Cloud or in-country: deciding where regulated workloads should live

Public cloud offers speed and services that are hard to match on premises. Regulated organisations in Oman and the wider Gulf also have to answer to data protection law, sector regulators and their own boards. The right answer is usually a mix, decided workload by workload.

Start with the data, not the platform

Classify data before choosing where it lives. A simple four-level scheme, public, internal, confidential and restricted, is enough for most organisations. Then map each system to the most sensitive data it holds. Marketing sites and analytics on anonymised data rarely raise questions; core banking records, health files and government identity data often do.

Know which rules apply

In Oman, the Personal Data Protection Law, issued by Royal Decree 6/2022, sets conditions for processing personal data and for transferring it outside the country. Sector regulators, such as the Central Bank of Oman for banks, may add requirements or approvals for outsourcing and cloud use. Contracts with government entities often carry their own residency clauses. Read them together, and record the reasoning for each decision.

Four common patterns

• Public cloud region abroad for workloads with no residency constraint and global users.
• A cloud region in the GCC where latency matters or regulators accept regional hosting.
• In-country colocation or private cloud for restricted data and systems that must stay in Oman.
• Hybrid, with sensitive records in country and stateless services, content delivery or analytics on anonymised data in the cloud.

The questions that decide it

• Where are the data, the backups and the logs stored, and who can access them?
• Which encryption keys does the provider hold, and which do you?
• How quickly can you recover in another site, and has it been tested?
• What would it cost, in time and egress fees, to move out?
• Does your team have the skills to run what you choose?

Our technology team designs landing zones in public cloud and builds private platforms in in-country data centres, with the network links that join them.