UAE Cybercrime Law: Offences, Penalties and Risks

UAE cybercrime law prohibits hacking, online fraud, misuse of payment cards, privacy violations, cyber blackmail, harmful false information, and using tools such as VPNs to commit or hide crimes. Individuals can face imprisonment, fines from AED 50,000 up to AED 2,000,000, deportation for non-citizens, and other consequences depending on the offence.

The main UAE cybercrime law and who it applies to

The main UAE law on cyber offences is Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes. It applies across the UAE, including Dubai, Abu Dhabi, Sharjah and the other emirates. It is a federal law, so the core offences and penalties are not different from emirate to emirate.

The law covers conduct using websites, apps, email, social media, payment systems, electronic devices, information systems and networks. It is not limited to skilled hackers. An ordinary person can commit an offence by forwarding a post, accessing an account without permission, recording a private conversation, creating a fake profile, or using someone else’s bank card details online.

The law is broad because many cyber offences happen through everyday tools. A phone, laptop, messaging app, cloud account or social media account can all be involved. The key issue is not only the device used, but what the person did with it and whether it caused harm, breached privacy, involved fraud, or threatened public order.

Individuals should also understand that cybercrime cases can move quickly. A complaint may be made to the police, a cybercrime unit or the public prosecution. Devices and accounts may be examined. Messages, screenshots, logs, email headers, bank records and platform data can become evidence. Deleting content after a complaint does not always solve the problem, because copies or technical records may still exist.

For non-citizens, conviction may also lead to deportation, in addition to imprisonment or fines. That can affect a person’s job, residency, family life and ability to return to the UAE.

Main prohibited acts and possible penalties

Federal Decree-Law No. 34 of 2021 covers many forms of online misconduct. Some offences require proof of intention, such as fraud or blackmail. Others may focus on the act itself, such as unauthorized access, recording, publishing, or sharing unlawful content. The penalty often becomes heavier if the act causes damage, affects public institutions, involves payment tools, or happens during a crisis.

The table below compares common offences that individuals should know about. The figures are based on the verified legal research for this article.

A person should not assume that a low-value act is harmless. For example, accessing an account “just to check,” forwarding a rumour “just in case,” or using saved card details “only once” can still create criminal exposure.

Hacking, unauthorized access and data misuse

Unauthorized access is one of the core areas of UAE cybercrime law. It covers access to a website, information system or network without permission. This can include a private email account, a social media account, a work system, a cloud drive, an online banking page, a customer database, or an internal business platform.

The basic penalty for unauthorized access is imprisonment and/or a fine between AED 100,000 and AED 300,000. The case becomes more serious if the access causes damage, data loss or operational disruption. In that situation, the penalty increases to at least 6 months in prison and/or a fine between AED 150,000 and AED 500,000.

If the access is done to steal data for illegal purposes, the penalty is higher again. The verified research states that this carries at least 1 year in prison and/or a fine between AED 200,000 and AED 500,000.

This matters in everyday situations. A former employee who logs into an old work account after leaving a job may face risk if they no longer have permission. A person who guesses a partner’s password and reads messages may commit an offence even if they do not publish anything. Someone who enters a system using a password shared for a limited purpose may be acting unlawfully if they go beyond that permission.

Damage is not limited to physical damage. Deleting records, changing passwords, locking users out, copying files, disrupting a website, or interfering with normal operations can make the case more serious. Even where no money is stolen, the law treats unauthorized access as a serious criminal matter.

Privacy, photos, recordings and private messages

Privacy offences are a major risk for individuals because they often involve normal phone use. Under the UAE cybercrime framework and related criminal rules, using technology to invade someone’s privacy can lead to imprisonment and heavy fines. Examples include eavesdropping, recording conversations, taking or sharing private images, and distributing private information without consent.

The verified penalty for using technology to invade someone’s privacy is up to 6 months in prison and a fine between AED 150,000 and AED 500,000. If a person alters or edits photos or recordings to harm someone, the penalty increases to at least 1 year in prison and a fine between AED 250,000 and AED 500,000.

This area catches many people by surprise. A person may think that recording a call is a good way to collect proof. But recording or sharing a private conversation without consent can create legal risk. The same applies to screenshots of private chats, photos taken in private settings, and videos filmed without permission.

Editing images or recordings is especially dangerous. This can include changing a photo to embarrass someone, combining images to suggest something false, adding audio to a video, or sharing an edited clip in a way that harms a person’s reputation. It does not need to be a professional deepfake to cause legal problems.

Consent is important. If someone sends a private photo or message to one person, that does not automatically mean it can be shared with others. Posting private content on a group chat, social media page, review site or public forum can increase the risk because publication expands the harm.

Fraud, impersonation, payment cards and VPN use

Online fraud is another key part of Federal Decree-Law No. 34 of 2021. Creating fake websites, emails or online accounts to impersonate others is punishable by a fine between AED 50,000 and AED 200,000, with possible imprisonment. If the impersonation causes harm, the penalty rises to at least 2 years in prison.

Impersonation can take many forms. A person might create a fake social media profile using another person’s name or photo. They might send emails that appear to come from a bank, delivery company, employer or government body. They might make a fake login page to collect passwords. Even if the fraud is unsuccessful, creating the tool or account can still create legal exposure.

Payment card crimes are treated very seriously. Forging, cloning or copying credit or debit cards, or using stolen cards to obtain funds or services, carries imprisonment and a fine between AED 200,000 and AED 2,000,000. This can include using card details found online, using someone else’s saved card without permission, or taking card information from a workplace system.

VPN use is often misunderstood. Ordinary VPN use is not itself an offence based on the verified research. The risk arises when a VPN or changed IP address is used to commit or conceal a crime. In that situation, the penalty can be temporary imprisonment and/or a fine between AED 500,000 and AED 2,000,000.

The practical point is simple. A tool that is lawful in normal use can become part of a cybercrime case if it is used to hide unlawful conduct. Using private browsing, a VPN, fake email, temporary phone number, or anonymous account will not protect a person if the underlying act is criminal.

False information, rumours, blackmail and public harm

The UAE takes false information and rumours seriously, especially where online content may cause public concern or harm the public interest. Publishing or sharing false news or misleading information can be punishable by up to 1 year in prison and a fine starting at AED 100,000. If the offence happens during a crisis, disaster or emergency, the penalty increases to up to 2 years in prison and a minimum fine of AED 200,000.

This does not only apply to the person who first creates the post. Sharing, reposting or forwarding false information can also be risky. A person who forwards a message to a large group, posts an unverified claim on social media, or translates and republishes a rumour may face questions about their role in spreading it.

The safest approach is not to publish or forward serious claims unless they come from an official or reliable source. This is especially important for information about public safety, health, crime, disasters, banks, markets, transport, schools, government action or emergencies. During a crisis, the legal risk is higher.

Cyber extortion and blackmail are also serious offences. Threatening to publish sensitive information or damage systems for ransom can lead to no less than 2 years in prison and a fine between AED 250,000 and AED 1,000,000. More severe penalties may apply if public institutions are targeted.

Blackmail is not limited to demanding money. It can include threats to release photos, expose private chats, damage a reputation, harm a business, lock an account, or disrupt a system unless the victim does something. Even a threat sent in anger can become evidence in a criminal case.

What to do next

If you think you may be affected by a cybercrime issue in the UAE, act quickly but carefully. Do not delete evidence, threaten the other person, or publish accusations online. A second mistake can make the situation worse.

Practical steps include:

• Save evidence safely. Keep screenshots, links, usernames, phone numbers, email addresses, payment records and dates. If possible, keep the original messages and files, not only screenshots.
• Do not edit evidence. Do not crop, alter or add comments to screenshots if you may need to use them in a complaint.
• Stop contact if there is blackmail. Do not argue with the blackmailer. Do not send more private material. If money is demanded, get legal advice before responding.
• Secure your accounts. Change passwords, enable two-factor authentication, log out of unknown sessions, and contact your bank if cards or accounts may be compromised.
• Report payment issues fast. If card details, bank transfers or online fraud are involved, contact the bank immediately and ask them to freeze or monitor the account.
• Be careful with posts and forwards. If the issue involves rumours, public claims or sensitive events, do not repost or comment until facts are verified.
• Get legal advice before filing or responding. Cybercrime complaints can lead to criminal investigations. A lawyer can help you explain facts clearly and avoid statements that create extra risk.
• For non-citizens, consider immigration risk. A conviction can affect residence status and may lead to deportation.

If you are accused, do not assume that “it was a joke,” “I deleted it,” or “I did not make money” is enough. Intention, harm, access rights, consent and technical records may all matter. If police or prosecution contact you, ask for a lawyer and prepare a clear timeline of what happened.

If you are a victim, report through the proper UAE channels and keep your complaint factual. Focus on who did what, when it happened, what platform was used, what evidence exists, and what harm resulted. Avoid public naming and shaming, because that can create a separate privacy or defamation issue.

This article is general information about UAE law, not legal advice. Laws change and every situation is different. For advice on your own case, speak to a licensed UAE lawyer.

Related reading

• Social Media Defamation in the UAE: Law and Penalties
• When Is a Contract Legally Binding in the UAE?
• How to Make a Valid Power of Attorney in the UAE

Have a question about your own case? Ask LocalLaw AI and get a clear answer with the law behind it. Start for free