Cybercrime Law UAE: What It Covers | #cybercrime | #infosec

The UAE cybercrime law is Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, which came into force on 2 January 2022 and replaced Federal Law No. 5 of 2012. It is much broader than a computer misuse statute: it covers content, speech, privacy and reputation as well as hacking and fraud, and it applies to ordinary social media use.

That breadth is the point most residents miss. A post, a forwarded message or a photograph taken in a public place can engage the criminal law here in circumstances where it would not in Europe, North America or much of Asia. The law has been amended since it was issued, so the consolidated text on the official legislation portal is the version to work from.

What does the cybercrime law actually cover?

The law runs across several distinct areas. Broadly, it deals with:

• Unauthorised access to systems, networks and websites, and interference with data.
• Online fraud and deception, including fraudulent electronic payment activity and fake platforms.
• Content offences, including insult and slander committed through an information network, and publication of false information or rumours.
• Privacy offences, including interception of communications, photographing or recording people without consent, and publishing material obtained that way.
• Offences relating to state security, public order, religion and public morals, and to material considered to disturb public peace.
• Misuse of personal data and unauthorised dealing in it.

Penalties span fines and custodial sentences, and for non-citizens deportation can follow a conviction. The ranges are set by the decree-law and have been amended, so they should be checked against the current text rather than repeated from an older summary.

Which offences are most likely to affect residents and businesses?

In practice, a small number of provisions generate most of the cases involving ordinary residents and companies.

The first is insult and slander by electronic means. Saying something online that imputes a specific fact capable of exposing someone to punishment or public contempt, or using abusive or demeaning language about them, can be an offence. It applies to private messages as well as public posts, which surprises people. A WhatsApp group of six colleagues is an information network for these purposes.

The second is publishing false information or rumours. Circulating unverified claims about a company, a product, an incident or a public matter can engage the law even where the person forwarding it did not originate it.

The third is the privacy group. Photographing or filming someone without consent and posting the result is an offence, and it does not matter that the picture was taken in a public place. Publishing conversations, recordings or images obtained without consent is treated seriously, and manipulated recordings or images attract greater exposure.

For businesses, the exposure sits in marketing claims, reviews and reputational disputes. A comparative advertisement that names a competitor, a complaint posted on a company account, or a staff member briefing a journalist off the record can all create problems under this law rather than under commercial legislation.

Why is conduct that is lawful elsewhere an offence here?

Three structural differences explain most of it.

First, truth is not a general answer. In many jurisdictions, proving the statement true defeats a defamation claim. Under the UAE framework, publishing true but private information with intent to harm someone’s reputation can itself be an offence. The question is not only whether the statement was accurate but whether publishing it was lawful.

Second, there is no strong public interest or free expression override built into the analysis. Journalism, whistleblowing and consumer criticism do not sit in a protected category in the way they do under systems with constitutional speech protections.

Third, the criminal law reaches private communications. Many people assume a closed group chat is not publication. It is.

The result is that habits formed elsewhere travel badly. The commonest single scenario is a resident posting an angry complaint about a landlord, employer, contractor or former partner, naming them, and being met with a police report the following week.

Does the law apply inside the DIFC, ADGM and the free zones?

Yes. Criminal law in the UAE is federal and applies across the whole territory. The DIFC and ADGM have their own civil and commercial courts, but neither has criminal jurisdiction. A cybercrime allegation arising from conduct in the DIFC is investigated by the Dubai Police and prosecuted in the onshore criminal courts, in Arabic.

Free zone status therefore offers no insulation here. It is a genuine difference from the corporate, employment and data protection position, where free zone rules often do displace the federal regime. Note in particular that the DIFC and ADGM have their own data protection laws that operate alongside, not instead of, the federal criminal provisions on data and privacy.

Is there a defence, and what happens if a complaint is filed?

The realistic answers are narrow. Lack of intent can matter for offences that require a specific intention, and the identity of the poster is sometimes genuinely in dispute where accounts are shared or spoofed. Beyond that, arguments that would work elsewhere, such as fair comment, honest opinion or public interest, do not map onto this framework.

Where offences are among those that require a complaint from the victim, withdrawal of that complaint can bring the matter to an end. This is why so many of these cases resolve through settlement and a formal withdrawal rather than through trial. Whether a particular offence can be resolved that way depends on how it is classified, and that is a question for a licensed lawyer on the specific charge.

Once a complaint is filed, the immediate practical risks are a travel ban and seizure of devices. Do not delete material, and do not contact the complainant directly to argue. Both make matters worse.

What should individuals and companies do to stay on the right side of it?

The controls that work are unglamorous:

• Do not name individuals or companies in a critical post. Take the dispute to the contract, the regulator or the court instead.
• Assume every group chat is publication, including work groups and family groups.
• Do not photograph or film people without consent, and do not forward images of accidents, arrests or injured people.
• Do not forward unverified claims, even with a disclaimer.
• For businesses, put a social media and communications policy in place, train the people who hold the account credentials, and set a rule that competitor comparisons go through legal review.
• Keep the corporate account separate from personal accounts, and keep a record of who posted what.

Where a complaint has already been made against you, the sequence that tends to work is early legal representation, a realistic assessment of whether the matter can be settled and withdrawn, and no further communication about the subject online.

This article is general information about UAE law as at September 2026 and is not legal advice. The position varies by emirate and by free zone and changes often, and this decree-law has been amended since it was issued. Take advice on your own facts. Anyone facing an actual allegation under the cybercrime law should take advice from a UAE licensed lawyer immediately, before responding to the complainant or to the police.

Legal Desire has published legal industry news and analysis since 2012. This article is part of our UAE desk, which tracks the laws, courts and regulators of the Emirates for lawyers and in-house teams.