Skip to main content
For UAE, Saudi and GCC businesses

Offshore Software Development for the UAE, Saudi Arabia and the Gulf

AI Dev Planner is a software and AI development team in Islamabad, Pakistan. We do not have an office in the Gulf. This guide is for companies in the UAE, Saudi Arabia and the wider GCC considering an offshore team: how the hours and working weeks line up, what the UAE and Saudi data protection laws say about sending data abroad, and what to check if your product needs Arabic and right-to-left interfaces.

General information, not legal advice. See the offshore software development overview for how the model works worldwide.

The short answer

On hours, the Gulf is one of the easiest regions to work with from Islamabad: the gap is one or two hours and never changes. The friction is elsewhere. Working weeks differ, so shared working days need agreeing. Both the UAE and Saudi Arabia have data protection laws with conditions on transfers abroad, and some sectors add their own rules. And if the product must work in Arabic, right-to-left support has to be designed in from the first sprint.

Time zones: one or two hours, all year

Islamabad is UTC+5 and Pakistan does not change its clocks. The UAE is four hours ahead of GMT (UAE Government portal, accessed 17 October 2026) and Saudi Arabia is three hours ahead, and neither moves its clocks either. Unlike the UK, Europe or the US, the difference is the same in January and July, so recurring meetings never drift.

The overlap column assumes both sides keep a 09:00 to 17:00 local day. It is arithmetic for planning, not a statement of our working hours, which are agreed per project.

Time difference and working-day overlap between Islamabad, the UAE and Saudi Arabia
CountryUTC offsetIslamabad is ahead byOverlap of a 09:00–17:00 dayExample
United Arab Emirates (Dubai, Abu Dhabi)UTC+4, no clock change1 h7 h09:00 in Dubai is 10:00 in Islamabad
Saudi Arabia (Riyadh, Jeddah)UTC+3, no clock change2 h6 h09:00 in Riyadh is 11:00 in Islamabad

With this much overlap, a Gulf client can work with an Islamabad team much as it would with one in another emirate: same-day answers, live working sessions and quick decisions. Other GCC states have their own offsets; check yours against UTC+5 the same way.

Working weeks, Ramadan and public holidays

Hours line up easily; days need more thought. In the UAE, federal government employees work 7.30 am to 3.30 pm Monday to Thursday and a half day on Friday, and Saturday and Sunday are the official weekend (UAE Government portal, public sector hours). The UAE’s fact sheet notes that Sharjah government entities work Monday to Thursday, and that most private companies close only on Sundays while others close on Saturdays and Sundays (UAE fact sheet). In Saudi Arabia, a royal decree in 2013 moved government bodies and financial institutions to a Friday and Saturday weekend (Arab News, June 2013). All accessed 17 October 2026.

The result is that a Saudi client, a UAE client and a supplier may each have different days off. Write down at kick-off:

  • the days each side works, and which days count for deadlines and response times;
  • the fixed weekly meeting day, chosen from days both sides work;
  • who covers urgent issues on the days that only one side works, if the product is live;
  • public holidays on both sides for the year ahead, including Eid holidays, which move each year.

Plan for Ramadan as well. In the UAE private sector, working hours are reduced by two hours a day during Ramadan (UAE Government portal, private sector hours, accessed 17 October 2026), so the time your own team has for reviews and approvals shrinks. Schedule big decisions, user testing and launches with that in mind.

UAE: the federal PDPL and cross-border transfers

The UAE’s federal Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. The UAE Government portal says it came into force on 2 January 2022, that it sets out requirements for the cross-border transfer and sharing of personal data, and that the UAE Data Office, established by Federal Decree-Law No. 44 of 2021, acts as the federal data regulator (UAE Government portal, data protection laws). The same page lists separate laws that may apply instead or as well, including the DIFC’s Data Protection Law (DIFC Law No. 5 of 2020) and Federal Law No. 2 of 2019 on the use of ICT in health fields.

A US International Trade Administration summary of the law notes that it applies regardless of where the controller or processor is established, and that it excludes data governed by other laws, such as government data and personal health and financial data. On transfers, Article 22 covers destinations with adequate protection, as approved by the UAE Data Office, and Article 23 lists the cases in which data may be transferred to a country without adequate protection, including a contract binding the recipient to the law’s requirements and the data subject’s express consent (trade.gov). All accessed 17 October 2026.

For a project with an offshore team, that translates into a short list of questions for your adviser:

  • Which regime applies to you: the federal PDPL, a free-zone law such as the DIFC’s, or a sector law such as the health ICT law?
  • Will the development team access personal data at all, or can it work only on test data with production hosted in your own UAE-region cloud account?
  • If access is needed, which Article 22 or 23 basis applies, and what the contract must say.
  • Whether the implementing regulations and any Data Office guidance current at the time of your project add further steps.

Saudi Arabia: the PDPL and transfers outside the Kingdom

Saudi Arabia’s Personal Data Protection Law was issued by Royal Decree No. M/19 in September 2021 and amended by Royal Decree No. M/148 in March 2023. It took effect on 14 September 2023, with a further year for most controllers to comply, and the Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulator. According to DLA Piper’s summary, the law applies to processing in the Kingdom and to processing of the personal data of people residing in the Kingdom by entities outside it (DLA Piper, Data Protection Laws of the World, accessed 17 October 2026).

Transfers outside the Kingdom are governed by the law and a separate transfer regulation. The same summary describes conditions including that a transfer must not compromise national security or the Kingdom’s vital interests, must be limited to the minimum personal data needed, and should go to a country with an appropriate level of protection, or otherwise rely on appropriate safeguards, with limited exceptions. It also notes that sector regulators may require their own approvals, for example the Saudi Central Bank for banks. The official texts and guidance are published by SDAIA; read the current versions with your adviser before you agree data access with any supplier outside the Kingdom.

The design advice is the same as for the UAE, and it matters more where the law expects the minimum data to leave the country: host production in a Saudi or approved region in your own account, give the development team test data, and treat any access to real personal data as an exception that is agreed, limited and recorded.

Government and semi-government buyers, and regulated sectors such as banking and health, may have procurement, hosting and supplier-location requirements of their own. Check those before you shortlist any offshore supplier.

Arabic and right-to-left: what to require

Products for Gulf users often need Arabic alongside English. Right-to-left support is far cheaper to build in from the start than to retrofit, and it is easy for a supplier to claim and hard to fake in a live demo. Treat the points below as requirements to write into the scope and to verify with any supplier, including us: ask to see a live right-to-left product they built.

  1. Layout direction set at the document level

    The page or app sets the language and right-to-left direction (for example dir="rtl" on the HTML element), and the layout uses logical properties (start and end) rather than hard-coded left and right, so one codebase serves both directions.

  2. Mirroring, with the right exceptions

    Navigation, progress indicators and directional icons such as back arrows flip in RTL. Media playback controls, logos, charts with a time axis and phone numbers usually should not. Ask how the supplier decides which is which.

  3. Bidirectional text

    Arabic sentences often contain English product names, numbers, email addresses and URLs. Mixed-direction strings, form inputs and copied text need testing with real content, not placeholder text.

  4. Arabic typography

    An Arabic web font with the weights you need, line heights that suit Arabic script, and no letter-spacing on Arabic text, which breaks joined letters.

  5. Numbers, dates and calendars

    Decide whether to show Western or Arabic-Indic digits, how currency amounts are formatted, and whether any date needs the Hijri calendar alongside the Gregorian one.

  6. Search, sorting and generated documents

    Search should handle Arabic letter variants, lists should sort correctly in Arabic, and PDFs, invoices and emails generated by the system must render Arabic text correctly.

  7. Content and translation workflow

    Strings in translation files rather than in code, a review step by a native speaker, and room in the layout for text that is longer or shorter than the English.

If Arabic is planned for a later phase rather than launch, say so during discovery anyway. Choosing logical layout properties and keeping strings out of the code from day one costs little and saves a rebuild later.

Contracting, and how Gulf clients work with us

Points to settle in writing with any offshore supplier:

  • Governing law and disputes. UAE onshore law, a free-zone legal system such as the DIFC’s, Saudi law or another jurisdiction: which applies and where disputes are heard is negotiable, and worth local advice on enforceability.
  • IP assignment. A written assignment of the bespoke work to you. Our terms of service say that bespoke source code, database designs and associated assets are assigned to the client once the contractual milestones under the statement of work are met; ask for the exact wording.
  • Data terms that match the regime you are under, and a clear statement of who can access which data from where.
  • Currency and fees. Our published planning ranges are in GBP. Agree the invoicing currency and who bears transfer charges.
  • Working days and holidays, as set out above.

How the work itself runs:

  • A discovery phase maps workflows, data model and integrations, followed by fixed 2-week sprint costs against the agreed scope. Our engineers can also join an existing in-house team.
  • A dedicated Slack channel, and a video walkthrough of working software every two weeks.
  • The repository in your own GitHub or GitLab organisation, and hosting in cloud accounts you control, in the region you choose.
  • A 60–90 day warranty after launch covers defects in what we delivered.

We are probably not the right partner if:

  • you need a locally licensed supplier or an on-site team in the UAE or Saudi Arabia;
  • your regulator or contracts require that only in-country staff can access your systems or data;
  • you need a fixed quote before anyone has looked at the scope.

For an indicative range for your product, use the MVP cost calculator.

Related guides

Offshore software development FAQs for Gulf companies

What is the time difference between Islamabad and Dubai or Riyadh?

Islamabad is one hour ahead of the UAE and two hours ahead of Saudi Arabia, all year round, because none of the three changes its clocks. If both sides kept a 09:00 to 17:00 day, about seven hours would overlap with the UAE and six with Saudi Arabia.

How do different working weeks affect a project?

UAE federal government offices work Monday to Friday with a Friday half day, while Saudi government offices moved to a Friday and Saturday weekend in 2013. Private companies vary. Agree the working days, the weekly meeting day and the public holidays on both sides at the start, so a Sunday request or a Friday deadline does not land on someone's day off.

Does the UAE data protection law apply to an offshore development team?

It can. The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, applies regardless of where the controller or processor is established, but it excludes some data covered by other laws, such as health and financial data, and the financial free zones have their own regimes. Transfers outside the UAE are permitted in the cases set out in Articles 22 and 23. Check which regime applies with your adviser.

What does the Saudi PDPL mean for outsourcing development outside the Kingdom?

The Personal Data Protection Law, supervised by SDAIA, reaches processing of the personal data of people residing in Saudi Arabia by entities outside the Kingdom, and transfers abroad must meet the conditions in the law and its transfer regulation, such as an adequate level of protection or appropriate safeguards and keeping the data transferred to the minimum needed. Sector regulators can add their own approvals.

Can you build Arabic and right-to-left interfaces?

Ask any supplier, including us, to show a live right-to-left interface they have built and to explain how they handle bidirectional text, mirrored layouts and Arabic typography. This page does not make a claim about Arabic delivery experience; treat it as a requirement to verify during scoping.

Do you have an office in Dubai or Riyadh?

No. Our engineering team is based in Islamabad, Pakistan, and we work with clients in the Gulf remotely. We do not claim a UAE or Saudi office, licence or registration.

Do you price projects in AED or SAR?

Our published planning ranges are in GBP. The invoicing currency, payment schedule and who bears transfer and conversion fees are agreed in the contract for each project.

Sources

All sources accessed 17 October 2026. This guide is general information, not legal advice.

  1. UAE Government portal: Fact sheet — The UAE is four hours ahead of GMT; government offices work Monday to Friday; most private companies close on Sundays, others on Saturdays and Sundays.
  2. UAE Government portal: Working hours in the public sector — Federal hours of 7.30 am to 3.30 pm Monday to Thursday, a Friday half day, and a Saturday–Sunday weekend.
  3. UAE Government portal: Working hours and overtime (private sector) — Private-sector hours are reduced by two hours a day during Ramadan.
  4. Arab News: It's a Friday-Saturday weekend (June 2013) — Royal decree moving Saudi government and financial institutions to a Friday–Saturday weekend.
  5. UAE Government portal: Data protection laws — Federal Decree-Law No. 45 of 2021, in force from 2 January 2022; the UAE Data Office; the DIFC data protection law; the health ICT law.
  6. US International Trade Administration: UAE cross-border data flows — Summary of PDPL Articles 22 and 23 on transfers, the law's reach, and the data it excludes.
  7. DLA Piper: Data Protection Laws of the World, Saudi Arabia — Summary of the Saudi PDPL: decrees, effective dates, SDAIA as regulator, extraterritorial reach and transfer conditions.

Talk it through first

Tell us what you are building, which languages it needs and where your data must live. If we are not the right fit, we will say so.

Discuss your project Estimate your MVP cost