2jenn - Fotolia

Falling oil prices and disjointed data protection threaten Middle East datacentres

A fixation on datacentre ownership and mistrust of third-party services could impede enterprise IT in the Middle East

This article can also be found in the Premium Editorial Download: CW Middle East: CW Middle East – April to June 2016

In the Middle East, the datacentre is afforded particularly high strategic status in the enterprise.  

It is at the heart of managing the current surge in mobile data traffic and device proliferation. It is central to the various e-government schemes and smart city initiatives that underpin much of the Middle East’s ambition to digitise its economies - and diversify away from oil production, towards business services and tourism.

This is particularly true of the six nations of the Gulf Cooperation Council (GCC): Saudi Arabia, the United Arab Emirates (UAE), Qatar, Bahrain, Kuwait and Oman.

In the five years to 2019, the Middle East and Africa will have experienced the highest growth rates in datacentre traffic in the world – at a compounded annual growth rate of 32%, from 82 to 328 exabytes - according to Cisco’s Global Cloud Index report.

2016 has been particularly eventful for the datacentre in the Saudi Arabia and UAE - the Middle East’s largest markets for the enterprise technology by size and adoption respectively. Since January there have been a number of datacentre launches, agreements to build more and one established facility became the first owned by a Middle East telecoms provider to gain Tier IV status – the highest level of certification.  

But beneath the surface are signs of a market stagnating or grinding towards saturation point, against the backdrop of the global oil price crash.

The oil slump over the 18-month period since June 2014 – from around $115 a barrel to around $30 a barrel this year – is making a direct impact on enterprise IT spending budgets in oil exporter countries, where governments are also the corporate technology sector’s largest customer.

Enterprise technology spend in Saudi Arabia – where almost half of the state’s GDP is derived from oil – seems particularly vulnerable. UAE, with around a third attributable to oil seems less affected – but not entirely immune – to the price crash’s effects.

Both countries have implemented public spending cuts to make up for oil revenue shortfalls.

“At the moment, all major, capital-intensive projects are on hold in both countries. This will continue to be the situation until oil prices recover,” said Biswajeet Mahapatra, research director at Gartner for the Middle East.

“We have not heard of any major investments in building new datacentres from scratch. Of course, the regular updates and modernisations which were planned might go through – but they’re also under major scrutiny and if possible are being deferred.”

Read more about Middle East IT

Saturation point

Growth in the datacentre market is forecast as flat over the next five years, as industry watchers revise their projections. For new datacentres market figures released this month (March 2016) at the Gartner Symposium in Dubai, compounded annual growth between 2016 and 2018 was revised up slightly from 1% to 2.46%.

IDC recently revised down overall ICT spending forecasts across the Gulf region for this year, to rise by only 3% to $66bn from $64bn in 2015.

Datacentre purchases appear to be drying up, but there is little evidence that spending is being diverted to update enterprise technology capabilities to address the increasing complexity and "always-on" demands of pervasive computing, such as introducing virtualisation to the datacentre. Outside of the Middle East, that has meant a move to cloud technology and managed services, and away from on-premise, wholly owned datacentres.

Corporations and organisations that include the US government and General Electric have justified such manoeuvres – outsourcing their increasingly complex and ever-changing enterprise IT requirements – with the need to focus squarely on core activities, cutting costs and capital expenditure in the process.

Analysts and managed service providers alike had predicted that the Middle East was set to take up cloud services en masse, aided by a lack of dependence on legacy systems in the region that would help the rapid transition from conventional, on-premise datacentres to third-party cloud services. 

Fears over data ownership

But this has not happened: “There is a lack of local hosting of public cloud solutions and locally available skill sets,” said Gartner’s Biswajeet Mahapatra. 

Rather, in Saudi Arabia and the UAE, governments and other conservative business sectors have steadfastly held onto on-premise datacentre ownership – with an almost visceral fear of losing control over their data. 

Between a quarter and a third of all datacentres in the region are government-owned and self-run, according to Saurabh Verma, analyst and research manager at IDC for the Middle East, Africa and Turkey. The rest is carved up among banks and financial institutions, utilities, oil and gas – in many of which the governments are also investors.

Retail, hospitality, professional services and non-banking financial services are the sectors increasingly considering hosting and the private cloud.   

“For government departments the situation is slightly different. There is this misguided idea that datacentres in themselves keep data secure,” Verma explained. “The notion of physically controlling your own datacentre is a difficult one to shift from.”

There have been instances of companies and government datacentres assessing cloud models, hosting and other third-party offerings, but a pervasive lack of trust in third party organisations to manage sensitive, internal data, has prevented adoption said Jonas Zelba, industry analyst at Frost & Sullivan. “As such, governments are hardly doing anything at all in cloud services.”

The reality of data security

Gartner’s Mahapatra suggested the concern over data security is partly responsible for the slow take-up of next-generation data technologies in the Middle East.

In some ways such fears may be justified – fed by regular tales of worldwide data security breaches hitting otherwise reputable corporations. In 2015 the Middle East and Africa suffered just 1.6% of the reported global data breaches, but that equated to some 76.5 million records exposed, according to Gemalto’s Breach Level Index Report for the first half of 2015. That was 31% of the global total of compromised data records, second only to North America.

“Changing datacentre strategy is also more tricky with governments – because the approval process is more involved and there are, of course, local laws and regulations around the ownership and location of personal data,” Verma said.

Laws that Gartner’s Biswajeet Mahapatra agrees have contributed directly to cloud technology’s negligible impact in the Middle East to date.

The GCC states have a patchwork of rules governing data localisation, seemingly inspired by European Union data protection legislation, to ensure that data generated within their borders is not transferred or replicated outside of them.

Patchy rules frustrate investment

But unlike the EU, there is neither a harmonised regional legal framework nor dedicated regulators to oversee data protection. Instead there are discrete, opaque rules that often vary – sometimes in the same country - across trade zones. For instance, in the UAE data transfer from the Dubai International Finance Centre to “a jurisdiction that does not have adequate levels of data protection” is prohibited. 

Nick O’Connell, technology, media and telecoms partner at UAE law firm Al Tamimi, said corporate users of cloud services could be exposed to claims from their own customers and face reputational damage if there is an outage or security breach – even when the cloud provider is at fault. “Similarly, failure on the part of the cloud provider, for example with regard to compliance in respect of data privacy, could lead to regulatory non-compliance on the part of the cloud user,” he said.

Such rules have until now stopped datacentre owners switching to the cloud, but also dissuaded expansion of suppliers of the cloud services in the region – particularly from outside of the Middle East.

But it appears the world’s biggest players are now gearing up to take a gamble there.

Oracle announced plans to build a “state-of-the-art” datacentre in Abu Dhabi to support its cloud services push in the region – one of a very select few from global technology elite to set up in the Middle East. It follows on from IBM’s declaration of intentions to build its own datacentres in the region, as part of a $1.2bn global expansion programme for its cloud offerings.

Grim news for the channel

Amazon’s AWS cloud arm is also rumoured to be opening a regional office in the Emirates.

Verma at IDC says that the only way international suppliers can truly make commercial headway in the region is to have a physical presence. Providers may benefit more from direct selling to the market – as opposed to through the reseller channel. 

Oracle and IBM’s forays into the Middle East are statements of intent for their aspirations of prominence within the region’s cloud technology market. This may ultimately prove good news for local cloud evangelists.

But before take-up of the technology can happen – with its promise of greater efficiency, shrinking capital expenditures and rapid delivery of cutting edge applications – it will require some bold rethinking from the most influential contributors to the region’s technological future: Its governments.

Read more on Virtualisation management strategy