Question 1

What is the UAE Cybercrime Law and what does it cover?

Accepted Answer

Federal Decree-Law 34 of 2021 on Combatting Rumours and Cybercrimes (the Cybercrime Law) replaced the 2012 framework with significantly broader scope and tougher penalties. It criminalises a wide range of conduct including: unauthorised access to systems and data, identity theft, online fraud, electronic forgery, cyber-extortion, hacking and DDoS, online defamation and insults, dissemination of false information / rumours, hate speech, content harmful to public morals, electronic begging, online gambling, dissemination of pornographic material, child-protection offences, sale of prohibited goods online, illegal use of cryptocurrency for criminal purposes, and online activities undermining public order or state institutions. Penalties range from significant fines (AED 50,000 to AED 1,000,000+) to imprisonment (months to life depending on offence).

Question 2

Are cryptocurrency-related offences covered?

Accepted Answer

Yes — Article 48 of FDL 34/2021 criminalises unauthorised dealing in virtual currencies (without licensing under the relevant regulator — VARA, ADGM FSRA or DFSA), use of cryptocurrency for unlawful purposes (money laundering, terrorism financing, fraud, drug trade), and operation of unlicensed virtual-asset platforms. Penalties include imprisonment of 1+ years and fines of AED 500,000 to AED 1,000,000+. Crypto-related cybercrime files often involve complex on-chain forensics and require coordination between UAE authorities, foreign regulators (often U.S. DOJ, U.K. NCA, German BKA), and the licensed VARA/FSRA regulators. We routinely act in these matters in coordination with international forensic firms (Chainalysis, TRM Labs, Elliptic) and parallel-jurisdiction defence counsel.

Question 3

What about defamation and online speech?

Accepted Answer

FDL 34/2021 has expansive provisions on online defamation, insults to state institutions, dissemination of rumours and harm to social peace. Criminal complaints for online posts (including private WhatsApp messages and Instagram comments) are common — the threshold for prosecution is lower than in many Western jurisdictions, and intent is presumed in many circumstances. Practical reality: complaints are filed routinely; prosecution is selective; resolution often involves civil-criminal settlement plus content removal. Travel ban during the proceedings is common. We act for both complainants and defendants — early engagement before formal complaint filing often resolves matters at the prosecutor stage.

Question 4

How does the investigation process work?

Accepted Answer

Cybercrime investigations are typically led by the relevant emirate Public Prosecution's Cybercrime Unit (Dubai, Abu Dhabi, Sharjah and other emirates have dedicated units), with technical support from the Federal Public Prosecution and the police anti-cybercrime sections. Process: (i) complaint filing (online or in person at police station) → (ii) preliminary investigation, suspect summons or arrest → (iii) digital evidence seizure (devices, account access, on-chain analysis) → (iv) prosecutor decision on referral → (v) trial at competent court (typically the Court of First Instance with onward appeal). Bail is regulated and travel bans are common during proceedings. We routinely coordinate digital forensic counsel, ensure custody-of-evidence procedures, and challenge improperly obtained evidence.

Question 5

What about cross-border cybercrime?

Accepted Answer

Cross-border cybercrime involves complex jurisdiction questions — UAE assertion of jurisdiction is broad (any element of the offence within the UAE, including server location, victim presence, or money flow). Mutual Legal Assistance Treaties (MLATs) with major countries enable evidence sharing; ad-hoc cooperation is also common with U.S. DOJ, U.K. NCA, and EU agencies. Interpol Red Notices may be issued. For the defendant: simultaneous defence in the UAE and the home jurisdiction is often necessary; we coordinate with international defence firms (typically U.S., U.K., German, Indian) on parallel proceedings. Extradition treaties exist with many but not all countries — bilateral arrangements determine the path.

Question 6

Can a company be liable for cybercrime by employees?

Accepted Answer

Yes — corporate liability under FDL 34/2021 is significant. Articles 65-67 establish that companies can be held criminally liable where: (i) the offence was committed in the company's name or on its behalf; (ii) by an officer or representative; (iii) with corporate benefit. Penalties for corporate offenders include fines (typically 2x the natural-person penalty), suspension of activity, and dissolution. Practical compliance steps: documented cybersecurity training, incident-response procedures, clear acceptable-use policy, employee monitoring (subject to PDPL), and retention of legal counsel for any incident discovered. We routinely advise on the corporate-vs-individual liability allocation in incident response.

UAE Cybercrime & Digital Investigations — FDL 34/2021 defence and prosecution.

What we do for individuals and companies under cyber-investigation.

Defence

Corporate & investigations

Complainant-side

Cross-border

Frequently asked questions

Cyber-investigation, complaint or breach?