When Conflict Hits Home: A Guide For Digital Businesses In The GCC

I was sipping tea in my backyard when I first heard it: a sharp, distant boom that rattled somewhere between the windows and my chest. My first instinct—it had something to do with construction, the soundtrack of ever-developing Dubai. My father-in-law, a former military man, who was in the room with me, did not flinch, but he put down his teacup. "Sonic boom," he said, quietly but reassuringly. Geopolitical tensions had entered our backyard. 

Since then, as the panic has subsided, we have learnt that fear and risk are not the same thing. Fear lingers. Risk is a variable that must be managed. As governments across the GCC continue to do their job to derisk the situation with calm and coordinated responses, businesses in the region must also do theirs and ensure continuity. This is especially true for digital businesses, which are not just the lifeblood of modern economy, but also possible strategic targets. 

But what does this really mean? Let's get specific. 

Companies As Geopolitical Pawns: More Than A Data Center Problem 

When drones reportedly struck the data centers of an American company located in the UAE last week, it marked the first such attack during an active conflict. But it may not be the last. Technology company assets are now understood to be legitimate targets.  

Although damage was limited, it has taught us that, first, the cloud lives in buildings, in countries, and some of those countries are now at war. And the attack surface extends far beyond any single building. Global positioning system (GPS) networks can lose precision. Payment rails can get disrupted. Even artificial intelligence (AI) model weights, with months of training, millions in compute, may not be recoverable.

The solution is not glamorous though: keep data in safe places. Before the Russia-Ukraine war for example, Ukraine foresaw the risk and moved petabytes of critical data off local servers and into the cloud (read: servers in more secure locations). This was backed by an emergency legislation that effectively dismantled the localization laws. 

From a policy lens, the conflict has made the data localization debate urgent. From an operational standpoint, data distribution and data mirroring across regions are no longer a "good-to-have,” they are survival strategies. 

Who Holds the Keys: Ensuring Business Continuity 

Every digital business has someone who holds the keys. The Chief Executive Officer with root access. The Chief Technology Officer who is one of the multisig wallet signatories. The Compliance Officer whose credentials unlock the regulatory portal.  

In peacetime, this is an inconvenience. In a conflict zone, it is an existential vulnerability. The question every founder is asking right now is: what happens to the business if I am unreachable? As the government works to secure the internet, businesses must secure themselves. 

Typically, regulated financial companies are legally required to have succession and continuity plans. Most have cursorily signed off on these “documentary requirements”, but never stress-tested them. The COVID-19 crisis has already made the cost of that visible. The companies that survived weren't the most sophisticated. They were the ones that had a plan, and followed the plan. 

A conflict zone is not a pandemic. But the lesson is identical: continuity planning is not a compliance exercise; it is the difference between a business that survives a crisis and one that becomes a casualty of it.

The Clock Does Not Stop: Earn Regulatory Trust 

There is a common, understandable assumption that regulators will be more accommodating in a crisis. Sometimes they are. But licensing requirements, compliance deadlines, and sanctions obligations do not have a geopolitical-clock-stop. On the contrary, the regulatory landscape in a conflict shifts faster than most compliance teams can track.  

A digital finance company that onboarded customers last week may find itself solving a sanctions problem it did not know it had. Digital media platforms might face the pressure of tracking wartime developments in real time, identifying misinformation before it spreads.

The window to engage with regulators proactively, before the deadline passes, before the breach is recorded, before the damage is done, is narrow. Regulators remember who came to them, and who they had to chase. 

Force Majeure: Fine Print, Big Impact 

Understanding contractual exposure—what is covered, what is excluded, what remedies actually exist—cannot be done well in the middle of an operational emergency. It needs to be done before one.  

The businesses calling their lawyers this week to understand their contracts are already behind. But better late than never: audit your agreements now.

Conflicts As Accelerants Of Innovation 

Conflict, grim as it is, compresses the timeline between invention and necessity. 

Delivery platforms may reroute dynamically around disrupted supply chains, demonstrating operational resilience. AI-powered tools may collapse language barriers for displaced populations and relief workers. Insurance smart contracts may be deployed to trigger automatic payouts. Stablecoins may provide settlement rails when banking infrastructure is impacted.  

Several such concepts can turn into commercial reality, catalyzed by war-time urgency. Conflict does not create these solutions but encourages their deployment. Businesses thus must solve for the present risk of survival, and hedge against the future risk of irrelevance.

The Most Important Factor: The People 

Behind every platform, every protocol, every contingency plan, there are people. And, these people have families to reassure, children to pick up from school, and parents calling to ask if everything is alright. In moments like this, resilience is not just an infrastructure question, but a human one.  

In such times, businesses must give their teams comfort, clarity, and above all, flexibility. Encourage people to log off when they need to, check in with one another, and prioritize safety over productivity.  

A business that protects its people will always reemerge from risk. The reverse, however, is not true.

About The Author 

Ankita Dhawan is a technology lawyer and regulatory strategist. She is the founder of Consilium Advisors, a public policy and regulatory advisory firm based in the UAE.