Licensing is not a cyber rule
The Department of Culture and Tourism in Abu Dhabi and the Department of Economy and Tourism in Dubai license and classify hotels and agents. The research found no universal cyber audit cycle in those rules.
Hotel and travel cybersecurity in the UAE: In hospitality, one call to a help desk can open the guest database.
Attackers use ordinary routes: a phone call, a stolen password, a trusted booking email. In a hotel or travel business, those routes end at passports, cards and loyalty accounts, and a front desk that cannot stop serving guests.
The road to money
Where an ordinary intrusion goes in a hotel or travel business
The first steps look like any other sector. The last three do not.
- A call or a click
A caller posing as staff to the help desk, a fake booking-platform email, or a stolen password.
- A trusted identity
Not only administrators. Reservation and front-office staff, revenue managers, and an outsourced help desk that can reset passwords and MFA.
- The guest record
Passport or ID numbers, loyalty accounts and payment data, often held longer than needed and by several parties.
£18.4mfine imposed by the UK ICO on Marriott over the Starwood reservation database breach, 339 million guest records - A shutdown that costs
Shutting systems down protects data. It can also stop card payments, websites, digital room keys and bookings.
~$100mexpected impact on MGM Resorts from its cyber incident, per its securities filing - Many parties, one guest
Brand, owner and operator each control part of the estate. Property systems, booking engines, payment providers and outsourced IT sit in every flow.
What the regulator expects
Hospitality has no single cyber rule. Data law and contracts do the work.
The research found no federal cybersecurity standard for all hotels and travel agents, and no verified yearly cyber audit in tourism licensing. Duties come from the PDPL, government ownership and designation, and payment contracts.
- 31 Dec 2024PCI DSS v4.0 retired. PCI DSS v4.0.1 is the only version the PCI council supports after this date.
- 31 Mar 2025The future-dated requirements in PCI DSS v4.0.1 became mandatory.
- Your acquirerCard brands and acquirers decide whether and how you validate. PCI DSS is a payment-industry standard, not UAE law.
Guest data falls under data law
The PDPL asks for suitable security and for testing that it works (Art. 20). Guests come from many countries, so other breach clocks can also apply. The shortest clock that reaches your guests should set the plan.
Payments follow the acquirer
PCI DSS binds merchants and service providers through card brands and acquirers. Keep that separate from statutory duties when you report to a board or a regulator.
Rules and frameworks behind this page
- UAE Personal Data Protection Law, Federal Decree-Law 45 of 2021Asks for suitable security measures and testing of their effectiveness (Art. 20), and an impact assessment for high-risk processing (Art. 21).
- PCI DSS v4.0.1A payment-industry standard for entities that store, process or transmit card data. Set by contract with card brands and acquirers, not by UAE law.
- DESC standards and policiesISR for Dubai Government Entities and the CSP standard for cloud providers serving them. Not triggered by a hotel being in Dubai.
- UAE Critical Information Infrastructure Protection PolicyUAE IA applies only to entities designated under this policy.
Source: DCT Abu Dhabi and Dubai DET licensing; UAE PDPL; PCI Security Standards Council. This is analysis, not legal advice.
UAE rules, by who you are
Which UAE rule reaches a hotel, a travel agent or a tourism venue
Tourism licensing is not a cyber rule, and the research found no federal cyber standard for all hotels and agents. Guest data falls under data law. Card security follows your acquirer.
Hotels, resorts and serviced apartments
Abu DhabiBinding lawDCT Abu Dhabi tourism and hospitality licensing, with the PDPL where it applies.
Protect guest identity, booking and payment data, property management systems, Wi-Fi, door locks, CCTV and vendor links. No universal yearly cyber audit was verified for every hotel.
Hotels and hospitality operators
DubaiRegulator ruleDubai Department of Economy and Tourism licensing and classification, with the PDPL where it applies.
No universal cyber audit frequency was verified in tourism licensing. Secure guest and payment data, the property management system, booking systems, Wi-Fi and connected property devices.
Travel agencies, tour operators, ticketing and booking platforms
FederalContract termTourism licensing, the PDPL where it applies, and payment and acquirer contracts.
Secure booking and customer platforms, payment integrations and third-party booking links. Identify data processors. Confirm PCI DSS and acquirer duties separately from UAE law.
Confirm: PCI DSS is a payment-industry standard set by contract.
Attractions and connected venues
Abu DhabiRegulator ruleVenue licensing, contract requirements, and UAE IA and CIIP if designated.
Protect ticketing, access control, CCTV, building systems and customer data. Apply critical-infrastructure controls only if you are designated.
Dubai government and semi-government tourism services
DubaiStandard or policyDESC ISR for government entities. The DESC CSP standard if a cloud provider serves them. CII if designated.
Apply ISR to government entities and the CSP standard to defined cloud providers. Being a hotel in Dubai does not bring a private operator under DESC.
Guest personal data
FederalBinding lawFederal Decree-Law No. 45 of 2021 (PDPL), subject to exclusions. ADGM and DIFC have their own regimes.
Use suitable security, make data available after a failure and test the safeguards. Passport and ID data raises the stakes, so keep only what you need and encrypt it.
Designated critical tourism or transport services
FederalRegulator ruleCIIP Policy and UAE Information Assurance standard, where designated.
Apply UAE IA only where formal designation applies. Do not assume every tourism entity is designated.
This is analysis, not legal advice. A sector’s presence on a critical-infrastructure list does not make every company in it critical. We state a test or audit frequency only where the binding rule, licence, designation or contract does. Confirm your licence, any designation and the current version of each rule with your counsel.
Beyond the UAE
If you also operate in the US, the UK, India or Australia
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
United States
- FTC final order against Marriott and Starwood (December 2024)The FTC finalized an order requiring a comprehensive information security program, limits on how long personal data is kept, and a deletion request link for U.S. customers. Read as a guide to FTC expectations.
- California Consumer Privacy Act (CCPA)Covers for-profit businesses meeting its thresholds. Guests in California can ask to know, delete, correct or limit use of their data. A breach caused by poor security can trigger private lawsuits.
India
- CERT-In Directions under section 70B(6), 28 April 2022Service providers, body corporates and others must report listed incidents, including data breaches and ransomware, within 6 hours and keep ICT logs for a rolling 180 days within India.
- Digital Personal Data Protection Rules, 2025Notified in November 2025 with an 18-month phased compliance period. Affected guests must be told of a breach without delay, in plain language. Relevant to guest and booking records held in India.
Australia
- Privacy Act 1988: Notifiable Data Breaches schemeCovers organizations the Privacy Act covers. A suspected breach should be assessed within 30 calendar days. If serious harm is likely, notify the OAIC and the people affected.
- Cyber Security Act 2024: ransomware payment reportingBusinesses with annual turnover above A$3 million, and critical infrastructure operators, must report a ransomware or cyber extortion payment within 72 hours of making it. In force since 30 May 2025.
What changes
What changes for a hotel or travel business
The same security decision gets a different answer once a guest, a passport and a front desk are in the picture.
Who to protect first
Domain and cloud administrators.
The help desk, in-house or outsourced, and the reservation and front-office staff who open booking-platform emails all day.
Resetting a password
A routine IT request.
A high-risk process. Verify the caller with facts not found online, require a second approver for privileged and MFA resets, and call back on a number on file.
What to keep
Keep data in case it is needed.
Decide whether passport and ID details are needed after check-in. If they are, encrypt them. Data you do not need is liability.
Containing an incident
Shut down the affected systems.
A shutdown is a business decision with a price. Define the minimum guest service first: manual check-in, key issue and offline payment.
Buying a business
Review policies and contracts.
Acquired systems carry acquired intrusions. Include a compromise assessment in due diligence.
First asks
What we are asked first
Review identity recovery
Walk through how a caller proves who they are, who approves a reset, and what the outsourced help desk is allowed to do.
Shrink card scope
Inventory every place a card is typed, swiped, stored or read out, and remove the paths you do not need.
List vendors with standing access
Name every supplier with remote access to production systems and plan how to cut one off without closing the property.
Rehearse the shutdown
Run a tabletop where systems are down: manual check-in, keys, payment and recovery order.
First moves
Where we would start with a hotel or travel business
Manage Cyber Risk & Exposure
Rank the help desk, guest data, payment paths and vendor access by what a breach would cost.
- Cyber Risk Assessments
- Third-Party & Supply-Chain Risk
- Vulnerability & Exposure Management
Protect What Matters
Redesign identity recovery, shrink card scope and segment guest Wi-Fi and property devices.
- Identity & Access Security
- Phishing Operations
- OT/ICS & IoT Security
Detect, Respond & Recover
Agree the minimum guest service and the recovery order, then rehearse a shutdown with the front desk.
- Cyber Resilience
- Crisis Management
- Resilience Testing
Read next
What to read before you talk to us
Industry Brief Industry Brief: Hospitality Cyber Risk Priorities Five priorities for hospitality, from the help desk to a guest service that survives a shutdown. Cybrilliant Risk Management SME Article Identity Is the New Attack Path Why identity is the route attackers take. Cybrilliant Threat Intelligence SME Executive Briefing Cyber Resilience: What Happens When Preventive Controls Fail? What recovery looks like when preventive controls fail. Cybrilliant Cyber Resilience SME Industry Brief Industry Brief: Real Estate Cyber Risk Priorities The property side: building systems and vendor access. Cybrilliant Risk Management SME
Sources and method. This page is analysis, not legal advice.
- PCI Security Standards Council, PCI DSS v4.0.1
- UK Information Commissioner’s Office, Marriott International penalty notice
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection
- UAE Critical Information Infrastructure Protection Policy
- UAE Information Assurance standard
- DESC Information Security Regulation and Standards
- DESC Cloud Service Provider / Data Centre / SOC security standards
- UAE Legislation portal