UAE Cybercrime Law: Key Rules, Offences and Business Responsibilities
Digital platforms, electronic communications and information systems are now central to how organisations operate in the UAE. Their use also creates legal responsibilities concerning system access, personal information, online content, electronic payments and the handling of confidential data.
The principal federal legislation governing cybercrime is Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, which came into force on 2 January 2022. The law establishes a comprehensive framework addressing the misuse of websites, electronic information systems, networks, digital platforms and other information technology.
The legislation covers more than hacking and technical cyberattacks. It also addresses electronic fraud, unlawful access to data, invasion of privacy, online threats, defamation, the circulation of false information and various forms of prohibited digital content.
These provisions can affect companies, directors, employees, service providers and individual users. A message, image, recording, social media post or electronic transaction may have legal consequences depending on its content, purpose and the way it was obtained or distributed.
This blog explains the principal areas covered by the UAE Cybercrime Law, the potential implications for businesses and individuals, and the practical measures organisations can take to reduce their exposure to cybercrime and unlawful online conduct.
What Does the UAE Cybercrime Law Cover?
The UAE Cybercrime Law addresses offences committed through websites, electronic information systems, information networks, digital platforms and other forms of information technology. Its scope is considerably wider than unauthorised access to computer systems. The principal areas covered include:
Hacking and unauthorised access to websites, systems, networks and electronic accounts
Obtaining, copying, altering, disclosing, deleting or damaging electronic data without lawful authority
Disrupting websites, networks, digital services or information systems
Creating or using false websites, email accounts or electronic accounts
Electronic fraud, impersonation and the unlawful acquisition of money or benefits
Misuse of electronic payment information and financial data
Online threats, blackmail and extortion
Defamation and insults communicated through digital channels
Recording, photographing or sharing information in a manner that invades another person’s privacy
Publishing rumours, false information or certain categories of prohibited content
Unlawful handling of government information, confidential data and protected electronic records
The law therefore regulates both technical attacks and conduct carried out through everyday digital channels. Emails, messaging applications, social media platforms, cloud services, online payment systems and company devices may all be relevant depending on the circumstances. An act does not need to involve sophisticated hacking techniques to create potential liability. Accessing an account without permission, forwarding confidential material, publishing private communications or using digital information to deceive another person may also fall within the legislation.
For businesses, this broad scope means that cybercrime risk is not limited to the IT department. It may also arise through employment practices, marketing activity, customer communications, data handling, payment processes and employees’ use of workplace systems.
Unauthorised Access, Hacking and System Interference
The UAE Cybercrime Law prohibits hacking a website, electronic information system, information network or information technology device. A basic hacking offence may result in imprisonment and/or a fine ranging from AED 100,000 to AED 300,000.
Where the hacking causes damage, destruction, interruption or disruption, or results in data being deleted, disclosed, altered, copied, distributed or otherwise compromised, the penalty may increase to imprisonment for at least six months and/or a fine ranging from AED 150,000 to AED 500,000.
If the hacking is carried out to obtain data or information for an unlawful purpose, the law provides for imprisonment of at least one year and/or a fine ranging from AED 200,000 to AED 500,000. More serious penalties apply where government websites, systems, networks or information technology are involved.
In a business environment, potential risk may arise from conduct such as:
Accessing a company system without permission
Continuing to use login credentials after authority has been withdrawn
Entering areas of a system beyond the access granted to the user
Copying or downloading databases without approval
Altering or deleting company files
Installing malicious software
Disrupting a website, network or digital service
Using another person’s credentials to obtain protected information
Authorised access should therefore be clearly defined. The fact that an employee, contractor or service provider has been given access to one part of a system does not necessarily authorise access to all company information or allow data to be copied, retained or used for another purpose.
Businesses should apply role-based access controls, maintain system logs, document user permissions and remove access promptly when an employee or contractor changes role or leaves the organisation. These measures support cybersecurity and help establish what access was authorised if an incident occurs.
Personal Data, Privacy and Confidential Communications
The UAE Cybercrime Law contains several provisions governing the collection, interception, disclosure and use of information through electronic means. These provisions operate alongside the UAE’s wider data protection, employment and sector-specific requirements.
Unlawful Collection and Processing of Personal Data
Using information technology to collect, store or process the personal data of UAE citizens or residents in violation of applicable legislation may result in imprisonment and/or a fine ranging from AED 50,000 to AED 500,000.
Businesses should ensure that customer, employee and supplier information is collected for a lawful purpose, accessed only by authorised personnel and handled in accordance with the applicable data protection framework.
Interception and Disclosure of Communications
The law prohibits unlawfully obstructing or intercepting access to an information network, website, electronic system, communication or data. The offence may result in imprisonment and/or a fine ranging from AED 150,000 to AED 500,000.
If information obtained through interception is disclosed or leaked, the penalty may include imprisonment for at least one year and a fine of up to AED 1 million. More serious consequences apply where government communications, information or data are involved.
Invasion of Privacy
Using an information network, electronic system or information technology to invade another person’s private or family life without consent may constitute an offence unless the conduct is otherwise authorised by law. The prohibited activities include:
Eavesdropping on, recording or revealing conversations and communications
Recording or sharing audio or visual material
Taking, transferring, copying, keeping or disclosing photographs of another person
Publishing information, comments or images, even when genuine, with the intention of harming the person concerned
Publishing images of accident or disaster victims without the required permission or consent
Tracking, recording or disclosing another person’s geographical location data
The penalty may include imprisonment for at least six months and/or a fine ranging from AED 150,000 to AED 500,000. Modifying an image, recording or scene with the intention of insulting or defaming another person is also separately punishable.
Confidential Information Obtained Through Work
A person who uses electronic means to disclose confidential information obtained through their employment, position or profession without authority or permission may face imprisonment for at least six months and/or a fine ranging from AED 200,000 to AED 1 million. Using the information to obtain a benefit for the offender or another person is treated as an aggravating circumstance.
For organisations, these provisions are relevant to activities such as recording meetings, monitoring communications, sharing screenshots, forwarding customer information, retaining employee records and sending confidential documents outside the business. Internal access to information does not automatically provide authority to disclose or reuse it.
Electronic Fraud, Impersonation and Payment Offences
The UAE Cybercrime Law addresses several forms of electronic deception, including fake digital identities, fraudulent online transactions and the misuse of electronic payment information.
Fake Websites, Emails and Electronic Accounts
Creating a website, email address or electronic account and falsely attributing it to another individual or legal entity may result in imprisonment and/or a fine ranging from AED 50,000 to AED 200,000. If the false website, email or account is used, or another person is allowed to use it, in a manner that harms or offends the person to whom it was falsely attributed, the penalty may include imprisonment for at least two years. Higher penalties apply when the false digital identity is attributed to a government entity.
This provision may be relevant to fake company websites, impersonated corporate email addresses, fraudulent social media profiles and accounts created in the name of directors, employees or recognised brands.
Electronic Fraud
Electronic fraud includes unlawfully obtaining money, property, a benefit, a document or a signature by using a fraudulent method, a false name or an untrue identity through an information network, electronic system or information technology. The offence may result in imprisonment for at least one year and/or a fine ranging from AED 250,000 to AED 1 million.
Common business-related scenarios may include:
Sending false payment instructions
Impersonating a director, supplier or government official
Creating fraudulent invoices
Redirecting payments to an unauthorised bank account
Operating a deceptive website or online sales page
Using false information to obtain goods, services or financial benefits
A commercial disagreement or unsuccessful transaction is not automatically electronic fraud. The specific facts, representations, intention and evidence must be assessed.
Electronic Payment Instruments
The law also prohibits forging, cloning or copying credit cards, debit cards and other electronic payment instruments, as well as unlawfully obtaining their data through information technology. The same provision applies to unauthorised use of a payment instrument or its data to obtain money, property or services, and to knowingly accepting forged, copied or illegally obtained payment information. These offences may result in imprisonment and/or a fine ranging from AED 200,000 to AED 2 million.
Businesses should maintain independent verification procedures for changes to payment instructions, restrict access to financial systems, use multi-factor authentication and require appropriate approval before releasing funds. Requests involving passwords, one-time passcodes or unexpected bank account changes should be treated with particular caution.
Cyberextortion, Online Threats and Defamation
Digital communications can create criminal exposure when they are used to threaten, pressure, insult or damage the reputation of another person.
Cyberextortion and Threats
Using an information network or information technology to threaten or extort another person in order to force that person to act or refrain from acting may result in imprisonment for up to two years and/or a fine ranging from AED 250,000 to AED 500,000. Where the threat involves committing a crime or engaging in acts affecting honour, together with an express or implied demand that the person act or refrain from acting, the penalty may be temporary imprisonment for up to ten years.
Potential examples include:
Threatening to publish confidential information unless money is paid
Demanding a benefit in exchange for not releasing private images or communications
Threatening to disrupt a company’s systems unless a demand is met
Using stolen business data to pressure an organisation or individual
Threatening harmful online publication to compel a person to take a particular action
A legitimate commercial demand is not automatically extortion. Businesses may lawfully request payment, enforce contractual rights and warn that formal legal proceedings will be commenced. The wording, purpose, surrounding circumstances and nature of the threatened action are important.
Online Defamation and Insults
Using an information network, electronic system or information technology to insult another person, or to attribute conduct or a characteristic that could expose the person to punishment or contempt by others, may result in imprisonment and/or a fine ranging from AED 250,000 to AED 500,000.
An offence committed against a public official or a person performing a public service because of their work is treated as an aggravating circumstance.
The provision may apply to content shared through:
Social media posts and comments
Emails and electronic newsletters
Messaging applications
Online reviews
Websites and blogs
Discussion forums
Private or workplace group chats
Businesses should exercise care when responding publicly to customers, competitors, suppliers or former employees. Internal disputes should also be handled through appropriate reporting, disciplinary and legal procedures rather than through insulting messages or public allegations. Employees responsible for company accounts should receive clear guidance on authorised communications, complaint handling and escalation. A post made from an official account may expose both the individual author and the organisation to reputational, operational and legal consequences.
Rumours, False Information and Misleading Online Content
The UAE Cybercrime Law addresses the publication and circulation of false, misleading or unverified information through digital channels.
Rumours and False News
Article 52 covers the use of information networks or information technology to publish, republish or circulate false news, rumours, misleading information or information that contradicts official announcements in circumstances capable of affecting public opinion, creating panic or harming public interests.
The basic offence carries imprisonment for at least one year and a fine of at least AED 100,000. More serious penalties may apply in aggravating circumstances, including certain offences involving public authorities or committed during pandemics, crises, emergencies or disasters.
Liability is not necessarily limited to the person who originally created the content. Republishing, forwarding or recirculating information may also be relevant.Businesses managing websites, social media accounts or messaging groups should therefore:
Verify significant claims before publication
Use official sources for government and regulatory announcements
Distinguish confirmed facts from opinion or speculation
Avoid forwarding unverified information during emergencies
Maintain an approval process for sensitive public communications
Correct inaccurate information promptly when identified
Misleading Online Advertising
Using a website, information network or information technology to promote goods or services through a misleading advertisement or method containing inaccurate information may result in imprisonment and/or a fine ranging from AED 20,000 to AED 500,000.
The same provision also addresses advertising, promoting or facilitating dealings in virtual currencies, digital currencies, stored units of value or payment units that are not officially recognised in the UAE or where the required regulatory licence has not been obtained.
Marketing claims should be accurate, capable of substantiation and consistent with the company’s licence and regulatory permissions. Businesses should also review content produced by advertising agencies, influencers and other third parties acting on their behalf.
Other Regulated Online Content
The law contains additional provisions addressing activities such as:
Promoting unlicensed fundraising or donation campaigns
Conducting certain statistical surveys or questionnaires without the required permit
Promoting or selling unlicensed medical products
Publishing content prohibited under other provisions of the law
The legality of online content therefore depends not only on whether it is accurate, but also on whether the activity being promoted requires prior approval or is otherwise restricted.
Corporate and Management Liability
Cybercrime exposure may extend beyond the individual who carried out the prohibited act. Under the UAE Cybercrime Law, the person responsible for the actual management of a legal entity may be subject to the same penalties as the person who committed the offence if it is proven that the manager:
Was aware of the prohibited conduct
Failed to comply with duties arising from the management role
Contributed to the commission of the offence through that failure
The legal entity may also be jointly liable for fines or compensation where an employee commits the offence in the company’s name and for its benefit. Liability is therefore not imposed automatically merely because an offence was committed using a company device or account. The circumstances must be examined, including who authorised the conduct, whether management knew about it and whether the activity was undertaken for the organisation’s benefit.
However, businesses should not assume that employee misconduct will always remain an individual matter. Risk may increase where management ignores known unlawful activity, fails to respond to repeated warnings or permits company systems and accounts to be used for prohibited purposes.
Following a conviction, the court may also order measures such as:
Restricting the offender’s use of information networks, electronic systems or information technology
Closing a website involved in the offence, either completely or partially
Blocking access to the website for a period determined by the court
Failure to comply with a court-ordered measure may result in an additional penalty.
Companies should establish clear responsibility for cybersecurity, data protection and digital communications. Internal policies should identify who may access systems, publish content, manage corporate accounts, approve advertisements and respond to suspected incidents.
Management should also ensure that reported concerns are documented and investigated. A policy that exists only on paper is unlikely to provide meaningful protection if access controls, training, supervision and escalation procedures are not implemented in practice.
How Can Businesses Reduce Cybercrime Risk?
Cybercrime compliance requires more than antivirus software and firewalls. Businesses must also manage how employees, contractors and service providers access information, communicate online and use company systems.
Practical measures include:
Establish Clear Internal Policies
Policies should address acceptable technology use, confidentiality, personal data, social media, electronic communications, remote working, device security and the use of company accounts. Employees should understand that company information must not be copied, recorded, retained, disclosed or transferred without proper authority.
Control Access to Systems and Data
Access should be granted according to an individual’s role and reviewed regularly. Businesses should:
Use multi-factor authentication
Avoid shared user accounts
Maintain access and activity logs
Restrict administrator privileges
Review access when responsibilities change
Disable accounts promptly when employment or a contract ends
Obtain Authority Before Security Testing
Penetration testing, vulnerability scanning and other cybersecurity assessments should be conducted only with clear written authorisation defining the systems, methods, timeframe and permitted scope. Testing a system without appropriate authority may create legal exposure even where the stated intention is to identify vulnerabilities.
Protect Payment Processes
Changes to supplier bank details and urgent payment requests should be verified through a separate, trusted communication channel. Companies should implement payment approval limits, segregation of duties and additional verification for unusual or high-value transactions.
Manage Corporate Communications
Only authorised individuals should publish content through company websites, social media pages and official accounts. Sensitive statements, regulatory announcements, advertising claims and responses to disputes should be reviewed before publication. Employees should not use company channels to insult, threaten or make unverified allegations about customers, colleagues, competitors or public authorities.
Review Third-Party Access
Technology providers, consultants, marketing agencies and outsourced personnel may have access to sensitive systems or company accounts. Contracts should define permitted access, confidentiality obligations, security requirements and the procedure for returning or deleting information.
Train Employees Regularly
Training should cover phishing, impersonation, payment fraud, suspicious links, password security, personal data, recording and photography, social media conduct and internal incident reporting. Training should be practical and repeated periodically rather than limited to a policy issued when employment begins.
Maintain an Incident Response Procedure
The procedure should identify:
Who receives an incident report
Who has authority to contain the incident
How systems and accounts will be secured
How electronic evidence will be preserved
When management, insurers, regulators or law enforcement should be notified
Who is authorised to communicate externally
Prompt action may reduce financial loss, limit further disclosure and preserve information required for an investigation.
How to Respond to and Report a Suspected Cybercrime
A suspected cybercrime should be treated as both a security incident and a potential legal matter. The immediate priorities are to limit further harm, preserve evidence and escalate the matter through the appropriate channels.
Secure the Affected Systems
Depending on the incident, the organisation may need to:
Disable compromised accounts
Reset passwords and access credentials
Isolate affected devices or systems
Suspend unauthorised transactions
Block malicious email addresses, domains or connections
Notify the relevant bank or payment provider
Preserve backups and prevent further alteration of records
Containment measures should be coordinated carefully. Unnecessary deletion, reformatting or modification of devices may destroy information needed for an investigation.
Preserve Electronic Evidence
Relevant evidence may include:
Emails and complete email headers
Messages and call records
Screenshots
Website addresses and account names
Transaction records and payment instructions
Access logs and security alerts
Files received or downloaded
Dates, times and details of the persons involved
Internal reports and communications concerning the incident
The original material should be preserved where possible. Employees should avoid repeatedly forwarding suspicious content or attempting to access the suspected offender’s systems.
Escalate the Incident Internally
The incident should be reported promptly to the authorised internal contact, which may include management, information technology, cybersecurity, compliance, legal or data protection personnel.
The company should also review whether the incident creates notification obligations under applicable data protection laws, sector regulations, insurance policies or contractual arrangements.
Report the Matter to the Authorities
Cybercrimes may be reported through official police and government channels. Available options include:
The Ministry of Interior’s electronic crime reporting services
Dubai Police’s eCrime service
Abu Dhabi Police’s Aman service
The relevant local police station or police application
Police emergency number 999 where there is an immediate threat or ongoing emergency
Dubai Police’s eCrime service allows persons affected by qualifying criminal offences to submit complaints online. Dubai Police may also be contacted on 901 for non-emergency enquiries.
In Abu Dhabi, the Aman service can be contacted on 8002626, by SMS to 2828 or through the available Abu Dhabi Police channels.
The UAE Government portal also directs the public to official online channels for reporting cybercrime and confirms that 999 should be used for crimes and emergencies requiring immediate police assistance.
Where money has been transferred fraudulently, the affected bank or payment provider should be contacted immediately. Speed may be critical to tracing, freezing or attempting to recover funds.
How NUR Advisors Group Can Help
Cybercrime risk is not solely a technical matter. It is also connected to corporate governance, internal authority, employee procedures, data handling and the way third-party providers are managed.
NUR Advisors Group supports UAE businesses in establishing practical corporate and compliance frameworks that clarify responsibilities and reduce operational risk. Depending on the organisation’s requirements, this may include:
Reviewing internal governance and delegated authority
Defining responsibilities for company systems and digital accounts
Supporting the development of internal compliance policies
Establishing approval procedures for external communications
Reviewing employee onboarding and offboarding processes
Strengthening document control and confidentiality procedures
Reviewing the corporate aspects of third-party service arrangements
Coordinating with appropriate legal, data protection or cybersecurity specialists where required
NUR Advisors Group does not provide criminal defence, digital forensics or technical cybersecurity testing. Where an incident requires specialist investigation or legal representation, the appropriate qualified professionals should be engaged promptly.
Our role is to help businesses establish clear structures, documented procedures and effective lines of responsibility. These foundations can reduce uncertainty, support timely decision-making and help management respond more effectively when a digital risk or suspected cybercrime arises.
To discuss your organisation’s corporate governance and compliance requirements, contact NUR Advisors Group for support tailored to your business activities and operating structure.
Disclaimer
The information contained in this article is provided by NUR Advisors Group for general informational purposes only. It does not constitute legal, tax, accounting, financial, immigration, employment or other professional advice and should not be relied upon as a substitute for advice tailored to your specific circumstances.
Although reasonable efforts are made to ensure that the information is accurate at the date of publication, laws, regulations, procedures, fees and government requirements may change without notice. NUR Advisors Group makes no representation or warranty regarding the completeness, accuracy or continued validity of the information and, to the fullest extent permitted by law, accepts no liability for any action taken or decision made in reliance upon it.
Readers should obtain advice from appropriately qualified professionals and confirm current requirements with the relevant government or regulatory authority before taking action. Links to external sources are provided for convenience and do not constitute endorsement or guarantee of their content.
