United Arab Emirates. Cybersecurity. Federal Decree-Law
Cybercrime LawFederal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes
In force
§1Summary
- Synopsis
Criminal law covering unauthorised access, misuse of electronic data and online invasion of privacy, including unlawful collection or processing of personal data and capturing or publishing images of people without consent. In the absence of PDPL penalties, it is the main source of sanctions for privacy breaches onshore.
- Key themes
- Unique features
Article 13 criminalises unlawful collection, storage or processing of personal data (detention and/or AED 50,000–500,000); Articles 44–45 cover online privacy invasion.
- SaaS relevance
Exposes SaaS operators and staff to criminal liability for unlawful data handling or security failings affecting UAE data.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Imprisonment and fines up to AED 5m depending on offence
§3Dates
- Key dates
- Adopted
- In force
- Gazette No. 712 (Supp.) 26 Sept 2021; amended once (page updated 2024-04-04)
§4Text and authority
- Text
- Authoritative text uaelegislation.gov.ae
- English text uaelegislation.gov.ae
- Authority
- Public Prosecution / Police (criminal enforcement)
§5Where it applies
- Domestic law of
- United Arab Emirates
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Article-level figures from DLA Piper summary.