Architecture, Design & Construction
A studio in Dubai holds thirty years of drawings, the BIM models for the towers it is proud of, the bids it has not won yet, and the bank details of every client and supplier. No regulator licenses that. The PDPL still covers every client record, DESC reaches you the day you take a Dubai government project, and the people who encrypt file servers for a living know that a design firm cannot work for a week without its archive. We assess the studio the way we assessed banks, in plain language, with the ten fixes that matter first.
We are the GRC and compliance experts who pull it all together and make security look easy, so you can focus on actual security.
of regional breaches begin with an unpatched flaw, the most fixable problem in security and the commonest one on a studio file server
Source: Verizon 2026 DBIR, EMEA
growth in active ransomware groups targeting the UAE in one year, with data-rich, security-thin firms the easiest prey
Source: CPX State of the UAE Cybersecurity Report 2025
attacks a day countered nationally in 2026, up from about 200,000 the year before
Source: UAE Cyber Security Council, August 2026
Why it feels harder than it should
Nobody hands an architecture practice a rulebook, so the obligations arrive sideways. The federal PDPL governs the client, staff and site-worker data you hold. A Dubai government or semi-government project brings DESC alignment and data-residency clauses into the contract. Developers and main contractors now pass down ISO 27001 and ISO 19650 language for BIM and common data environments. Your professional indemnity insurer asks about backups and multi-factor authentication at renewal. Four sources, none of them called a regulator, all of them able to stop a project.
What this looks like in practice
One case: a 24-person architecture and interiors studio in Al Quoz with a villa portfolio, one hotel fit-out on tender and a small government landscaping job. The villa clients are PDPL data, the hotel bid is confidential commercial information the competition would pay for, the government job carries DESC clauses, and the studio pays forty suppliers a month from an accounts inbox that has never had multi-factor authentication. That is the map. The assessment draws it in two hours.
A story from the field
A principal at a 24-person architecture and interiors studio in Al Quoz, Dubai
It is a Monday in June and the studio opens at eight. The principal has a client presentation at eleven for a villa on the Palm and a hotel fit-out tender due Thursday. The senior designer opens the project server to pull the latest set. Every folder is there. Every file ends in an extension nobody has seen before.
Thirty years of drawings. The founder’s first sketches from 1996, the BIM models for four towers, the bids, the client contracts, the payment schedules with bank details. On the desktop, one text file: a wallet address, a deadline of seventy-two hours, and a line saying the files have also been copied.
The backups sit on a NAS in the same cupboard as the server, and it is encrypted too. The IT partner who set it up left the country in 2023. At ten the bank calls: a supplier invoice paid last week went to an account nobody recognizes.
The eleven o’clock presentation happens on a laptop from home, with a set that is three weeks old.
What changes the ending
UAE Data Office
Federal personal data protection under the PDPL (Federal Decree-Law 45 of 2021): consent, processing, breach duties, and cross-border transfer for nearly every business.
DESC
Dubai’s cyber authority. Its ISR v3 standard and CSP certification are mandatory for cloud and service providers that serve Dubai government, with data-residency requirements.
Your regulators, sector by sector
These are summary profiles. Behind each one sits a complete obligation map, control set and calendar that AccuSights maintains for clients. Seeing yours is what a demo is for.
Access is granted by project, not by seniority, so a designer can open the work they are on and nothing else. The leaver checklist runs the same day: accounts closed, shared-drive links revoked, the laptop wiped. The read-only agent shows what was downloaded in the last thirty days, so you know what left before you have to guess. And your employment contracts and the PDPL give you standing; the evidence is what makes it usable.
You open the plan you wrote before it happened. Disconnect the server, restore the archive from the isolated backup to a clean machine, and confirm the current set for each live project. One person calls the bank to freeze payments in flight, one calls the clients whose data is affected, and one records what happened for the PDPL breach assessment, which includes notifying the UAE Data Office where personal data is involved. The assessment writes that plan with you; the agent shows whether the backup is still good every week after.
The PDPL applies to any business in the UAE that processes personal data, and a studio processes client, staff and site-worker data every day. A Dubai government or semi-government project brings DESC into the contract. Developers and main contractors increasingly pass down ISO 27001 and ISO 19650 clauses. And the professional indemnity insurer asks about backups and multi-factor authentication at renewal. Unregulated is not the same as unaffected.
Assess
Where the drawings, the models, the bids and the money actually live, what would stop the studio for a week, and the ten fixes that matter first. Mapped to any regulator or contract that applies.
Details →Comply
PDPL always, DESC on government projects, ISO 27001 and 19650 where a client asks: one control set, evidence produced once, ready the day a client questionnaire arrives.
Details →Keep an eye on it
Read-only insight so you prioritize the right things and keep an eye on them. We have no access and do not remediate; you or your IT partner fix, we show you where, then we check again.
Details →One program instead
We assess the studio once, in plain language: where the drawings, the models, the bids and the money actually live, who can reach them, what would stop the practice for a week, and the ten fixes that matter first. Then we map what applies to you, PDPL always, DESC and ISO where a contract brings them, and keep the picture current with the read-only compliance agent. You or your IT partner fix; we show you where, then we check again.
Cross-mapped controls
One control, mapped to every regulator on this page that it satisfies.
Evidence collected once
Reused across every emirate, free zone, and framework that applies to you.
Always audit-ready
A read-only compliance agent keeps the picture current. You keep the keys.
Global breach figures: Verizon 2026 Data Breach Investigations Report, the 19th edition, analyzing more than 22,000 confirmed breaches across 145 countries. Regional figures: EMEA section of the same report, and UAE public statistics as cited.
Book a demo
Thirty minutes with an engineer who works in UAE regulation. You leave knowing which rules apply to you, where the gaps are, and how one control set covers them.