Start a project
Start a project Book a call
Compliance

Web development company in Dubai: what to ask before you sign

A contract-minded checklist for a company owner hiring a web developer in Dubai, from scope and code ownership to VAT invoices, data protection and exit terms. It ends with a clause list to paste into an email.

ESTASOFT
11 min read
Cover image for a contract checklist for hiring a web development company in Dubai, covering scope, code ownership, invoices, data protection and exit terms.
On this page
    On this page

      You have found a company in Dubai, the proposal looks fine, and a web development contract is on your desk. A few written lines now decide who owns the work, who controls the accounts, what happens to your customers' data and how you leave if things go wrong. This is a checklist for a company owner, not a developer.

      At the end is a short clause list you can paste into an email. Facts were checked on 3 November 2026 and rules change. ESTASOFT has an office in Dubai, but this list works for any developer.

      Scope and acceptance tests

      Start with scope. Ask for a document that lists pages, features, languages, integrations and what is not included. A one-page brief makes this easier: see How to write a one-page brief for a web agency.

      Then ask for acceptance tests. These are written checks that say when a deliverable is done, who runs them, how many working days you have to review, and what happens if a check fails. Tie each payment to accepted work, not to a date.

      Who owns the source code and design files

      The UAE copyright law is Federal Decree-Law No. 38 of 2021 on Copyright and Neighboring Rights. The UAE legislation portal shows it taking effect on 2 January 2022. In its English text, three articles matter here:

      • Article 9 says a transfer or license of economic rights is valid only if it is in writing. The writing must name the right, its purpose, its duration and where it applies. Rights not expressly transferred stay with the author.
      • Article 13 says handing over or selling the original of a work does not transfer the economic rights, unless the parties agree otherwise.
      • Article 28 sets default rules for work an author creates for another person and for work made by employees. It applies unless the parties agree otherwise in writing.

      This article cannot tell you how these combine for your project. That is a question for a lawyer. What you can do is avoid relying on a default and write ownership into the contract. Say what is assigned to you and what is only licensed, and when the assignment takes effect, for example on final payment. Cover the code, design files, fonts and images, and any parts the developer reuses for other clients. Ask for a list of open-source components with their licenses, and for confirmation that employees and subcontractors have passed their rights to the developer. Our guide on who owns the code covers the rules in other countries and a handover list.

      Domain, hosting and accounts in your name

      Ask that your company is the registered owner of the domain and the account holder for hosting, cloud, email, payment and analytics from day one. The developer works as a user on your accounts and does not own them. Ask for every login to be handed over in writing at the end. Domains, DNS and hosting explained shows what to control.

      Payments and the VAT tax invoice

      Agree milestones, each tied to accepted deliverables. Consider keeping a final part of the price until handover is complete. State the currency and whether prices include VAT. The UAE Ministry of Finance gives the standard VAT rate as 5 percent.

      Ask whether the developer is registered for VAT, and ask for a tax invoice that shows its tax registration number. The government portal gives the mandatory registration threshold as AED 375,000 a year in taxable supplies and imports, so a small UAE supplier may have no number. Ask, and record the answer. The Federal Tax Authority's VAT page offers a tool to check a registration number. The VAT executive regulations on the UAE legislation portal (Cabinet Resolution No. 52 of 2017, Article 59) list the supplier's name, address and tax registration number among the particulars of a full tax invoice. The Ministry of Finance's field list for electronic tax invoices (version 1.1, 28 October 2026) includes them too.

      The Ministry's e-invoicing guidelines (version 2.0, 26 October 2026) say e-invoicing applies to anyone doing business in the UAE unless excluded. For businesses with annual revenue below AED 50 million, the dates shown are 31 March 2027 to appoint a service provider and 1 July 2027 to implement. Ask the developer how its invoices will meet the rules that apply to it, and ask your accountant what you need to reclaim VAT.

      Data protection

      If the developer will handle personal data, such as a customer database, a contact form or an online store, the data protection law matters. It is Federal Decree-Law No. 45 of 2021 on the protection of personal data, and the government portal says it came into force on 2 January 2022. In the official text:

      • It applies to controllers and processors in the UAE, and to foreign ones that handle the data of people in the UAE. It excludes some cases, including companies in free zones that have their own data protection rules, and health and banking data governed by other laws.
      • A controller must choose a processor that gives sufficient guarantees. A processor must act on the controller's instructions, keep data secure, erase it when processing ends and tell the controller about a breach as soon as it knows.
      • It sets conditions for moving personal data out of the UAE. One is a destination with adequate protection. Where there is none, listed cases apply, such as a contract that requires the recipient to meet the law's standards.

      The law says its executive regulations were due within six months of its issue. This article could not confirm from an official source that they have been issued. A law firm note dated 15 June 2026 says they had not, and reports that a new federal authority for artificial intelligence and data was announced on 14 June 2026. Ask your lawyer what applies today, and whether a free zone regime applies to your company.

      Put these points in the contract: where data is stored and who can open it, no live customer data in test systems unless you agree, how fast the developer tells you about a breach, and return or deletion of data at the end.

      Support and warranty

      Ask how long the developer fixes defects free of charge, and write the number of days into the contract. Ask how a defect differs from a change request, how fast the developer responds to a serious fault, and who pays for hosting, updates and monitoring after the warranty ends. If you want a continuing arrangement, compare care plans line by line.

      Confidentiality

      Ask for a confidentiality clause that binds both sides, or an NDA signed before you share anything sensitive. It should cover your customer data, prices, plans and logins. Say how long it lasts, that staff and subcontractors are bound by it, and that the developer returns or deletes your material at the end.

      Termination and handover

      Write down how each side can end the contract, how much notice is needed, and what you pay for accepted work if it ends early. Then list what you receive: the code with its history, build instructions, accounts, a database export, design files and documentation. Name a date and a person who confirms the handover.

      Contract language, courts and arbitration

      Ask a lawyer to review these points, because the right choice depends on your company and the other party. Ask which language the signed contract is in. If there are two versions, ask which one prevails if they differ. Ask which country's law applies, and where disputes are decided: in a court or through arbitration, under which rules and in which place. Do not sign a clause you cannot read in a language you understand.

      Subcontracting and offshore work

      Ask who will do the work and where they sit. Ask whether any part goes to subcontractors or to a team in another country, and require your approval before that happens. Subcontractors should sign confidentiality and ownership terms with the developer. If personal data will be opened from abroad, go back to the transfer rules above. Ask for a named project lead and a contact address in the UAE.

      Security basics

      Ask the developer for a one-page answer on how the project handles the OWASP Top 10, and what is tested before launch. Our guide OWASP Top 10 explained for business owners explains the list in plain words and ends with a security acceptance checklist for a project. At a minimum, ask about HTTPS, multi-factor sign-in for admin accounts, and a list of every component with a plan for updates.

      Clause list to copy into an email

      Paste this into an email and ask the developer to confirm each point in the contract.

      1. Scope: the contract lists pages, features, languages, integrations and exclusions.
      2. Acceptance: each deliverable has written tests, a review period in days and a rule for failed tests.
      3. Payments: each milestone is tied to accepted work. Amounts state the currency and whether VAT is included.
      4. Invoices: every invoice is a tax invoice with the supplier's tax registration number, or states in writing that the supplier is not registered for VAT.
      5. Ownership: the code, design files and content are assigned to my company in writing, and the clause says when. Reusable tools are licensed to me with no end date.
      6. Third-party parts: you will list every open-source and paid component with its license.
      7. Accounts: the domain, hosting and all service accounts are in my company's name from the start.
      8. Data: you will tell me where data is stored, who can open it, and how quickly you will report a breach. No live customer data goes into test systems without my approval.
      9. Support: defects are fixed free of charge for an agreed number of days after launch.
      10. Confidentiality: staff and subcontractors are bound, and my material is returned or deleted at the end.
      11. Subcontracting: no work goes to a subcontractor or to another country without my written approval.
      12. Exit: the contract states notice periods, payment for accepted work and a dated handover list.
      13. Law: the contract states its language, the governing law and where disputes are decided.

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      ESTASOFT offers web development. Send a short brief on the contact page, and read who owns the code before you sign.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.