The UAE's Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes makes unauthorised access, password misuse, interception and unlawful data processing criminal offences with fines that reach AED 3 million or more, and it contains no express exemption for security testing. For security teams that means authorisation is the line between a penetration test and a crime, and the same law also reaches staff misuse of credentials, careless handling of personal data and the publication of altered images. In force since 2 January 2022, it replaced Federal Decree-Law No. 5 of 2012. This guide explains who and what is covered, the offences that matter to security work, penalties, what the law means for service accounts and AI agents, and how to set up authorisation and reporting so your team stays on the right side of it. It is for security leaders, testers, researchers and legal teams working on UAE systems. For a comparison across countries see the Computer Misuse and Anti-Hacking Laws Guide.
Confirm every obligation, figure and penalty on this page against the official text of the law before relying on it.
Key takeaways
- Authorisation is everything: the hacking offence in Article 2 turns on access without permission, and the official text contains no specific carve-out for security testing, so written, scoped authorisation is the tester's main protection.
- Sector targets raise penalties sharply: harming information systems of banking, media, health or scientific entities carries temporary imprisonment and AED 500,000 to 3 million (Article 4); government entities and critical facilities attract the same range under Article 5.
- Credentials are regulated directly: Article 9 criminalises unlawfully obtaining or using codes and passwords, and Article 10 covers using another person's IP address to commit or conceal a crime.
- Data handling can be a crime: Article 6 covers unlawful access to personal data, with aggravation for health, bank and e-payment data, and Article 13 covers unlawful collection or processing of personal data.
- Managers can be liable: under Article 58, the person responsible for the actual management of a legal person faces the same penalties where it is proven they knew of the offence and their failure in their duties contributed to it; the legal person is jointly liable for fines and compensation for offences committed by employees in its name and for its benefit.
Scope: who and what is covered
The Decree-Law has 74 articles. It was issued on 20 September 2021 and entered into force on 2 January 2022 (Article 74); Article 73 repealed Decree-Law No. 5 of 2012. It applies to conduct using information technology, networks and platforms, and its offences cover individuals, employees and organisations. Article 69 extends it to crimes committed outside the UAE where they involve systems of government entities, were prepared, planned, directed, supervised or financed in the UAE, affect the security or interests of the UAE or its nationals or residents, or where the offender is found in the UAE and not extradited.
| Who | Why it matters to them | Articles to know |
|---|---|---|
| Security teams and penetration testers | Testing without clear authorisation can meet the hacking and tools offences | 2, 3, 9, 16 |
| Independent security researchers | No express research safe harbour in the text | 2, 12, 16 |
| Privacy and data teams | Unlawful access to and processing of personal data is criminal | 6, 13, 44 |
| Banks, hospitals, media and research bodies | Attacks on these sectors carry aggravated penalties | 4, 8 |
| Government entities and critical facilities | Highest penalty ranges | 3, 5, 7 |
| Platform and website operators | Must comply with removal and blocking orders | 53, 62, 63 |
| Marketing and communications teams | Rumours, false news and image offences | 44, 52 |
The law sits beside the UAE's personal data protection law and the federal information assurance standards. See the UAE PDPL Guide and the UAE Information Assurance Standards Guide for those obligations.
Key obligations
The Decree-Law is mostly a list of prohibitions, so the obligations are what an organisation must do to avoid committing, enabling or suffering those offences.
Offences that matter for security work
| Article | Offence (summary) | Security practice it touches |
|---|---|---|
| 2 | Hacking: access to a website, information system or network without authorisation | Penetration testing, red teaming, bug hunting, staff accessing systems beyond role |
| 3 | Hacking government information systems | Testing for public sector clients |
| 4 | Harm to information systems, aggravated for banking, media, health and scientific entities or where a cyberattack is used | Denial of service testing, destructive test cases |
| 6 | Unlawful access to personal data; receiving or storing such data | Handling breach data, test data containing real records |
| 9 | Unlawfully obtaining or using codes and passwords | Credential harvesting in tests, password dumps, shared credentials |
| 10 | Using another's IP address or other means to commit or conceal a crime | Anonymisation infrastructure, spoofed sources |
| 11 | Fake websites, emails or accounts | Phishing simulations, impersonation pages |
| 12 | Interception of communications; disclosing intercepted data | Traffic capture, TLS inspection, wireless testing |
| 13 | Unlawful collection or processing of personal data | Logging, monitoring and analytics that collect personal data |
| 16 | Tools for committing or concealing crimes | Possession and distribution of offensive tooling outside authorised use |
What organisations should put in place
- Written authorisation for all testing: a signed engagement letter or internal approval naming systems, IP ranges, accounts, techniques, time windows and contacts. Because the text has no express testing exemption, scope documents are your evidence that access was authorised. The Security Research Legal Safe Harbours Guide covers how to word them.
- Phishing simulation approvals: fake sites, emails and accounts fall under Article 11. Obtain written approval from the organisation being simulated and keep pages internal or access-restricted.
- Interception policy: TLS inspection, packet capture and monitoring should rest on a documented policy, employee notice and legal review, given Article 12 and Article 13.
- Credential handling rules: forbid sharing passwords, using colleagues' accounts and storing credentials in documents. Article 9 makes misuse of codes and passwords an offence in its own right.
- A vulnerability disclosure route: give external researchers a clear, authorised way to report issues so they do not need to probe beyond it. See the Vulnerability Disclosure Policy Template.
- Removal and blocking order handling: website and platform operators need a process to act on orders under Articles 62 and 63, which allow a three-working-day grievance window before appeal.
Reporting when you are a victim
The government portal lists these channels: the Ministry of Interior's eCrimes platform in the MoI UAE app; Dubai Police's eCrime website; Abu Dhabi Police's Aman service; the federal Public Prosecution's My Safe Society app; any police station; and 999 for emergencies. Preserve logs and evidence before reporting, and route personal data breaches through your data protection process as well.
Timeline and current status
| Date | Event |
|---|---|
| 2012 | Federal Decree-Law No. 5 of 2012 on Combating Cybercrimes |
| 20 September 2021 | Federal Decree-Law No. 34 of 2021 issued |
| 2 January 2022 | Decree-Law 34 of 2021 enters into force; the 2012 law is repealed |
As of November 2026, the official legislation portal and the government information portal show Decree-Law 34 of 2021 without listed amendments in the pages we checked. Confirm on uaelegislation.gov.ae before relying on a specific penalty, because federal decree-laws can be amended by later decree.
Enforcement and penalties
Offences are prosecuted by the Public Prosecution and tried in the criminal courts. Penalties below are from the official English text; "temporary imprisonment" is a defined term in UAE criminal law and is more serious than "imprisonment".
| Article | Offence | Penalty (official text) |
|---|---|---|
| 2 | Hacking | Imprisonment and/or AED 100,000 to 300,000; at least 6 months and/or AED 150,000 to 500,000 if damage or data loss results; at least 1 year and/or AED 200,000 to 500,000 if done to acquire data for illegal purposes |
| 3 | Hacking government systems | Temporary imprisonment and AED 200,000 to 500,000, rising to at least 7 years and AED 250,000 to 1.5 million for acquiring government data |
| 4 | Harm to information systems | At least 1 year and/or AED 500,000 to 3 million; temporary imprisonment for banking, media, health or scientific targets |
| 5 | Government entity or critical facility | Temporary imprisonment and AED 500,000 to 3 million |
| 6 | Personal data | At least 6 months and/or AED 20,000 to 100,000; aggravated for health, bank or e-payment data |
| 8 | Data of financial, commercial or economic establishments | At least 5 years and AED 500,000 to 3 million |
| 9 | Codes and passwords | Imprisonment and/or AED 50,000 to 100,000; at least 6 months and/or AED 300,000 to 500,000 if used to commit a crime |
| 12 | Interception | Imprisonment and/or AED 150,000 to 500,000; disclosure carries at least 1 year and a fine up to AED 1 million |
| 13 | Unlawful collection or processing of personal data | Imprisonment and/or AED 50,000 to 500,000 |
| 16 | Tools for crime or concealment | At least 2 years and/or AED 200,000 to 500,000 |
| 53 | Failure to remove illegal content or comply with orders | AED 300,000 to 1 million |
Article 56 provides for forfeiture of devices, programs and data used in an offence, and Article 59 allows measures such as electronic monitoring, bans on network use and site closure or blocking. Article 60 lists aggravating circumstances, including offences committed in the course of a job. Article 61 allows reduction or exemption for offenders who provide information leading to detection or arrest.
What it means for AI agents and non-human identities
The law does not mention AI agents or service accounts, but its offences attach to access, credentials and data, which is exactly what machine identities hold.
- Authorisation for automated access: an AI agent or script that reaches systems outside its approved scope is still accessing without authorisation, and the people who deployed it carry the risk. Define each agent's allowed systems and actions in writing and enforce them with least-privilege credentials. See the Agent Identity and Access Guide.
- Shared and borrowed credentials: Article 9 makes unlawful use of codes and passwords an offence. Service account passwords copied into scripts and reused across teams blur who used them. Issue each workload its own credential and record its owner. The Service Account Security Guide covers the patterns.
- Agents that collect personal data: agents that browse, scrape or summarise data can collect personal data. Article 13 makes unlawful collection or processing an offence, so data scope belongs in the agent's design review.
- Testing AI systems: prompt injection and agent abuse testing against third-party AI services is still testing someone else's system. Get the provider's written permission or use its published testing terms.
- Evidence: keep logs that tie every machine identity action to an owner and approval, so you can show authorisation if an action is questioned. See the Audit Readiness for AI Agents and NHIs guide.
Compliance steps
- Map exposure: list the activities your organisation runs that touch the offences above: testing, monitoring, phishing simulation, data analytics, AI agents, content publishing.
- Standardise authorisation: adopt a testing authorisation template with scope, techniques, data handling, stop conditions and named contacts, signed by someone with authority over the target systems. For third-party systems, obtain the owner's signature, not just your client's.
- Restrict tooling: keep offensive tools in controlled environments with access logging, and remove them at engagement end, given Article 16.
- Review monitoring: confirm TLS inspection, data loss prevention and user monitoring rest on written policy, notice and legal review.
- Govern credentials: ban password sharing, issue per-workload credentials, store secrets in a vault and rotate on staff and supplier exit.
- Prepare to report: document which police channel applies in each emirate you operate in and how evidence will be preserved.
- Train staff: cover hacking, credential, privacy and content offences in awareness training, especially for IT administrators, marketing and social media teams.
Framework mapping
| Decree-Law exposure | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Know the legal limits | GV.OC-03 | PM-9 |
| Authorised testing only | ID.RA-01 | CA-8, RA-5 |
| Credential control (Article 9) | PR.AA-01, PR.AA-05 | IA-2, IA-5, AC-6 |
| Lawful monitoring (Articles 12, 13) | DE.CM-01 | AU-12, PT-2 |
| Staff awareness | PR.AT-01 | AT-2 |
| Report and preserve evidence | RS.CO-02 | IR-4, IR-6 |
Measuring it
- Tests with signed authorisation on file: target 100% before any activity starts.
- Shared credentials remaining: count of passwords or keys used by more than one person or workload.
- Machine identities with owner and scope: percentage of service accounts and agents.
- Monitoring controls with legal review: percentage of interception and monitoring tools with a documented basis.
- Staff trained on the Decree-Law: percentage of IT, security and communications staff in the last year.
Common failure patterns
- Verbal scope: a test agreed by email thread or call, with no signed scope, leaves the tester without evidence of authorisation.
- Testing the cloud provider by accident: scanning shared infrastructure or a SaaS tenant beyond what the client controls, without the provider's permission.
- Real data in test environments: copying production personal data into labs or reports can meet Articles 6 and 13.
- Researchers going beyond proof: downloading records to prove a vulnerability rather than stopping at the minimum evidence.
- Agents with broad tokens: an agent given an administrator token can reach systems no one approved, and the deploying team owns the consequences.
Practitioner checklist
- Use a signed testing authorisation for every engagement, internal or external.
- Obtain third-party owners' permission before testing hosted or shared systems.
- Approve phishing simulations in writing and keep infrastructure restricted.
- Base interception and monitoring on written policy, notice and legal review.
- Ban password sharing; issue per-person and per-workload credentials from a vault.
- Define each AI agent's allowed systems, actions and data scope.
- Keep test data synthetic or masked.
- Publish a vulnerability disclosure route for researchers.
- Record the reporting channel for each emirate and the evidence preservation steps.
- Check uaelegislation.gov.ae for amendments before quoting penalties.
Standards and references
- UAE Legislation: Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes (official text)
- UAE Government portal: Law on combatting rumours and cybercrimes
- UAE Government portal: Report cybercrimes online
- Clyde and Co: UAE updates cybercrime law
- Digital Policy Alert: Federal Decree-Law No. 34 of 2021 enters into force
- Chambers and Partners: UAE's new federal law on countering rumors and cybercrimes, key amendments
Related NHI Mgmt Group resources: Computer Misuse and Anti-Hacking Laws Guide · UAE PDPL Guide · Security Research Legal Safe Harbours Guide · Bug Bounty and Vulnerability Disclosure Guide. This guide summarises UAE Federal Decree-Law No. 34 of 2021 as published at the date above and is not legal advice.