UAE Cybercrime & Social Media Laws Guide
A practical guide to UAE rules on privacy, online images, defamation, rumours and false news, hacking, IP-address circumvention, personal data and cybercrime reporting.
Primary legal source: Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes, together with the UAE Personal Data Protection Law and applicable federal/local procedures.
What the UAE Cybercrime Law covers
Federal Decree-Law No. 34 of 2021 provides a federal framework for a broad range of technology-related offences, including hacking, unlawful access or acquisition of data, privacy violations, defamation and slander, false news and rumours, extortion, unlicensed fundraising, misleading digital advertising and other online offences.
The law should not be reduced to slogans such as “all public photography is illegal” or “VPNs are illegal”. The individual offence provisions contain specific elements, including intent, consent, the type of conduct and the purpose for which technology is used.
This page therefore distinguishes the statutory offence from general social-media etiquette and from separate laws such as the federal Personal Data Protection Law, copyright legislation and the Crimes and Penalties Law.
Key offences and current statutory penalties
The table is a high-level summary. Individual articles contain qualifying conditions and, in some cases, aggravated penalties.
| Offence | Article | Penalty | Important qualification |
|---|---|---|---|
| Invasion of privacy, including specified photography / electronic images | Article 44 | At least 6 months imprisonment and/or AED 150,000–500,000 | The offence requires the statutory privacy-invasive context, including the intent and absence of consent described by Article 44. |
| Online defamation and slander | Article 43 | Imprisonment and/or AED 250,000–500,000 | The law also contains an aggravating circumstance for offences against qualifying public officials or public-service persons. |
| False news and qualifying false / misleading rumours | Article 52 | At least 1 year imprisonment and at least AED 100,000 | Aggravated cases specified in Article 52 carry at least 2 years and at least AED 200,000. |
| Circumventing an IP address to commit or conceal a crime | Article 10 | Temporary imprisonment and/or AED 500,000–2,000,000 | Article 10 does not make ordinary VPN use itself an offence. |
| Misleading consumer advertising / certain unlicensed or unrecognised virtual-currency promotion | Article 48 | Imprisonment and/or AED 20,000–500,000 | This is not a generic five-year minimum penalty for all cryptocurrency or financial-trading activity. |
| Hacking a website, electronic information system, network or ITE | Article 2 | Basic offence: imprisonment and/or AED 100,000–300,000 | Higher penalties apply under Article 2 for specified damage, data acquisition or illegal-purpose situations. |
| Unauthorised acquisition or disclosure of personal electronic data | Article 6 | At least 6 months imprisonment and/or AED 20,000–100,000 | Aggravating circumstances apply to specified sensitive data including health, bank-account and e-payment information. |
International Money Transfer & FX Rates — Transparent Cross-Border Wire Rates
Bypass retail bank markups when transferring USD, GBP, EUR, CAD, AUD, or INR. Check today's real mid-market exchange rate instantly before initiating a transfer.
Privacy and photography: what Article 44 actually says
Article 44 concerns use of an information network, electronic information system or information-technology means with the intention of invading another person's privacy or the sanctity of private or family life without consent, outside cases authorised by law.
- Taking photographs of others in public or private places and specified electronic handling of those images is covered.
- Publishing news, photographs, scenes, comments, data or information, even when true, can be covered when done with the statutory intention of harming the person.
- Taking, transmitting or publishing photographs of injured, dead or accident victims without the required permission is expressly addressed.
- Tracking, monitoring, disclosing, transferring, copying or retaining third-party geographic-location data is also included.
Safe social-media practice
- Get consent before deliberately photographing, recording or publishing identifiable people where privacy is implicated.
- Do not publish or circulate accident-victim images without the required permission.
- Do not publish private communications, location data or other sensitive material simply because you obtained access to it.
- Verify potentially harmful claims before circulating them.
- Keep evidence when reporting harassment, extortion, hacking or financial scams instead of deleting the original records.
Fake news, rumours and misleading online content
Article 52 is more specific than the simplified phrase “fake news is illegal”. It covers false news or data, false, tendentious, misleading or erroneous rumours or reports, reports contrary to what was officially announced, and certain provocative propaganda when the statutory effects or risks specified in the Article are present.
At least 1 year + at least AED 100,000
Article 52 provides imprisonment for at least one year and a fine of not less than AED 100,000 for the conduct covered by paragraph 1.
At least 2 years + at least AED 200,000
The penalty increases in the aggravated situations specified by paragraph 2, including specified conduct against a state authority or institution and certain epidemics, crises, emergencies or disasters.
VPNs and Article 10
The legal provision commonly discussed in connection with VPNs is Article 10. Its wording targets circumvention of an IP address through another person's address or another means when done with the intention of committing a crime or preventing its detection.
Legitimate security use
Businesses commonly use VPN technology as part of secure network architecture. A lawful security use should not be confused with using a concealed or manipulated network address for the purpose described by Article 10.
A VPN does not make an otherwise unlawful activity lawful.
Hacking, unauthorised access and personal data
It is inaccurate to group Articles 2 to 6 into one generic “AED 200,000–1,500,000 hacking penalty”. The provisions distinguish ordinary hacking, government-system hacking, damage to systems, damage to government entities or critical facilities, and unauthorised handling of personal electronic data.
Article 2 — Hacking
Basic hacking carries imprisonment and/or AED 100,000 to AED 300,000. Higher penalties apply when specified damage, data consequences or illegal-purpose acquisition are involved.
Article 3 — Government systems
Hacking government information systems carries higher penalties, including temporary imprisonment and fines of AED 200,000 to AED 500,000 in the basic case, with much higher penalties for specified aggravated conduct.
Article 6 — Personal data
Unauthorised acquisition, possession, modification, destruction, disclosure, copying or dissemination of personal electronic data can attract at least six months and/or AED 20,000 to AED 100,000.
Employers and employee communications
Employee communications and workplace monitoring cannot safely be reduced to a rule that an employer can monitor anything merely because a contract mentions monitoring. Nor is the Cybercrime Law itself a universal ban on workplace monitoring.
Federal Decree by Law No. 45 of 2021 on the Protection of Personal Data generally prohibits processing personal data without consent, subject to statutory exceptions. Article 4 includes processing that is necessary for the controller or data subject to carry out legally established rights and obligations in employment, social security or social-protection law, to the extent permitted by those laws.
How to report cybercrime in the UAE
The UAE Government currently lists the following routes for reporting cybercrimes:
- Ministry of Interior eCrimes platform through the UAE Ministry of Interior application.
- Dubai Police eCrime for Dubai-related incidents.
- Abu Dhabi Police Aman for Abu Dhabi.
- My Safe Society through the federal Public Prosecution reporting application.
- Nearest police station where appropriate.
- 999 when immediate police assistance is required.
Preserve evidence
- Keep screenshots and original messages where possible.
- Record usernames, phone numbers, email addresses and account identifiers.
- Preserve transaction references for financial scams.
- Do not alter or delete the original evidence unnecessarily.
- Report promptly; the current government guidance does not state a general 72-hour deadline for cybercrime reporting.
Abu Dhabi Aman and Dubai reporting details
| Authority | Current route | Contact |
|---|---|---|
| Dubai Police | eCrime platform / Dubai Police cybercrime services | ecrime.ae |
| Abu Dhabi Police | Aman Service | 8002626 |
| UAE Police emergency | Immediate police assistance | 999 |
Frequently Asked Questions
VPN & Digital Security
VPN technology can be used for legitimate security and privacy purposes. Article 10 of the UAE Cybercrime Law targets IP-address circumvention used with the intention of committing or concealing a crime.
Official primary sources
The legal content above is based primarily on current official UAE legislation and UAE Government reporting guidance. The UAE Legislation portal describes itself as the unified and updated destination for federal legislation and amendments.
Legal-information notice: This guide explains current UAE laws and official reporting routes in general terms. A specific post, image, message, recording, workplace monitoring practice or cyber incident may involve additional legislation, facts and emirate-specific procedures. This page is not legal advice.