The UAE Cybercrime Law, formally Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, came into force on 2 January 2022 and replaced the 2012 cybercrime law. It criminalises hacking, data theft, online fraud, extortion, the spread of false information and a wide range of other online conduct, with penalties that escalate sharply when government or critical infrastructure systems are involved. For businesses it matters in two directions: it protects you when you are attacked, and it exposes your organisation and staff if your systems, data or people are misused. This guide explains the law in plain language and what to do about it. It is general information, not legal advice.
Key Takeaways
- Federal Decree-Law 34 of 2021 is the UAE’s primary cybercrime statute, effective 2 January 2022, replacing Federal Law No. 5 of 2012.
- It criminalises unauthorised access, data damage and theft, interception, fraud, phishing, extortion including ransomware, misuse of VPNs for crime, spreading rumours and false news, and online defamation and harassment.
- Penalties include imprisonment and fines, with the heaviest sanctions reserved for attacks on government, banking and critical infrastructure systems.
- Businesses are victims and potential defendants: employee misuse, poor data handling and careless public statements all create exposure.
- Preserve evidence, report through official channels and align security, HR and communications policies with the law.
What the Law Covers
The Decree-Law is broad. The provisions most relevant to organisations include:
- Unauthorised access to websites, networks, systems or data, with higher penalties where access leads to deletion, alteration, disclosure or theft of data, and higher again for government or critical systems.
- Attacks on government and financial systems, including disrupting or obstructing access to government, banking and critical infrastructure services.
- Data and communication offences: unlawful interception, obtaining confidential or government data, and misuse of personal data and electronic payment information.
- Fraud and forgery: electronic forgery, fraud using online means, phishing and identity theft, and creating fake websites or accounts to deceive.
- Extortion and threats conducted through information technology, which is how ransomware and sextortion are prosecuted.
- Malicious software: creating, distributing or using malware and tools designed to attack systems.
- Misuse of VPNs and IP spoofing to commit or conceal a crime.
- Rumours, false news and content offences: publishing false information that harms public order or the state’s interests, as well as online defamation, harassment and privacy violations.
- Content hosted or published by website owners and administrators who fail to remove illegal content when required.
Penalties combine imprisonment and fines that scale with the target and the harm. Fines for serious offences against government or critical infrastructure systems run into millions of dirhams, and courts can order confiscation of equipment, deletion of data and closure of websites. Deportation may apply to non-citizens convicted of certain offences.
How the Law Protects Your Business
Every common attack on a UAE organisation maps to an offence under the Decree-Law: the phishing email that compromises a mailbox, the invoice fraud that follows, the ransomware deployment and the extortion demand, the theft of customer data and its sale online. That gives you a legal basis to report, to obtain law enforcement support and, where attackers are identified, to pursue prosecution and recovery.
Reporting matters. Dubai Police operates the eCrime platform for cybercrime reports, Abu Dhabi Police and other emirates provide equivalent channels, and the federal authorities coordinate serious incidents. Our incident response planning guide explains how to build reporting into your playbook, and our guide to business email compromise in the UAE describes the most frequently reported attack.
Where Businesses Create Their Own Exposure
Employee conduct. Staff who access systems or data beyond their authorisation, retain customer data after leaving, or use company devices to harass, defame or spread false information can commit offences, and the organisation faces reputational and in some cases legal consequences. Access control, acceptable use policies and leaver processes are legal safeguards as well as security ones; our IAM best practices guide covers them.
Data handling. Unlawful collection, disclosure or misuse of personal data and payment information is an offence under the cybercrime law in addition to obligations under the UAE PDPL. Our PDPL compliance guide sets out the data protection side.
Security testing. Penetration testing and red teaming are authorised access only when properly scoped and documented. Always use written rules of engagement that name the systems, dates and testers, and never test systems you do not own or have authority over. See our red teaming versus penetration testing guide.
Corporate communications. Statements about competitors, public incidents or security events must be accurate. Publishing unverified claims online can fall within the rumours and false news provisions.
Platforms you operate. If you run websites, forums or apps that host user content, you need a process to remove illegal content promptly when required.
Evidence and Investigation: What to Do During an Incident
- Preserve logs, disk images, emails and chat records before remediation destroys them; forensic preservation supports both the police report and any insurance claim.
- Record a timeline of discovery, actions taken and people involved.
- Report through official channels promptly and keep the reference number.
- Coordinate notifications: the UAE Data Office or the DIFC or ADGM commissioners where personal data is involved, sector regulators such as CBUAE, DESC, DoH or DHA where applicable, and your cyber insurer.
- Engage legal counsel before engaging with extortionists; ransom payments carry legal and sanctions considerations.
- Use a retained incident response provider so forensic and legal steps happen in the right order.
Our ransomware readiness checklist includes the evidence-preservation steps that are easiest to get wrong in the first hours.
A Practical Compliance Checklist
- Adopt an acceptable use policy that references the cybercrime law and have every employee acknowledge it.
- Enforce least-privilege access, MFA and logging so unauthorised access is prevented and, when it occurs, provable.
- Define data handling and retention rules aligned to the PDPL and sector laws.
- Document rules of engagement for all security testing and keep authorisations on file.
- Add a cybercrime reporting step and contact details to your incident response plan, and rehearse it.
- Train staff on phishing, social media conduct and the consequences of misuse, using the law as context.
- Review social media and communications policies against the rumours and defamation provisions.
- Maintain a content takedown process for any platforms you operate.
- Keep forensic capability on retainer and test evidence preservation during exercises.
Frequently Asked Questions
What is the UAE Cybercrime Law?
Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes is the UAE’s primary cybercrime statute. In force since 2 January 2022, it replaced Federal Law No. 5 of 2012 and criminalises hacking, data theft, online fraud, extortion, malware, misuse of VPNs for crime, the spread of false information and a range of other online conduct.
Is ransomware a crime under UAE law?
Yes. Deploying malware, unauthorised access, damaging or encrypting data and extorting a victim through information technology are each offences under the Decree-Law, with penalties that increase when government, banking or critical infrastructure systems are targeted.
How do I report a cybercrime in the UAE?
Report to the police in the relevant emirate, for example through the Dubai Police eCrime platform or Abu Dhabi Police channels, and preserve evidence before remediation. Where personal data or regulated systems are affected, also notify the relevant data protection authority and sector regulator.
Is using a VPN illegal in the UAE?
Using a VPN is not itself illegal. The law penalises using a VPN or false IP address to commit or conceal a crime. Businesses can and do use VPNs for legitimate secure access, and should document that use in policy.
Can an employee be prosecuted for accessing company data without permission?
Yes. Unauthorised access to systems or data, and obtaining or disclosing confidential data, are offences regardless of whether the person is an insider. Clear authorisation records, access controls and acceptable use policies protect both the organisation and its staff.
Does the cybercrime law replace the UAE PDPL?
No. The cybercrime law criminalises specific conduct, while the PDPL sets out how organisations must process and protect personal data. Both can apply to the same incident, for example a data breach caused by hacking, and compliance programmes should address both.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA helps UAE organisations prevent, detect and respond to the attacks the cybercrime law addresses, with incident response and digital forensics, 24/7 managed SOC services, security awareness training and regulatory compliance consulting. Talk to our Dubai team about aligning your policies and response plan with UAE law. This article is general information, not legal advice.