Software, IT and SaaS in the UAE

How software, IT-services and SaaS companies actually structure a UAE entry - where the IP sits, which entity bills, and where the engineers stay.

• The UAE is a billing, talent and IP-holding location for software, not a blanket tax shelter; the value is in the structure, not the licence.
• Free-zone 0% corporate tax is always conditional. It applies only to a Qualifying Free Zone Person on qualifying income - broadly business-to-business supplies to other free-zone persons and qualifying intellectual-property income, subject to a de-minimis test and economic substance. Software-service income billed to a mainland (onshore UAE) customer is generally non-qualifying and taxed at 9%.
• 100% foreign ownership is available - inherent in free zones, and for most mainland activities since the 2021 reform - so a local partner is usually not required.
• The recurring design is a UAE billing-and-IP entity over an Indian development entity, joined by an intercompany agreement that satisfies transfer pricing on both sides and puts real substance behind any UAE-held IP.
• One ESOP pool produces two tax outcomes: UAE-resident employees generally face no UAE tax on equity; India-resident teammates are taxed in India.
• There is no general data-localisation mandate for ordinary SaaS; the federal Personal Data Protection Law is in force, but its Executive Regulations remain pending (2025-26), and DIFC and ADGM run their own, more developed regimes.
• A 15% Domestic Minimum Top-up Tax applies to multinational groups with consolidated revenue of at least EUR 750m for financial years starting on or after 1 January 2025, eroding the 0% benefit for groups above that threshold.
• A newly enacted research-and-development tax credit gives qualifying UAE R&D a non-refundable, tiered credit (up to 50% of eligible spend, capped at AED 5 million) for tax periods from 1 January 2026 - it offsets corporate tax, so it is most useful where UAE development income is actually taxed at 9% rather than sitting at 0%; a separate high-value-employment credit remains only proposed.

Free-zone-versus-mainland is the structural spine of every UAE software entry, and the corporate-tax position is what makes it consequential. The headline is the trap: a free-zone licence does not equal 0% tax. The 9% federal rate is the standard; the 0% rate is available only to a Qualifying Free Zone Person, and only on qualifying income - broadly business-to-business supplies to other free-zone persons and qualifying intellectual-property income - subject to a de-minimis threshold for non-qualifying income and to genuine economic substance in the zone (Cabinet Decision 100/2023; Ministerial Decision 229 of 2025 (replacing 265 of 2023 on qualifying and excluded activities); FTA Free Zone Persons Corporate Tax Guide, May 2024). For a software business the edge is sharp: revenue from a service supplied to a mainland (onshore UAE) customer is generally non-qualifying and taxed at 9%, and breaching the de-minimis threshold can put the entity's whole qualifying status at risk for the period. The reliably 0% positions are exporting to free-zone clients and earning qualifying IP income with the required nexus and substance behind it. The point for entry planning is that you must know which entity bills which customer before you choose the licence, not after; the mechanics belong on the corporate-tax spoke (see uae tax and uae structuring). Two further points sit on the spine. Ownership is rarely the constraint - 100% foreign ownership is inherent in free zones and available for most mainland activities since Federal Decree-Law 32/2021, so activity classification, not nationality of shareholding, is the live mainland question. And for large multinational groups the 0% is already being eroded: a 15% Domestic Minimum Top-up Tax applies to groups with consolidated revenue of at least EUR 750m for financial years starting on or after 1 January 2025 (Federal Decree-Law 60/2023), so a group at that scale should not assume the headline 0% survives the top-up. On incentives the position has moved. A corporate-tax research-and-development credit has now been enacted - a non-refundable credit tiered at 15%, 35% or 50% of qualifying R&D spend (by expenditure band and R&D-headcount, capped at AED 5 million), effective for tax periods starting on or after 1 January 2026 (Cabinet Decision 215 of 2025; Ministerial Decision 24 of 2026, 18 March 2026). It offsets corporate tax (or top-up tax) and can be carried forward or transferred within a qualifying group - so it is most relevant to a software business whose UAE development income is actually taxed at 9%, rather than to a pure-0% qualifying free-zone position. A separate high-value-employment tax credit (stated to take effect from 1 January 2025) remains proposed and subject to legislative approval, so it should not yet be relied on.

For most SaaS businesses there is no blanket data-localisation requirement in the UAE - you are not, as a rule, forced to host customer data onshore. The federal Personal Data Protection Law (Federal Decree-Law 45/2021) is in force, with the UAE Data Office as regulator, but its Executive Regulations remain pending (2025-26), so the detailed federal regime should be treated as not yet finalised and confirmed at the time of filing. Where localisation does bite it is sector-specific - health, telecommunications and government data - handled through sector rules and contract terms, not a general mandate. Two structural notes matter. DIFC (Data Protection Law 5/2020) and ADGM (Data Protection Regulations 2021) operate their own, more developed regimes, so a business domiciled in either follows that framework, not the federal one. And the economics of where you host and run infrastructure - data centres, cloud, AI compute - is a separate question covered on the Data Centres page; this page is about the company's data-protection obligations, not the infrastructure spend.

If you are moving now, the first month has a natural order. Run it in this sequence and the tax position is designed in rather than discovered later:

• select the vehicle - free zone for export, mainland for onshore selling, or a dual or onshore-access combination - against where your customers actually sit;
• map the customer-location matrix - which revenue comes from free-zone persons, which from mainland UAE, which from outside the UAE - because that mix drives QFZP status;
• decide where the IP sits, and put the IP assignment and the India-UAE development agreement in place so ownership and the intercompany flow are documented from day one;
• set the transfer-pricing model for the UAE-to-India charge, defensible to the authorities on both sides;
• confirm the QFZP exposure and de-minimis headroom before the first mainland contract is signed;
• plan substance and people - the founder and key-employee residency route, including the Golden Visa pathway, and enough genuine UAE activity to support any 0% IP claim;
• settle the data-processing terms and the applicable data-protection regime (federal PDPL, DIFC or ADGM) before customer data starts flowing.

• Assuming the free-zone licence delivers 0% tax, then billing mainland customers from it - which is generally non-qualifying income taxed at 9%, and can jeopardise QFZP status if it breaches the de-minimis threshold.
• Parking IP in a UAE entity with no real substance and claiming the qualifying-IP 0% - a position that does not survive the nexus and substance requirements.
• Running the business from India in substance - board, people, decisions - while treating the UAE entity as offshore, creating a place-of-effective-management exposure in India.
• Setting an intercompany price that suits one jurisdiction and ignoring the transfer-pricing consequence in the other.
• Designing a single ESOP pool as if everyone is tax-free, when India-resident teammates are taxed in India and sit within FEMA limits.
• Assuming a general data-localisation duty (there is none for ordinary SaaS) - or, conversely, assuming the federal PDPL is fully operational when its Executive Regulations are still pending and DIFC/ADGM may govern instead.
• Treating the high-value-employment tax credit as already available - it remains proposed and subject to legislative approval (the research-and-development credit, by contrast, is now enacted and effective for tax periods from 1 January 2026); and a large group assuming the free-zone 0% survives the 15% Domestic Minimum Top-up Tax, which it does not at or above the EUR 750m threshold.