Amendments to UAE Cybercrimes Law – useful reminder of potential impact of wide ranging provisions


The issuance of Emiri Decree No. 2 of 2018 in August 2018 amends three provisions of Federal Decree Law No. 5 of 2012 (the “UAE Cybercrimes Law” or “Law”). Whilst the amendments are primarily focused at increasing the penalties in relation to terrorist acts, the change presents a good opportunity to revisit the Law and flag key provisions that all businesses and individuals operating in the UAE should be aware of.

This update provides an overview of the key provisions to be aware of and also summarises the recent amendments.  We will be focusing on the provisions relating to invasion of privacy, defamation and the use of Virtual Private Networks or “VPNs” in the UAE.

Key provisions

Whilst the majority of the provisions of the UAE Cybercrimes Law deal with the penalties for committing online acts which are more traditionally acknowledged as criminal, such as deliberating intercepting communications; using online platforms to extort individuals; inciting terrorism or unlawfully obtaining or distribute personal information, this Law also includes important provisions, which due to the cultural sensitivities of the region, go beyond the scope of those seen in other jurisdictions.

Invasion of privacy and social media: Under Article 21 of the Law, it is a criminal offence to use the internet or any information technology tool to invade the privacy of another person. Due to the wide scope of this provision, the mere act of taking a photograph of an individual, including saving such a photograph on a device, or transferring the photograph in any form is considered to be invasion of privacy and carries the penalty of imprisonment and/or a fine.

In the current age of social media where photographs are constantly being taken on personal devices and shared across multiple platforms it is easy to see how an individual or company could fall foul of the Law.

Defamation: under Article 20 it is an offence to insult or accuse another person of a matter of which he may be punished or held in contempt by others. This provision has been widely interpreted and examples include tweeting derogatory comments about former employees and sharing a video of an illegally parked car on social media. The takeaway message is to stay clear of uploading any content which identifies any wrongdoing of another individual. In the case of the parked car, criminal action was pursued against the individual that uploaded the video as the registration details of the car were shown in the video which was deemed sufficient to identify the owner of the vehicle. 

Use of VPNs in the UAE: there is a widely held misconception in the UAE that the use of Virtual Private Networks or “VPNs” is not permitted under the UAE Cybercrimes Law. This may be a result of arguably sensationalist news reports both local and internationally which give the impression that VPNs are banned under the UAE Cybercrimes Law. This is not in fact the case. Whilst the Law does include provisions setting out criminal penalties for the misuse of VPNs, the use of VPNs for legitimate purposes is permitted. The Telecommunications Regulatory Authority (“TRA”) has issued guidance on this point and, in particular, has confirmed that the use of VPNs by businesses to gain access to internal and virtual networks is permitted.

Summary of recent amendments to the UAE Cybercrime Law

For completeness, we have also briefly outlined the recent amendments to the Law which relate to Articles 26, 28 and 42 only.

The amendment to Article 26 increases the penalty for establishing, managing, running of a website, computer network or by any information technology means that promotes the interests of any form of organisation that engages in acts of terrorism to imprisonment for a term of between 10 to 25 years and a fine or between AED 2 and 4 million (approximately US$ 545,000 to 1.1 million).

The amendment to Article 28 creates an offence for any attacks made on a member of the UAE judicial courts system via any information technology means. Whilst Article 28 predominantly deals with online acts that intend to incite acts or publish information which may endanger national security or public order, this provision could well be widely interpreted to extend to criticism of UAE court judgments. Therefore, we recommend exercising caution when publishing any content online which includes commentary on such decisions.

Article 42 states that the court has jurisdiction to deport an individual that contravenes the provisions of the Law. The recent amendments add that this provision still stands but is subject to the provisions of the UAE Penal Code.


The provisions highlighted above are just a few examples of how everyday online actions, such as posting on social media that that would be considered normal practices elsewhere, have severe consequences that are punishable by imprisonment and/or significant fines in the UAE. It is therefore imperative that businesses provide sufficient training to all staff on the scope of the Law and set out clear guidelines for employees to follow to ensure compliance.