Abstract
Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime (the 'Cybercrime Law') is one of the broadest cybercrime frameworks in the region. It criminalises a wide range of online conduct beyond traditional cybercrime. A common mistakes from the Noura Almaazmi team. The analysis draws on UAE federal legislation, applicable free-zone law (DIFC/ADGM where relevant), and current Cybercrime practice as observed across the Noura Almaazmi caseload. 3 core practitioner questions are examined. Key findings address: What online conduct is criminalised under UAE law, and Can I sue someone for defaming me on social media in the UAE, presented through the lens of common mistakes. The article equips UAE-based practitioners, in-house counsel, and international clients with UAE exposure with a decision-ready analytical framework grounded in current law.
Keywords: UAE law, cybercrime, uae cybercrime and online defamation, UAE legal practitioners, UAE courts 2026
Introduction
Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime (the 'Cybercrime Law') is one of the broadest cybercrime frameworks in the region. It criminalises a wide range of online conduct beyond traditional cybercrime. A common mistakes from the Noura Almaazmi team.
The errors below are the ones we see repeatedly across initial intakes — both from clients arriving with existing matters and from counterparties on the other side of disputes. Most are procedural rather than substantive, and most are avoidable with disciplined upfront work.
This is one of the recurring topics we field at the firm, and the notes below summarise the practitioner-level approach we take when partners are asked to advise on it.
Analysis
What online conduct is criminalised under UAE law?
UAE Cybercrime Law criminalises: (1) hacking and unauthorised access to systems; (2) publishing false information or rumours online; (3) online defamation and insult (including on social media); (4) cyberbullying and harassment; (5) publishing content that violates public order, morality, or religious values; (6) phishing and identity theft; and (7) operating illegal online gambling or pornographic content. Penalties range from fines of AED 20,000 to imprisonment of up to 10 years depending on the offence.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
Can I sue someone for defaming me on social media in the UAE?
Yes — both criminally and civilly. Filing a criminal complaint with the cybercrime unit of the local police triggers a formal investigation. A conviction carries fines and imprisonment. Separately, civil damages can be claimed before the civil courts under UAE tort law. The criminal conviction is strong evidence in the civil claim.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
What if the defamatory content is published outside the UAE?
UAE courts have jurisdiction over offences affecting UAE persons or interests even if the act was committed abroad. The police cybercrime unit can request takedowns via platform abuse reports and, in serious cases, through INTERPOL or bilateral law enforcement cooperation channels.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
Conclusion
This article has examined what online conduct is criminalised under uae law, can i sue someone for defaming me on social media in the uae within the framework of UAE cybercrime and online defamation — criminal and civil liability in UAE practice. Effective navigation of these issues depends not on any single legal argument, but on the quality of upfront procedural decisions, evidentiary discipline, and a clear understanding of which UAE forum and governing law apply to each element of the matter.
The UAE legal landscape continues to evolve. Significant reform across commercial companies law, civil procedure, free-zone regulation, and personal status has reshaped practice since 2021. Readers are advised to verify the current state of any legislation or regulation cited here. This analysis reflects the law as at 02 November 2024.
For matter-specific advice, contact the Noura Almaazmi team. A qualified practitioner will assess your specific facts, confirm the applicable forum and governing law, and deliver a scoped engagement recommendation within one working day of intake.
References
- UAE Civil Transactions Law (Federal Law No. 5 of 1985)
- UAE Commercial Transactions Law (Federal Law No. 18 of 1993)
- Federal Decree-Law No. 42 of 2022 (UAE Civil Procedure Code)
Practical checklist
- Establish the procedural geometry up-front: which UAE forum has jurisdiction, what governing law applies, and what the limitation/notice clock looks like.
- Document the contemporaneous record — correspondence, notices, payment trails, registry searches — before substantive work starts. Evidentiary discipline pays compound returns.
- Map dependencies on third parties (regulators, counterparties, banks, registries) and lock in realistic lead-times for each.
- Identify the cross-border interface early. Pure-onshore matters are rarer than they look; most Cybercrime work has at least one foreign-domiciled party, foreign-law document or foreign-asset element.
- Stage the workstream in 30 / 60 / 90-day blocks with explicit decision points. Linear plans without decision points drift; gated plans deliver.
- Pre-position the enforcement strategy at the structuring or filing stage — not after judgement. The enforcement choices available are determined by the choices made up-front.
Advisory note
On cybercrime matters of this type, our default position is to compress the diagnostic phase and move quickly to a written position — typically within 5-10 working days of intake. The diagnostic captures the procedural geometry, the documentary record, the limitation calendar and the practical objectives of the client. From there, the engagement either proceeds on a fixed-fee scoped basis (where the path is clear) or under a more flexible arrangement (where significant unknowns remain — for example pending regulator correspondence or counterparty positioning that materially changes the workplan). Either way, the goal is to give the client a decision-quality view at the earliest practical moment, rather than running an open-ended discovery phase that can erode both budget and momentum.
Frequently asked questions
What online conduct is criminalised under UAE law?
UAE Cybercrime Law criminalises: (1) hacking and unauthorised access to systems; (2) publishing false information or rumours online; (3) online defamation and insult (including on social media); (4) cyberbullying and harassment; (5) publishing content that violates public order, morality, or religious values; (6) phishing and identity theft; and (7) operating illegal online gambling or pornographic content. Penalties range from fines of AED 20,000 to imprisonment of up to 10 years depending on the offence.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
Can I sue someone for defaming me on social media in the UAE?
Yes — both criminally and civilly. Filing a criminal complaint with the cybercrime unit of the local police triggers a formal investigation. A conviction carries fines and imprisonment. Separately, civil damages can be claimed before the civil courts under UAE tort law. The criminal conviction is strong evidence in the civil claim.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
What if the defamatory content is published outside the UAE?
UAE courts have jurisdiction over offences affecting UAE persons or interests even if the act was committed abroad. The police cybercrime unit can request takedowns via platform abuse reports and, in serious cases, through INTERPOL or bilateral law enforcement cooperation channels.
In practice, the answer above usually drives a follow-on question about timing, cost or downstream procedural steps. Our standard approach is to walk the client through the next 30 / 60 / 90 days of workflow, flagging where decisions need to be taken and where external dependencies (regulators, counterparties, court calendars) sit in the critical path. Cybercrime matters in particular reward early sequencing work — the procedural choices made in the first two weeks tend to shape the outcome more than any single substantive argument made later.
Where the matter sits at the intersection of UAE-onshore process and a free-zone or foreign element, we run a parallel workstream addressing the cross-border interface — service of process, governing-law election, choice of forum, treaty reciprocity, and (where relevant) sanctions or compliance overlays. Most of the procedural failures we see in this topic area trace back to one of those cross-border seams being underestimated at the structuring stage.
Related guides in the library
Published 02 November 2024. General information only — not legal advice. Contact us for matter-specific advice.