Cybrilliant Talk to an Expert

School and university cybersecurity in the UAE: A campus is open by design, so accounts matter more than the perimeter.

Students arrive and leave, departments create accounts for visiting staff, and personal devices join the network by default. An ordinary intrusion lands where student records, research and term-critical systems sit.

Talk to an ExpertFollow one account ↓

An account outlives the person who used it.

Review and retention periods in the ADEK policies.

  1. Joins

    A student or staff member gets an account. The school now holds a record.

  2. 1 year

    Review the data protection plan every year. It covers data classification, access levels, threat protection and restoration (Digital Policy, 7.3).

  3. Leaves

    The account should close. The record does not.

  4. 5 years

    Keep student records at least five years after the student leaves. Graduation records are kept indefinitely (Records Policy, 2.1).

  5. 5 to 7 years

    Keep staff records at least five and at most seven years after employment ends, unless the school needs them longer (Records Policy, 2.2).

Where an intrusion goes in a school or university

  1. A call or a click

    Phishing, a stolen password, or an unpatched system that faces the internet.

    34%of Educational Services breaches began with exploitation of a vulnerability, and 22% with phishing (Verizon 2026 DBIR, Public Sector snapshot)
  2. A sensitive identity

    Not only IT administrators. Registrar, finance and payroll staff, researchers, and accounts of adjuncts and students who have left.

  3. A shared vendor

    Student-information and learning platforms, payment providers and edtech apps hold records for many schools at once.

    40%of Educational Services breaches involved a third party (Verizon 2026 DBIR, Public Sector snapshot)
  4. Records and research

    Student and family records, fee data, unpublished research and sponsor data, often copied well beyond the system of record.

What changes for a school or university

The same security decision gets a different answer once students, open networks and shared vendors are in the picture.

Who to protect first

Domain and cloud administrators.

Registrar, finance and payroll staff, researchers with sponsor data, and the help desk that can reset them.

Who owns an account

HR creates it and removes it.

Departments create adjunct, visitor and research accounts, and alumni keep email. Tie removal to the student or HR record, not to a ticket.

What the network is

Everything inside is trusted.

Open by design. Use zones: an open one for guests and personal devices, a managed one for staff, a regulated one for finance and research.

How to rank vendors

By spend.

By whether they hold student records or can reach your systems through remote support. One vendor failure can reach many schools.

What recovery means

Restore the systems from backup.

Restore what the term needs, identity first, then student records, the learning platform, payroll and fees. Prove it with a restore test.

49%

Of higher education providers hit by ransomware named unknown security gaps as a cause (Sophos, State of Ransomware in Education 2025, global survey of 441 education IT leaders)

The rules are set by emirate, and by school type

ADEK has written the most specific cyber duties we could verify, for private and charter schools in Abu Dhabi. Elsewhere in the UAE, expect the personal data law, ISO 27001 and NIST to be the working yardsticks.

Abu Dhabi: a yearly data plan

Private and charter schools must keep a data protection plan and review it each year. They must also name a staff member to liaise with ADEK on digital safety and security (ADEK Digital Policy v1.1, 7.3 and 2.3).

Abu Dhabi: vendors are vetted

Schools must keep a third-party risk framework that covers cybersecurity standards, data management and backup. Contracts must bar moving data in or out of the country without ADEK’s consent (Digital Policy, 5.5 and 7.1).

Student records stay restricted

Records must be stored securely and be open only to authorized staff. Parental permission is needed before student information goes to a third party (ADEK Records Policy v1.1, 1.4 and 1.5).

Rules and frameworks behind this page

ADEK Digital Policy, Version 1.1

For private and charter schools in Abu Dhabi. Requires controls such as multi-factor authentication, encrypted data and offline backups, plus a yearly data protection plan and vendor vetting.

Read the source

Source: Abu Dhabi Department of Education and Knowledge (ADEK), Digital Policy and School Records Policy, both Version 1.1. This is analysis, not legal advice.

UAE rules, by who you are

Which UAE rule reaches a school, a university or an education supplier

Abu Dhabi schools follow the ADEK School Digital Policy. Dubai private schools follow KHDA licensing, with no sector-wide cyber audit cycle. Universities and suppliers are not schools, so check their own rules.

  • Binding law
  • Regulator rule
  • Standard or policy
  • Contract term

ADEK-regulated schools

Abu Dhabi

Standard or policyADEK School Digital Policy v1.1, with the PDPL where it applies. UAE IA and CIIP only if designated.

Role-based access. Encryption in transit and at rest. Firewalls and IDS/IPS. Web filtering and network monitoring. Anti-malware, device encryption and regular patching. Automated backups with offline vaulting. Disaster recovery. Data classification and DLP. Regular awareness training. Updated incident response plans. A tabletop cyber-attack simulation with school management.

Confirm: The policy names these activities as regular. It sets no yearly or quarterly cadence for each.

Universities and higher education institutions

Federal

Regulator ruleYour higher-education regulator’s licensing and data requirements, with the PDPL where it applies. UAE IA if designated.

Confirm your regulator and any digital or data integration duties. Protect student and staff records, learning platforms, research data and integration credentials. Do not assume the ADEK school policy covers universities.

Private schools and providers regulated by KHDA

Dubai

Regulator ruleKHDA licensing and policies, with the PDPL where it applies. DESC only if your entity falls in DESC scope.

The public KHDA resources reviewed set no universal cyber test or audit frequency for every private school. Apply the licensing and privacy duties. Secure student systems, accounts, devices, backups and cloud services.

Dubai government and semi-government education entities

Dubai

Standard or policyDESC ISR, the DESC IoT standard where relevant, and the DESC CSP standard for cloud providers serving them.

ISR is mandatory for Dubai Government Entities. Do the applicability review and keep evidence for the controls in scope.

Education cloud and service suppliers

Dubai

Standard or policyDESC CSP Security Standard if you provide cloud services to Dubai government or semi-government entities. Contract. PDPL where it applies.

DESC states CSP compliance is mandatory for providers who want to offer those services. Certification has yearly surveillance audits where possible and recertification every three years.

Personal data in education

Federal

Binding lawFederal Decree-Law No. 45 of 2021 (PDPL), subject to exclusions. Free-zone regimes may differ.

Use suitable technical and organisational security. Protect systems and data. Restore access after a failure. Test whether measures work. High-risk processing, such as a large volume of sensitive personal data, may trigger a data protection impact assessment.

Federal education entities and designated critical digital services

Federal

Regulator ruleFederal government security policies that apply to you. UAE IA and CIIP only if designated.

The Ministry of Education’s own policy is not automatically binding on private institutions. Only designated entities must apply UAE IA. Confirm your formal status.

This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every entity in it critical. We state a test or audit frequency only where the binding instrument or contract does. Some government and security directions reach only the entities they cover. Confirm your status, scope and current versions with your counsel and the competent authority.

What a school asks us first

0of 4 done. Whatever is left is where we start.

Where we would start with a school or university

Protect What MattersProtect What MattersTighten identity for the people who hold records and money, and clear accounts that outlived their owners.Identity & Access Security, Identity Security Posture Management (ISPM), Data SecuritySecure & ComplySecure & ComplyCompare practice with the ADEK policies where they apply and with the personal data law, then set owners and evidence.Compliance Assessments, Third-Party & Supply-Chain Risk, Control Design & ImplementationManage Cyber Risk & ExposureManage Cyber Risk & ExposureFind what faces the internet across departments and labs, and rank the systems the term depends on.External Attack Surface Management, Vulnerability & Exposure Management, Crown Jewel Identification

If you also operate in the US, the UK, India or Australia

UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.

United States

United Kingdom

India

Australia

Standards that follow your data, not your sector

Card, privacy, resilience and assurance standards reach a school or university through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.

  • Law
  • Card brand rule
  • Buyer requirement
  • Voluntary certification
  • Law

    GDPR

    EU General Data Protection Regulation

    You recruit or teach students in the EU, or run an EU campus.

    A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).

    Source: EUR-Lex, Regulation (EU) 2016/679
  • Card brand rule

    PCI DSS

    Payment Card Industry Data Security Standard

    Tuition, fees and bookshop payments by card.

    Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.

    Source: PCI Security Standards Council
  • Buyer requirement

    SOC 2

    AICPA System and Organization Controls 2

    Asked of learning platforms and hosting vendors that hold student records.

    An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.

    Source: AICPA, SOC suite of services
  • Voluntary certification

    ISO/IEC 27001

    Information security management systems

    A common evidence point for IT services and research data.

    The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.

    Source: ISO, ISO/IEC 27001

What to read before you talk to us

Industry BriefIndustry Brief: Education Cyber Risk PrioritiesWhere campus risk concentrates and what leaders decide first.
ArticleUAE Cybersecurity Regulatory Landscape: A Practical Executive View
Threat IntelligenceAdversary-in-the-Middle Attacks: When MFA Is Not the End of the Story
Practitioner Field NotePlaybook: Assessing a Critical Supplier
Technical ExplainerData Discovery and Classification: Why Programs Stall After the First Scan
Practitioner Field NotePlaybook: Running a Cyber Resilience Exercise

Sources and method. This page is analysis, not legal advice.