IT, Dubai, since 1998
- Coverage
- UAE, Saudi Arabia and the wider GCC
- Contact
- +971 4 343 5501, sales@protech.ae
Key takeaways
- The 3-2-1 rule means three copies on two media types with one off-site. Ransomware guidance adds an offline copy, and that is the part most companies fail.
- RAID replicates deletion, corruption and ransomware across every disk in the array, so it is redundancy rather than a backup.
- Disk Archive ALTO keeps long-term data on spun-down disks, and a replica set removed to a vault gives an offline copy the network cannot reach.
- Restore a real system to isolated hardware quarterly and time it, because that measured figure is your true recovery time.
The 3-2-1 rule, and where UAE businesses break it
Three copies of the data, on two different media, with one off-site. The rule itself does not require an offline copy, but ransomware guidance from CISA and the UK NCSC does. Most companies manage the three copies and fail the offline part, which is the only part ransomware cares about.
Three copies
Production, plus two independent backups. A RAID array is redundancy, not a backup.
Two media types
Disk and archive, or disk and removable, so a single technology failure cannot take everything.
One off-site, and one offline
This is the copy that survives ransomware, because malware cannot encrypt what it cannot reach.
Cloud is not automatically off-site
A cloud drive that is mounted and writable from an infected machine is just another connected copy.
Ransomware changed what a backup has to survive
Modern ransomware looks for backups first. It is not enough for a copy to exist; it has to be unreachable from the compromised network at the moment of the attack.
Air gapped archive
Disk Archive ALTO keeps long-term data on spun-down disks, and a full replica set can be removed to a vault as an offline copy.
Immutable retention
Set retention so a copy cannot be altered or deleted inside its window, even by an administrator account.
Encrypted portable copies
Kanguru hardware encrypted drives keep the keys on the device, so the data on a lost, locked drive stays unreadable without the password. Our guide shows how a Kanguru Defender HDD350 works as a secure backup drive in a rotation.
Kill a lost drive remotely
The Kanguru Remote Management Console can disable a lost or stolen managed drive the next time it connects to a computer that can reach the console.
Match the storage to the job
Backup, archive and working storage are three different problems. Using one product for all three is how companies end up paying premium prices to store data nobody will ever open again.
Working storage
LaCie for editing, photography and post-production, where read speed is the constraint.
Backup
Fast to write, fast to restore, retained for weeks or months. This is your operational safety net.
Archive
Retained for years at a low cost per terabyte. Disk Archive ALTO is a disk-based alternative to tape.
Endpoints
FileWave re-images and restores devices, so a lost laptop is an inconvenience rather than an incident.
Test the restore, not the backup
The backup job reporting success tells you a file was written. It tells you nothing about whether you can get your business back. The only meaningful test is a restore, done on a schedule.
Restore drill quarterly
Pick a real system, restore it to isolated hardware and time it. That number is your actual recovery time.
Know your RTO and RPO
How long can you be down, and how much data can you afford to lose? Everything else follows from those two answers.
Document who does what
At 3am the person who built the backup may be unreachable. The runbook matters more than the technology.
Review it after you grow
A backup designed for 5TB and twenty staff quietly stops being adequate. Revisit it annually.
What UAE and Saudi rules require of backups
Several regulators turn “have a backup” into specific duties. The wording below is summarised from the UAE Information Assurance Standard v2.1, ADHICS v2, NCA’s Essential Cybersecurity Controls and the PDPL Implementing Regulation.
| Rule | What it requires | Who it applies to |
|---|---|---|
| UAE Information Assurance Standard v2.1, T3.1.7 Information Backup | Back up information and software; decide what needs backup, how often and how backups are protected; document the procedures. | Federal entities and critical information infrastructure; emirate entities through their programmes |
| ADHICS v2 (Abu Dhabi Department of Health), CS 1.2 and DP 1.4 | A cloud environment for health information must be hosted within the UAE, including backup and disaster recovery; health data is not stored, processed or transferred outside the UAE without approval. | Any entity handling Abu Dhabi health data |
| NCA ECC-2:2024, 2-9-3 (Saudi Arabia) | Backups cover critical technology and information assets, allow quick recovery after incidents, and are tested periodically. | Government entities and their affiliated companies |
| PDPL Implementing Regulation, Article 8 (Saudi Arabia) | When personal data must be destroyed, all copies are destroyed, including backups. | Controllers processing personal data in the Kingdom |
Two consequences are easy to miss. Health data in Abu Dhabi cannot rely on a backup copy held in a foreign cloud region, so the offline and archive copies stay in the country. And a Saudi destruction request reaches backups too, so retention has to be planned for every copy, not only the live one. How long records must be kept is covered on our Disk Archive ALTO page, and the Saudi control map on Enterprise IT in Saudi Arabia.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of media, with at least one copy off-site. The rule does not require an offline copy, but ransomware guidance does: the offline copy is what protects you against ransomware, because malware can only encrypt storage it can reach from the infected network.
Does RAID count as a backup?
No. RAID protects against a disk failing, not against deletion, corruption, ransomware or a site incident. If a file is encrypted or deleted, RAID faithfully replicates that across every disk in the array. You still need independent backups.
What is air-gapped backup and why does it matter for ransomware?
An air-gapped copy is physically disconnected when not in use, so it cannot be reached from a compromised network. Disk Archive ALTO can provide one for long-term data: idle disks are spun down inside the system, and a full replica set can be removed and kept in a vault. Only the removed set is physically disconnected, and an offline copy is not the same as immutable storage.
Is cloud storage enough on its own?
Only if at least one copy is genuinely unreachable from your production environment. A cloud drive that is mounted and writable from an infected workstation will be encrypted along with everything else. Cloud plus an offline archive is the combination that holds up.
How should we move data securely between sites in the UAE?
Use hardware encrypted portable storage rather than consumer USB sticks. Kanguru Defender drives keep the encryption engine and keys on the device with AES 256-bit encryption, and the Kanguru Remote Management Console lets administrators disable a lost or stolen managed drive the next time it connects to a computer that can reach the console. Our Defender SSD350 guide covers carrying large confidential files on an encrypted external SSD.
How often should we test a restore?
At least quarterly, and always after a significant infrastructure change. Restore a real system to isolated hardware and time it. That measured figure is your true recovery time, and it is usually longer than people expect.
What is the difference between backup and archive?
Backup is a short-term operational copy for recovering recent work, optimised for speed of restore. Archive is long-term retention of data you must keep but rarely open, optimised for cost per terabyte and durability. Using backup storage for archive is expensive, and using archive for backup is slow.
What do UAE and Saudi regulations require for backups?
In the UAE, the Information Assurance Standard v2.1 (T3.1.7) requires entities to back up information and software to documented procedures, and ADHICS v2 keeps Abu Dhabi health data, including backup and disaster recovery, inside the UAE. In Saudi Arabia, NCA ECC-2:2024 (2-9-3) requires backups of critical assets, quick recovery and periodic testing, and the PDPL Implementing Regulation extends destruction of personal data to backups.
Does NCA ECC require restore testing?
Yes. Control 2-9-3 of ECC-2:2024 includes periodic testing of how effectively backups can be recovered, alongside backup scope and quick recovery after cybersecurity incidents.
النسخ الاحتياطي واستعادة البيانات بعد الكوارث للشركات في الإمارات
حماية بيانات الشركات تبدأ بقاعدة 3-2-1: ثلاث نسخ من البيانات، على نوعين مختلفين من وسائط التخزين، ونسخة واحدة على الأقل خارج الموقع، وتضيف إرشادات الحماية من الفدية نسخة غير متصلة بالشبكة. النسخة غير المتصلة هي التي تنجو من هجمات الفدية، لأن البرمجيات الخبيثة لا تستطيع تشفير ما لا تصل إليه. نظام RAID ليس نسخة احتياطية، فهو يحمي من تعطل قرص واحد فقط. توفر بروتكنولوجي حلول الأرشفة طويلة المدى عبر أنظمة Disk Archive ALTO للتخزين البارد على الأقراص كبديل عن الشرائط، وأقراص Kanguru المشفّرة بالعتاد بتشفير AES 256 بت مع إمكانية تعطيل أي قرص مفقود أو مسروق عن بُعد، ووحدات تخزين LaCie للمونتاج والإنتاج الإعلامي، وإدارة الأجهزة عبر FileWave. اختبروا الاستعادة فعليًا كل ربع سنة، فالنسخة التي لم تُستعد منها بياناتك من قبل ليست نسخة احتياطية بل افتراض. قسم تقنية المعلومات للمؤسسات في بروتكنولوجي يخدم الإمارات والسعودية ودول الخليج منذ عام 1998.
Find out whether your backup would survive a bad Tuesday
We will review your current backup and retention against your recovery objectives and your regulatory obligations, and tell you plainly where the gaps are.