The UAE cybercrime law: Federal Decree-Law No. 34 of 2021
The Emirati cybercrime law reaches conduct that in most common-law jurisdictions would be a private dispute or no dispute at all, and it reaches some conduct committed outside the country entirely.
Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes came into force on 2 January 2022 and repealed the 2012 law it replaced. It is the central instrument for online harm in the United Arab Emirates, and its scope is considerably wider than a visitor from a common-law jurisdiction expects.
The most important structural point is this: in the UAE, a great deal of what would elsewhere be a civil dispute is a criminal offence. Posting an insult, publishing someone’s photograph without their consent, or circulating an unverified claim are not merely actionable — they are prosecutable, and the sanction is measured in imprisonment and six-figure dirham fines.
The offences that matter most
The following are the provisions most frequently engaged in online harm matters. Fines are in UAE dirhams and, where a range is given, are set by the article itself.
Article 2 — unauthorised access. Imprisonment and/or a fine of AED 100,000 to 300,000; AED 150,000 to 500,000 where damage, deletion or disruption results; and, where the access is committed to acquire data or information for an illegal purpose, imprisonment of at least one year and/or a fine of AED 200,000 to 500,000.
Article 4 — harming, destroying or disrupting a website or information system. Minimum one year and/or AED 500,000 to 3,000,000, with enhanced penalties where banking, media, health or scientific entities are affected.
Article 6 — infringement of personal data. Unauthorised acquisition or dissemination of personal data by electronic means. Minimum six months and/or AED 20,000 to 100,000, aggravated for medical, financial and health data. This is a live and enforceable criminal route for data misuse, and in current conditions it is the more consequential exposure in the UAE than the administrative data protection regime.
Article 11 — impersonation. Creating a fake website, account or email falsely attributed to a natural or legal person. Imprisonment and/or a fine of no less than AED 50,000. Where the fake is used in a matter offensive to the person affected, the penalty is imprisonment for at least two years — a floor, not a ceiling, and a point frequently reported the wrong way round. Penalties are substantially heavier again where the entity impersonated is a government body.
Article 40 — electronic fraud. Minimum one year and/or AED 250,000 to 1,000,000.
Article 42 — cyber extortion, blackmail and threats. Up to two years and/or AED 250,000 to 500,000, rising to temporary imprisonment of up to ten years where the threat is to commit a crime or to impute a dishonourable act.
Article 43 — online insult and defamation. Imputing a fact exposing a person to punishment or contempt, by electronic means. Imprisonment and/or AED 250,000 to 500,000, aggravated where the victim is a public servant acting in the course of duty.
Article 44 — invasion of privacy. Eavesdropping, recording, photographing or publishing images without consent, including publishing photographs of casualties or the injured. Minimum six months and/or AED 150,000 to 500,000; where content has been altered or manipulated, minimum one year and/or AED 250,000 to 500,000. This provision does the work that would elsewhere be done by privacy or image-rights claims, and it is the natural home for deepfake and edited-image matters.
Article 52 — false news and rumours. Publishing false news likely to incite or provoke public opinion. Minimum one year and a minimum fine of AED 100,000; minimum two years and a minimum fine of AED 200,000 where directed at state authorities or published during a crisis.
Article 54 — electronic bots. Up to two years and/or AED 100,000 to 1,000,000.
Compare the Article 43 range with the equivalent civil exposure in a common-law jurisdiction and the shift in incentives becomes obvious. In the UAE, the threat of a criminal complaint carries weight that a letter before action does not.
Extraterritorial reach — and its actual limits
Article 69 extends the law to acts committed outside the UAE, but not at large. It applies to conduct abroad in four enumerated cases:
- the crime involves an information system, network, website or IT means belonging to a government entity;
- the crime was prepared, planned, directed, supervised or financed inside the UAE;
- the crime affects the security of the UAE or any of its interests, or harms any of its nationals or residents; or
- the offender is found in the UAE after the crime and is not extradited.
The third limb is the one that matters for online harm, and it is wide. Content published abroad that harms a UAE national or resident can fall within it. But it is a gateway that has to be established, not an automatic consequence of the content being readable in the UAE. Commentary that says an offence is complete wherever content is accessible states a broader principle than the article supports, and neither a complainant nor a publisher should plan on it.
For a Kenyan business or individual with UAE connections — customers, staff, investors, travel — this is not academic in either direction. There is real exposure to Emirati criminal process over content posted elsewhere, and there is a real route where the person harming a UAE-resident client is abroad. In both cases the gateway should be identified before anything is filed.
What the law lets a court do
Article 59 is the generally available removal power: on conviction, the court may order electronic supervision and the partial or total closure or blocking of the offending site. It applies across the law’s offences, and it is the route to a judicial takedown in an ordinary defamation or image-publication matter.
Articles 62 and 66 are narrower than they first appear, and the limit matters. Article 62 (correction and blocking writs) and Article 66 (the Attorney-General’s blocking power) are both expressed to operate in respect of the offences listed in Article 71. That list does not include Article 43 (online insult and defamation) or Article 44 (privacy and images). For the ordinary victim of online defamation or an unauthorised photograph, neither provision is available. Two further points follow: Article 66 is a power to order a site blocked, not a power to compel disclosure of who is behind an account; and the administrative blocking regime operated by the telecommunications regulator with the licensed internet providers is a separate track from either.
Article 65 confers probative force on digital evidence — a point of real practical value, and a contrast with jurisdictions where the admissibility of electronic records is a recurring battleground.
On identifying an anonymous account, there is no general pre-action disclosure procedure onshore. In practice the route is the criminal complaint itself, and the investigative work the police and public prosecution then carry out. That is a description of practice rather than of a specific statutory disclosure power, and it should be presented to a client as such.
Article 56 provides for forfeiture of devices and funds, Article 57 subjects an attempted misdemeanour under the law to half the prescribed penalty, and Article 58 attaches liability to the person in actual management of a legal person.
Deportation — a correction worth making
It is very widely stated that a cybercrime conviction in the UAE carries deportation. As a description of this law, that is wrong.
Federal Decree-Law No. 34 of 2021 contains no deportation provision. Deportation operates through Article 126 of the Penal Code, Federal Decree-Law No. 31 of 2021, under which a foreigner sentenced to a custodial penalty in a felony faces mandatory deportation, while in a misdemeanour the court may order deportation as a matter of discretion. There is an exception for a foreigner who is the spouse or a first-degree relative of a UAE national, save for offences against state security.
Most online-harm offences under Articles 43, 44 and 52 are misdemeanours. Deportation in those cases is therefore discretionary, not automatic. The flat statement that it follows conviction is materially misleading, and it matters a great deal to a person deciding whether to contest or settle.
Older commentary describing deportation as automatic reflects an earlier position. It should not be relied on, and where the point is decisive the current text of Article 126 should be checked directly.
Settlement
Articles 67 and 68 provide for amicable settlement, and Article 68 is more useful to the readers of this article than it is usually reported to be. It names Articles 43 and 44 expressly — online insult and defamation, and the publication of images without consent — alongside Articles 2(1), 6(1), 9(1), 11(1), 42(1) and 45, and it permits settlement irrespective of the status of the criminal case, provided the judgment has not become final. Article 61 provides an exemption for cooperation.
Combined with the complaint-based nature of the defamation and insult offences — where the complainant may withdraw at any time before final judgment, terminating the action — this makes early, structured engagement in a UAE matter unusually productive. A great many of these matters are capable of resolution without a conviction, on terms that include removal and an apology, and that is frequently a better outcome for a complainant than a criminal record for the other side.
How a complaint is made
Reporting channels operate at federal and emirate level. The Ministry of Interior operates an eCrimes platform through its application; Dubai Police operates its own eCrime platform; Abu Dhabi Police operates the Aman service; and the Federal Public Prosecution operates a reporting application. Complaints may also be made at any police station.
The onward process runs from the police station to the Public Prosecution — ordinarily within 48 hours — and then, if charged, to the Misdemeanour Court sitting as a court of first instance, with appeal and cassation above it. A victim may join as a civil claimant within the criminal case or bring a separate civil action.
What this law does not give you
Two limits are worth stating plainly.
There is no general onshore route to an injunction restraining publication in the common-law sense. The onshore interim toolkit is oriented towards asset preservation — precautionary attachment under the Civil Procedure Law — rather than restraint of speech. The realistic routes to removal are a court order following conviction, administrative blocking, or platform-level removal. A client should not be told that a takedown injunction can be obtained onshore.
The free-zone courts do not help here. The DIFC and ADGM Courts are common-law, English-language civil courts of limited, connection- or consent-based jurisdiction. They have no criminal jurisdiction over defamation and will not hear a general online-harm claim between parties with no free-zone nexus and no opt-in agreement. Their value in this field lies elsewhere — principally in disclosure relief against entities licensed within them.
Working across Kenya and the UAE
Two points for cross-border matters. An extradition arrangement between Kenya and the UAE has been implemented in Kenyan law by a 2025 legal notice applying the Extradition (Contiguous and Foreign Countries) Act to the UAE; whether any particular offence falls within its scope requires checking the instrument rather than assuming. Separately, we have not been able to verify any mutual legal assistance treaty or civil judgment enforcement treaty between the two states, and enforcement of a Kenyan judgment in the UAE would fall to be considered under the general statutory conditions, which include a public-order gate that is a real obstacle for defamation awards.
It describes the law as understood at the date of review and does not take account of your circumstances. Law and platform practice both change. Reading it does not create an advocate–client relationship with JM Sons Advocates. Before acting or deciding not to act, take advice on your own facts.