The GCC Data Centre Industry: Conflict and Policy

Spotlight

• Privately operated data centres in the Gulf are increasingly perceived as proxy extensions of US-aligned infrastructure in geopolitical conflict.

• Data localisation policies may inadvertently constrain resilience by complicating the transfer of critical data when infrastructure is threatened.

• Relocating digital infrastructure away from conflict zones is not a straightforward solution, as alternative hubs face their own structural vulnerabilities.

The rapid expansion of data centre infrastructure in the Gulf Cooperation Council (GCC) has become a central component of the region’s economic diversification strategies. As Gulf states seek to reduce dependence on hydrocarbon revenues, governments have increasingly invested in digital infrastructure capable of supporting artificial intelligence (AI), cloud computing, and other data-intensive technologies. The United Arab Emirates (UAE) and Saudi Arabia, in particular, have positioned data centres as critical foundations of their emerging digital economies. Simultaneously, US companies have recognised that the GCC offers affordable power and attractive connectivity, enabling the delivery of digital services and AI computing resources to Europe, Asia, and Africa with low latency—making it an attractive location for establishing cloud and AI infrastructure.

GCC digital infrastructure, particularly data centre facilities, enables governments, businesses, and consumers to access cloud services and AI workloads locally, while also providing a trusted partner for allied nations to outsource their own data storage and processing requirements under increasingly important sovereignty and residency frameworks. However, the recent Israel-US conflict against Iran has highlighted the vulnerability of digital infrastructure, which is both critical to global financial and government functions and extremely expensive. Data centre operations in the UAE and Bahrain experienced disruptions during regional missile and drone attacks, resulting in temporary outages affecting mobile applications and online banking.

As AI and cloud computing become critical economic and security assets, data centres, fibre-optic cables, and the energy systems that power them could become possible targets in future conflicts. However, despite these emerging security risks, the GCC’s unique combination of abundant energy resources, strategic geographic connectivity between major global markets, and strong government investment in digital infrastructure suggests the sector is likely to remain resilient in a post-conflict scenario, provided appropriate measures are adopted to strengthen the protection, redundancy, and diversification of critical digital assets.

Drivers of the GCC Data Centre Industry

The development of the GCC data centre sector is closely tied to national economic diversification programmes launched across the region over the past decade. Governments increasingly view digital infrastructure as essential for enabling new industries and supporting advanced technologies such as AI, fintech, and smart city systems, helping to shift away from reliance on fossil fuel income. This reliance is increasingly unsustainable not only due to finite reserves and climate pressures, but also because of the “unproductive” economic structure it creates, with limited employment opportunities for the national population.

A number of key geographic, infrastructural, and geopolitical advantages support the GCC’s digital ambitions. Energy availability has played a major role, since data centres require substantial amounts of electricity to power servers and cooling systems, and the GCC’s historically low energy costs have provided a competitive advantage. In addition to hydrocarbon resources, Gulf states are increasingly investing in nuclear power, hydrogen technologies, and solar energy—resources that are particularly abundant due to the region’s desert environment—to support future energy demand from digital infrastructure.

The Gulf also occupies a strategic position between Europe, Asia, and Africa, a location that enables relatively low-latency digital connectivity between major global markets and makes the region an attractive base for actors serving multiple geographies. Gulf states have demonstrated adaptability in navigating the “rigorous security and reporting requirements” necessary to obtain imports of US semiconductors, with the sale of advanced GB300 chips authorised to the state-backed AI companies HUMAIN of Saudi Arabia and G42 of the UAE in November 2025. This development reflects a geopolitically driven preferential alignment with US technology ecosystems compared to other players in the Middle East or globally, allowing continued access to critical AI hardware despite tightening export controls.

Finally, government policies aimed at attracting technology companies and skilled workers have reinforced the sector’s growth. Competitive income tax regimes, investments in leisure and cultural attractions, and flexible visa pathways make life for expatriates in these countries highly attractive relative to competing global hubs. This is in addition to the creation of advanced technology education and research funding at institutes such as Mohammed bin Zayed University of Artificial Intelligence (MBZUAI), and King Abdullah University of Science and Technology (KAUST), alongside specialised courses at other local multidisciplinary universities, which have further contributed to positioning the GCC as an alternative destination for global technology talent. 

Geopolitical and Regulatory Risks

However, recent regional tensions have raised concerns that the data centre industry remains vulnerable to physical disruption risks. Amidst the Iran war, successful targeting and debris from interceptions have resulted in damage to energy and industrial infrastructure across the region. Given the dominance of US hyperscalers such as Amazon Web Services, Microsoft, and Google in the region, Gulf-based data centres—although privately operated—have been targeted as perceived extensions of US and/or Israeli military infrastructure, effectively positioning them as proxy assets within broader geopolitical conflict.

Gulf-based data centres—although privately operated—have been targeted as perceived extensions of US and/or Israeli military infrastructure, effectively positioning them as proxy assets within broader geopolitical conflict.

This vulnerability is compounded by the sheer scale and centralisation of hyperscale facilities. Modern data centres can span 100,000 to over 7 million square feet for “hyperscale” facilities, housing tens of thousands of servers within a single site, making them difficult to fully secure against external threats. Security costs are correspondingly high due to spending on physical systems to protect infrastructure, including perimeter fences, surveillance and access control. The aerial threats from Iran’s drones, missiles and debris from interceptions are a significant challenge due to the difficulty of providing continuous overhead protection across large footprints. As a result, operators may increasingly need to invest in advanced counter-drone systems, airspace monitoring, and hardened structural designs, further increasing the already substantial cost of securing these sites.

Regulatory frameworks also pose potential challenges should the conflict continue. Gulf states including the UAE and Saudi Arabia have introduced data localisation requirements that mandate certain categories of data to be stored domestically. These policies are predominantly designed to enhance cybersecurity and data sovereignty, yet, they can also create operational constraints for public services and private companies that rely on global cloud networks. The experience of government data storage providers in Ukraine has demonstrated that the ability to rapidly transfer sensitive data across borders is crucial when infrastructure is threatened. Shortly before Russia’s invasion in February 2022, the Ukrainian parliament lifted a ban on the use of cloud storage by government services, allowing private sector providers, including Amazon, Microsoft, Google, and Cloudflare, to transfer data out of the physical data centres before they were subsequently targeted by Russian forces. The localisation policies of Gulf states may therefore require increased operational flexibility, including provisions for cross-border data transfer in emergency scenarios.

Policy Recommendations 

In light of the heightened geopolitical tensions and demonstrated physical vulnerability of digital infrastructure, several policy pathways are open for both GCC governments and private sector actors operating in the region.

First, Gulf states might prioritise the protection of critical digital infrastructure by integrating data centres into military defence planning and strengthening physical defences to include additional aerial systems, such as counter-drone and missile interception capabilities. Given the scale and strategic importance of these facilities, closer coordination between private operators and national defence authorities, as well as the development of new standards for infrastructure design will be required.

The experience of government data storage providers in Ukraine has demonstrated that the ability to rapidly transfer sensitive data across borders is crucial when infrastructure is threatened.

Second, regulatory frameworks governing data localisation should be designed with sufficient flexibility to enable secure cross-border data movement in emergency scenarios while still protecting national security and privacy concerns. This could include pre-approved contingency mechanisms allowing rapid data mirroring or transfer to allied jurisdictions in the event of disruption, ensuring continuity of critical services.

Third, greater diversification away from US suppliers could reduce the perception of Gulf data centres as extensions of US strategic infrastructure. Although US technology providers offer the most advanced and scalable cloud solutions, partial diversification of vendors and partnerships may decrease the likelihood of being targeted by state and non-state actors seeking to disrupt US-aligned infrastructure.

While some critics of the GCC’s data centre ambitions have suggested that the only solution to avoid threats to such costly infrastructure housing such critical data is to base them in locations further away from potential aggressors. It is worth noting that few locations offer the same low-cost energy, strategic geographic connectivity, and regulatory environments. Should data centre providers seek instead to concentrate their facilities in the US, and should GCC data localisation laws be relaxed enough to allow their processing beyond the Gulf countries’ borders, there would still be significant economic and operational challenges.

The US is also more exposed to natural disasters than the GCC, threatening the physical integrity of data centre infrastructure. In 2025 alone, the US experienced 23 separate billion-dollar weather and climate disasters including hurricanes, wildfires and floods which resulted in a total US$115 billion in damages. In contrast, the GCC faces a narrower range of natural hazards and is generally considered lower in global natural disaster risk assessments. Additionally, securing land and planning approval for new data centre developments in the US can be complex and time-consuming due to local environmental laws and community opposition to rising utility bills and noise pollution, which have delayed or blocked projects in key locations such as Virginia and California. Moreover, existing US grid systems have already demonstrated vulnerabilities, with power constraints and outages affecting data centre operations in areas such as “Data Centre Alley” in Virginia. As such, rather than relocating, strengthening resilience within the GCC remains the more viable and cost-effective strategy.

By addressing these structural challenges, GCC countries can strengthen the resilience and competitiveness of their data centre industries in the face of current threats, while reinforcing their ambitions to become global hubs for cloud computing and artificial intelligence once peace resumes.

Elizabeth Heyes is a Junior Fellow, Emerging Technology, ORF Middle East.