Cybercrime UAE: What Counts and What You Face

Cybercrime UAE: What Counts and What You Face

If you're worried you've crossed a line online in the Emirates — or someone's threatening you with a complaint — the rules here are stricter than most people expect. Cybercrime UAE law covers everything from insulting someone in a WhatsApp group to unauthorised access of a company server. Fines are steep. Jail time is real.

Quick answer

Cybercrime in the UAE is governed primarily by Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, which replaced the older 2012 law. It criminalises hacking, online fraud, defamation on social media, spreading false information, invasion of privacy through photos or recordings, blackmail, and misuse of VPNs to commit a crime. Penalties range from AED 50,000 fines to millions of dirhams, plus imprisonment and, for non-citizens, deportation. Complaints go through the eCrime platform run by the police in each emirate, or via the Public Prosecution.

What actually counts as cybercrime in the UAE

The 2021 law is broad. Deliberately so.

Article 6 covers unauthorised access to websites or IT systems — classic hacking. Article 40 criminalises insulting others online, including via WhatsApp, Instagram, or X. Article 44 targets invasion of privacy through recordings, photos, or news, even if what you shared was true. That last part catches people off guard.

Financial fraud online sits under Articles 40-43, with penalties starting at AED 250,000 and climbing fast when bank data or electronic payment tools are involved ^[1]. Spreading rumours or "false news" that harms public order? Article 52. Using a VPN to commit or conceal a crime is separately punished under Article 10 — the VPN itself isn't illegal, but using one while committing another offence adds a layer.

Some offences most residents don't realise are criminal:

• Forwarding a private photo of someone without their consent
• Screenshotting a WhatsApp conversation and posting it publicly
• Writing a bad Google review that names an individual and calls them a fraud
• Sharing news of an accident, fire, or arrest before official channels do

Honestly, the "true but private" trap is the one that lands ordinary people in the eCrime office. Truth is not a defence to a privacy complaint.

Penalties you're actually looking at

Numbers, not vibes.

Unauthorised access to a system: minimum AED 50,000 fine, up to AED 200,000, plus imprisonment. If the system belongs to a government body or contains confidential data, the floor jumps to AED 200,000 and prison terms extend to 5-7 years ^[1].

Online defamation or insult: fine of AED 250,000 to AED 500,000, or imprisonment, or both. If the target is a public official acting in their role, penalties escalate.

Blackmail using electronic means: up to 2 years imprisonment and AED 500,000, doubled if the threat involves immoral acts ^[1].

Spreading false information that harms the state, its economy, or public health (relevant during COVID and after): fines from AED 100,000 up to AED 1 million, and imprisonment.

For non-citizens, most convictions carry deportation after the sentence is served. This is not discretionary in serious cases — it's built into the law.

Watch out: A civil defamation claim and a criminal cybercrime complaint are separate tracks. Someone can file both. Settling one doesn't automatically drop the other, though prosecutors will often consider a signed reconciliation.

How complaints get filed and what happens next

The first step is almost always the eCrime portal — Dubai Police, Abu Dhabi Police, and Sharjah Police each run one. You can also walk into any police station. Complaints require evidence: screenshots with visible URLs and timestamps, phone numbers, account handles, and ideally a notarised translation if the content isn't in Arabic.

Once filed, the police investigate and refer to the Public Prosecution. You may be summoned. If you're the accused, don't post about it, don't message the complainant, and don't delete anything — deletion of evidence is itself an offence under Article 21.

Travel bans are common while investigations run. If you're on a visit visa or planning to leave, assume you can't until it's resolved.

Reconciliation is possible for many personal offences — defamation, insult, invasion of privacy — under Article 42 of the Criminal Procedures Law. A written withdrawal from the complainant, sometimes with financial settlement, can end the case before it reaches trial. Prosecutors have discretion but usually accept it for first-time, non-aggravated matters.

For a broader look at how criminal complaints move through the system, see our criminal law overview.

If you're the victim: what to do in the first 48 hours

Move fast. Evidence disappears.

Screenshot everything with the URL bar and timestamp visible. Save the original device — don't factory reset a phone that has the messages. Note account handles, profile URLs, and any phone numbers or emails used. If money left your account, contact your bank the same day and request a freeze on the receiving account; UAE banks cooperate with police on active fraud reports.

File through eCrime online or visit the nearest police station. Bring Emirates ID, evidence on a USB or printed, and if it's a business matter, the trade licence. For fraud over AED 100,000 or complex hacking, ask specifically for referral to the cybercrime unit — the general complaints desk sometimes routes these too slowly.

If content is defamatory and hosted on a UAE server or platform, the Telecommunications and Digital Government Regulatory Authority (TDRA) can order removal alongside the criminal process ^[2].

The clock matters more than the paperwork here.

When you need a lawyer, not a search bar

Anything involving a summons, a travel ban, or a fine above AED 100,000 — get representation before your next appointment with the Prosecution. Cybercrime cases move quickly through the courts once filed, and the difference between a suspended sentence and deportation often comes down to how the first prosecutor interview is handled.

Free legal advice is available for citizens through the Ministry of Justice in some emirates. For everyone else, private counsel is the route.

Citations

^[1] Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, U.A.E. Official Gazette. https://uaelegislation.gov.ae

^[2] Telecommunications and Digital Government Regulatory Authority (TDRA), Content Regulation. https://tdra.gov.ae

^[3] Dubai Police eCrime Platform. https://www.ecrime.ae

Need this checked for your situation? Talk to a UAE-licensed lawyer →