The UAE cybercrime law, replacing the 2012 law. It criminalises unauthorised access to systems and data, electronic fraud and forgery, online defamation, spreading rumours and false news, misuse of personal data and unlicensed online financial or crypto promotion, with imprisonment and fines up to the millions of dirhams. The legislation portal records one amendment without naming it.
Federal Decree-Law No. 34 of 2021 is the UAE's cybercrime law. It came into force on 2 January 2022 (Article 74), repealed Federal Decree-Law No. 5 of 2012 on Combating Cybercrimes (Article 73) and remains in force; the legislation portal records one later amendment. It is a criminal statute: it does not create a compliance programme, but it sets the prison terms and fines that apply to anything done through a website, network, account or electronic payment system.
The first group of offences protects systems and data. Article 2 punishes unauthorised access with imprisonment and/or AED 100,000 to AED 300,000, rising to at least one year and AED 200,000 to AED 500,000 where the aim is to obtain data for illegal purposes. Article 6 punishes misuse of personal data with at least six months and/or AED 20,000 to AED 100,000, aggravated for health, banking and e-payment data; Article 13 punishes unlawful collection or processing of residents' personal data with imprisonment and/or AED 50,000 to AED 500,000. Article 8 sets at least five years and AED 500,000 to AED 3,000,000 for breaching data of financial, commercial or economic establishments. Article 45 punishes disclosure of confidential information obtained at work with at least six months and/or AED 200,000 to AED 1,000,000.
The second group covers fraud and forgery. Article 11 covers fake websites, emails and accounts (imprisonment and/or AED 50,000 to AED 200,000), Article 14 forging electronic documents, Article 15 card and e-payment fraud (AED 200,000 to AED 2,000,000) and Article 40 internet fraud (at least one year and/or AED 250,000 to AED 1,000,000).
The third group matters most to online marketing. Article 48 punishes misleading advertising and advertising, promoting, mediating or dealing in a virtual or digital currency without a licence with imprisonment and/or AED 20,000 to AED 500,000. Article 41 punishes unlicensed fundraising, including schemes using electronic currency, with up to five years and/or AED 250,000 to AED 1,000,000 plus mandatory refunds, and Article 46 unlicensed solicitation of donations. Article 52 punishes rumours and false news with at least one year and AED 100,000, rising to two years and AED 200,000 during crises. Article 53 fines a platform AED 300,000 to AED 1,000,000 for failing to remove illegal content or obey an order.
The fourth group protects reputation and privacy. Article 42 covers online extortion, Article 43 insult and defamation (imprisonment and/or AED 250,000 to AED 500,000) and Article 44 publishing private images, conversations or location data without consent (at least six months and/or AED 150,000 to AED 500,000). Articles 56 to 63 provide for forfeiture of devices and proceeds, half penalties for attempts, device bans and site blocking, and a fast grievance route against content-removal orders. Article 67 allows amicable settlement for listed offences, including Articles 48 and 52.
Anyone using information technology, a website, a network, a social media account or an electronic payment system in the UAE, including companies, their managers, marketers and employees, platform operators and site administrators; offences against UAE government systems and data wherever committed. DIFC and ADGM are not excluded, as this is federal criminal law.
| Article 2 | Unauthorised access to a website, system or network: imprisonment and/or AED 100,000 to AED 300,000, rising where damage is caused and to at least one year and AED 200,000 to AED 500,000 where data is sought for illegal purposes. |
| Article 6 | Misuse of personal data or information through information technology: at least six months' imprisonment and/or AED 20,000 to AED 100,000, aggravated for health, medical, bank account and e-payment data. |
| Article 13 | Unlawful collection, storage or processing of UAE residents' personal data through information technology: imprisonment and/or AED 50,000 to AED 500,000. |
| Article 15 | Fraud using bank cards or electronic payment instruments: imprisonment and/or AED 200,000 to AED 2,000,000. |
| Article 40 | Obtaining money, property or a service by fraudulent means online: at least one year and/or AED 250,000 to AED 1,000,000. |
| Article 41 | Unlicensed fundraising, including schemes using electronic currency: up to five years and/or AED 250,000 to AED 1,000,000, with the court ordering refunds. |
| Article 43 | Insulting or defaming another person online: imprisonment and/or AED 250,000 to AED 500,000, aggravated where the victim is a public official. |
| Article 44 | Recording or publishing private conversations, images or location data without consent, even if true, where intended to harm: at least six months and/or AED 150,000 to AED 500,000. |
| Article 48 | Misleading advertising and advertising, promoting, mediating or dealing in a virtual or digital currency without a licence: imprisonment and/or AED 20,000 to AED 500,000. |
| Article 52 | Publishing rumours or false news: at least one year and a fine of at least AED 100,000, rising to two years and AED 200,000 where it incites against the authorities or occurs during crises. |
| Article 53 | A platform or site that fails to remove illegal content or obey an order of the authorities faces a fine of AED 300,000 to AED 1,000,000. |
| Articles 73–74 | Repeals Federal Decree-Law No. 5 of 2012 on Combating Cybercrimes and brings the new law into force on 2 January 2022. |
All penalties are criminal. Ranges most relevant to business: unauthorised access AED 100,000 to AED 300,000 (Article 2); personal data misuse AED 20,000 to AED 100,000 (Article 6) and unlawful processing AED 50,000 to AED 500,000 (Article 13); e-payment fraud AED 200,000 to AED 2,000,000 (Article 15); internet fraud at least one year and AED 250,000 to AED 1,000,000 (Article 40); unlicensed fundraising up to five years and AED 250,000 to AED 1,000,000 (Article 41); defamation AED 250,000 to AED 500,000 (Article 43); unlicensed crypto promotion AED 20,000 to AED 500,000 (Article 48); false news at least one year and AED 100,000 (Article 52). Devices and proceeds are forfeited (Article 56) and attempts carry half the penalty (Article 57).
This law reaches our clients through their marketing. A free zone company that promotes a token, a trading signal service or a crypto investment product without a VARA, SCA or Central Bank licence is exposed under Article 48 regardless of where the audience sits, so we check the licensing position before a client launches a campaign. Article 41 is the reason we tell clients that crowdfunding or collecting investor money online needs a licence first. Articles 6 and 13 overlap with the Personal Data Protection Law and we treat them together when reviewing a client's data handling. The law also cuts the other way: when a client or one of its directors is defamed online, or an email account is compromised and used to redirect payments, Articles 11, 15, 40, 43 and 44 give the basis for a complaint to the police cybercrime unit, and we help assemble the evidence.
Personal Data Protection Law (PDPL)
The UAE's first federal personal data protection law. It sets lawful-basis, consent, purpose limitation, security, breach notification and data subject rights requirement…
Crimes and Penalties Law (Penal Code)
The UAE Penal Code replacing Federal Law No. 3 of 1987 from 2 January 2022; it defines the offences and penalties that touch business, including fraud, breach of trust an…
Electronic Transactions and Trust Services Law
Replaces the 2006 e-commerce law: electronic documents, signatures and seals cannot be denied legal effect merely because they are electronic; trust service providers mus…
Dubai Virtual Assets Law (VARA)
Establishes the Dubai Virtual Assets Regulatory Authority (VARA) as a public corporation affiliated with the Dubai World Trade Centre Authority and empowers it to license…
Federal Virtual Assets Regulation
The federal framework for virtual assets outside the financial free zones. It makes the Securities and Commodities Authority the federal licensing authority for virtual a…
Anti-Commercial Fraud Law
Replaces the 2016 anti-fraud law: criminalises misrepresenting the type, price, origin or characteristics of goods and services and dealing in counterfeit, spoilt or frau…
Whether you are establishing a new venture, restructuring an existing enterprise, or exploring residency pathways — we are here to advise.
Arrange a Consultation →