Civil Law and UAE — Simple Cyber Law Issues List

1. Introduction

UAE cyber law is not contained in one single statute. It is a combination of criminal, civil, data-protection, electronic-transactions, evidence, consumer, intellectual-property and sector-specific rules.

The principal federal cybercrime legislation is Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, which came into force on 2 January 2022. The UAE Government describes it as covering misuse of information technology, electronic fraud, privacy, hacking, government information systems and other online offences. (U.AE)

Other important legislation includes:

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services

Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions

Federal Decree-Law No. 42 of 2022 on Civil Procedure

Federal Law No. 15 of 2020 on Consumer Protection

applicable intellectual-property and sector-specific legislation. (U.AE)

A simple formula is:

Cyber Conduct → Digital Evidence → Legal Responsibility → Damage/Offence → Remedy

2. Simple UAE Cyber Law Issues List

The major issues can be remembered as follows:

Unauthorized access / hacking

Cyber fraud

Identity theft

Phishing

Password and credential misuse

Data theft

Personal-data protection

Privacy violations

Unlawful disclosure of information

Cyber harassment and threats

Online defamation

Electronic blackmail

Fake accounts and impersonation

Malware and ransomware

Website and system attacks

Government-system attacks

Electronic payment fraud

Cryptocurrency and virtual-asset disputes

Electronic contracts

WhatsApp and email evidence

Digital signatures

Electronic authentication

AI-generated evidence

Blockchain evidence

Cloud-data disputes

Cybersecurity duties

Data-breach liability

Consumer protection in e-commerce

Intellectual-property infringement online

Jurisdiction in cross-border cyber disputes

Criminal liability versus civil liability

Compensation for cyber damage

Expert and forensic evidence

Preservation of electronic evidence

Enforcement of judgments involving digital assets.

3. Unauthorized Access and Hacking

One of the basic cyber-law issues is unauthorized access to computer systems, networks or electronic information.

Examples:

entering another person's email without permission;

accessing a company's server;

bypassing authentication;

accessing a cloud account;

obtaining confidential files without authority.

The Cybercrime Law establishes offences relating to misuse and attacks on information systems and electronic data. (U.AE)

Simple legal question

Did the person access or interfere with the system without lawful authority?

4. Cyber Fraud

Cyber fraud occurs when technology is used to deceive a person for unlawful financial or other gain.

Examples:

fake online investment platforms;

phishing emails;

fraudulent payment instructions;

fake websites;

manipulated invoices;

fraudulent electronic transfers.

Cyber fraud can generate both:

Criminal consequences

under cybercrime and criminal legislation.

Civil consequences

including:

repayment;

restitution;

damages;

recovery of misappropriated assets.

5. Identity Theft and Impersonation

A person may unlawfully use another person's:

name;

identification information;

account;

photograph;

credentials;

electronic signature;

digital identity.

A fake social-media account can therefore create several legal issues simultaneously:

identity misuse + privacy + impersonation + reputation + potential fraud

6. Phishing

Phishing generally involves sending deceptive communications designed to obtain:

passwords;

bank details;

OTPs;

payment information;

identity information.

Example

A consumer receives an email appearing to come from a bank:

"Your account will be suspended. Click here and enter your password."

The website is actually controlled by a fraudster.

Potential legal issues include:

cyber fraud;

unauthorized access;

identity theft;

electronic evidence;

financial loss.

7. Personal Data Protection

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, provides a separate framework concerning personal-data processing.

Important concepts include:

lawful processing;

consent where applicable;

transparency;

data-security obligations;

rights of data subjects;

processing restrictions;

cross-border transfers;

data breaches.

The UAE Government expressly identifies the PDPL as one of the country's principal cyber-related laws. (U.AE)

Example

A company collects customer:

name;

phone number;

Emirates ID information;

location;

financial information.

It must consider whether the collection and processing are legally permitted and whether appropriate safeguards are in place.

8. Data Breach

A data breach occurs when protected information is:

accessed;

disclosed;

lost;

altered;

destroyed;

stolen;

without proper authority or protection.

A breach can potentially create:

regulatory + contractual + civil + criminal consequences

depending upon the facts.

Importantly:

A data breach does not automatically establish the amount of civil damages.

Actual legally recoverable loss must still be demonstrated where compensation is claimed.

9. Privacy Violations

Cyber law overlaps heavily with privacy law.

Examples include:

accessing private photographs;

reading another person's private messages;

publishing private information;

accessing another person's cloud account;

recording or distributing private communications unlawfully.

The legal analysis may involve both the Cybercrime Law and personal-data/privacy provisions.

10. Online Defamation

Digital platforms make reputation-related disputes more complicated.

Examples:

defamatory Instagram post;

false Google review;

false WhatsApp message;

defamatory TikTok video;

false allegation on X;

publication of damaging information in an online group.

Potential legal questions include:

Was the statement false?

Was it communicated to others?

Was it unlawful?

Was the publication attributable to the defendant?

What damage resulted?

Does the conduct fall within a specific cybercrime provision?

11. Electronic Blackmail

Electronic blackmail can involve threats such as:

"Pay me AED 50,000 or I will publish your private photographs."

The situation may involve several legal issues:

threat;

extortion;

privacy;

unlawful disclosure;

cybercrime;

financial loss.

The fact that the threat was communicated through WhatsApp, email or social media does not make it legally harmless.

12. Fake Accounts

Creating a fake account may create different legal consequences depending on its purpose.

Harmless parody

May raise different questions.

Impersonation

Potentially more serious.

Fraudulent account

Can involve financial deception.

Account used to damage reputation

May raise defamation/privacy issues.

Therefore:

The existence of a fake account is not the complete legal question; its purpose, content and conduct matter.

13. Malware and Ransomware

Malware may be used to:

destroy data;

encrypt files;

steal credentials;

spy on users;

disrupt systems.

Ransomware example

A company's files are encrypted.

The attacker demands:

AED 1 million for the decryption key.

Potential legal issues include:

unauthorized access;

interference with computer systems;

extortion;

data destruction;

business interruption;

financial damage.

The company may also have civil claims against responsible persons where identity and causation can be established.

14. Electronic Payment Fraud

Digital banking creates important cyber-law issues.

Examples:

unauthorized bank transfer;

stolen OTP;

compromised account;

fake payment instruction;

manipulation of payment information.

A court may have to determine:

Who authorized the transaction?

and:

Was the bank or service provider legally responsible for the loss?

This may involve cyber law, banking regulations, contract law and evidence law simultaneously.

15. Electronic Contracts

Electronic contracts are legally important because modern commercial transactions are often completed without paper.

Examples:

online purchases;

electronic subscriptions;

email agreements;

click-wrap contracts;

mobile-app contracts;

digitally signed agreements.

The UAE's Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services provides the statutory framework for electronic transactions and trust services. (U.AE)

16. WhatsApp as Evidence

A particularly important modern issue is whether WhatsApp messages can prove:

a contract;

an admission;

payment;

a promise;

a variation;

acknowledgment of debt.

Dubai Court of Cassation — Civil Cassation No. 468 of 2024

A reported decision concerned a loan agreement allegedly concluded through WhatsApp communications without a conventional signed contract.

The case has been cited as illustrating the legal significance that UAE courts can give to authenticated electronic communications, subject to the applicable electronic-transactions and evidence framework. (Ayshams Law Official Website)

Simple principle

Digital communication can have legal evidentiary significance if authenticity and attribution are established.

It does not mean that every screenshot is automatically conclusive.

17. Email Evidence

Email can be relevant evidence concerning:

negotiations;

contracts;

notices;

payment;

admissions;

termination;

technical instructions.

The important question is not simply:

"Is it an email?"

but:

Can the court reliably establish its origin, authenticity, integrity and relevance?

18. Digital Evidence

Electronic evidence may include:

WhatsApp messages;

emails;

CCTV footage;

server logs;

metadata;

GPS records;

transaction records;

cloud records;

photographs;

digital signatures;

blockchain records.

The Evidence Law of 2022 is central to civil and commercial disputes involving such material. The UAE's official cyber-law resources identify the electronic-transactions framework alongside the Cybercrime Law and Personal Data Protection Law. (U.AE)

19. Digital Evidence Must Be Reliable

A common mistake is:

"It is digital, therefore it is automatically true."

That is incorrect.

The court may need to examine:

who created the record;

who controlled the account;

whether the record was altered;

whether metadata supports authenticity;

whether the device was properly examined;

whether the chain of custody is reliable;

whether the evidence actually proves the alleged fact.

20. Case Law — Dubai Court of Cassation Civil Cassation No. 277 of 2009

This older Dubai Court of Cassation authority is frequently discussed in connection with the judicial treatment of electronic communications and evidence.

It is useful historically because it demonstrates that UAE courts were dealing with electronic communications as evidence well before the modern 2021–2022 digital legislation.

Importance

It supports the broader proposition that:

Electronic form does not by itself prevent evidence from having legal significance.

However, because it predates the current electronic-transactions and evidence legislation, it should be treated as a historical authority, not as a complete statement of current law. (Law Gratis)

21. Cryptocurrency and Virtual Assets

Cyber law increasingly overlaps with:

cryptocurrency;

blockchain;

digital wallets;

token transfers;

virtual assets;

smart contracts.

The legal issues include:

ownership;

possession/control;

fraud;

tracing;

unauthorized transfers;

contractual obligations;

jurisdiction;

enforcement.

The important point is:

A cryptocurrency dispute is not necessarily only a cybercrime dispute.

It can simultaneously be a civil, commercial, contractual, property or regulatory dispute.

22. Dubai Cassation Civil Cassation No. 486 of 2024

This decision has been identified in recent UAE legal commentary as involving cryptocurrency/electronic communications and civil evidentiary issues.

Its importance lies in demonstrating that disputes involving digital assets can require courts to apply ordinary civil and evidentiary principles to technologically complex transactions. (Law Gratis)

Exam point

Digital assets do not eliminate ordinary requirements of proof, ownership, causation and contractual obligation.

23. Blockchain Evidence

Blockchain records can demonstrate:

transaction history;

wallet movements;

timestamped entries;

smart-contract activity.

But:

Blockchain record ≠ automatic proof of real-world legal ownership.

The claimant may still need to establish:

who controlled the wallet;

what legal agreement existed;

why the transfer occurred;

whether the transfer was authorized;

whether the blockchain record has been correctly interpreted.

24. Smart Contracts

A smart contract may automatically execute instructions when predetermined conditions are met.

Example:

Payment is automatically transferred when a blockchain oracle confirms delivery.

Legal questions may include:

Was there a valid contract?

What is the governing law?

What happens if the code contains an error?

Is the oracle reliable?

Can a court order reversal?

Who is responsible for the coding error?

Thus:

Code execution does not eliminate contract law.

25. AI and Cyber Law

AI introduces new cyber-law issues:

AI-generated phishing;

deepfakes;

automated fraud;

AI-assisted hacking;

synthetic identities;

automated surveillance;

manipulation of digital evidence;

AI-generated contracts;

AI-generated defamatory content.

One important legal question is:

Who is legally responsible when an AI-enabled system causes harm?

Depending on the circumstances, responsibility could involve:

user;

developer;

company;

service provider;

data controller;

employee;

third-party vendor.

The answer depends upon applicable law and evidence rather than simply the fact that "AI" was involved.

26. Case Law — Dubai Court of Cassation No. 611 of 2025

This is a particularly useful modern technology-related authority.

The dispute involved alleged interference with computer systems and deletion/manipulation of electronic material. The Dubai Court of Cassation considered the relationship between a criminal finding and a subsequent civil damages claim.

The Court emphasised that establishing wrongdoing does not automatically establish the amount of civil damage. The claimant still has to prove the actual loss and its quantum through appropriate evidence. (Moores Rowland UAE)

Important principle

Cyber wrongdoing + proof of fault ≠ automatic proof of every claimed financial loss.

This is extremely important in cyber-damage claims.

27. Cybersecurity Duties

Businesses increasingly need appropriate cybersecurity arrangements.

Depending upon the sector and applicable legislation, relevant measures can include:

access controls;

authentication;

encryption;

security monitoring;

incident response;

backup systems;

employee training;

vendor management;

data classification;

breach response.

Dubai has also adopted specific digital-security legislation, including Law No. 15 of 2024 concerning the Dubai Electronic Security Centre. (Dubai Land Department)

28. Cybersecurity and Civil Liability

Suppose Company A stores customer information.

A hacker obtains the information because Company A failed to implement reasonable security measures.

A customer suffers proven loss.

The legal analysis could involve:

Duty → Security failure → Breach → Data breach → Causation → Damage → Compensation

But the existence of a cyberattack alone does not automatically establish civil liability.

The claimant must establish the applicable duty and the necessary causal connection.

29. Data Breach and Compensation

A person whose information is compromised may ask:

"Can I automatically claim compensation?"

Not necessarily.

A civil claim normally requires examination of:

legal duty;

unlawful conduct;

actual damage;

causal connection;

evidence;

applicable statutory provisions.

The amount of alleged damage must also be demonstrated.

This is consistent with the reasoning discussed in Dubai Cassation No. 611/2025 concerning technology-related damages. (Moores Rowland UAE)

30. Cybercrime and Civil Liability

These are different concepts.

Criminal case

Question:

Did the defendant commit a cybercrime?

Civil case

Question:

Did the defendant cause legally recoverable damage?

Example

A hacker unlawfully deletes a company's database.

The criminal case may concern:

unauthorized access / interference.

The civil claim may concern:

restoration costs;

lost business;

data-recovery expenses;

contractual losses;

other proven damage.

Therefore:

Criminal liability and civil liability can coexist but are not identical.

31. Electronic Consumer Disputes

Online consumers may face:

fake products;

fraudulent websites;

unauthorized subscriptions;

misleading advertisements;

payment fraud;

data misuse.

Consumer law can therefore overlap with cyber law.

Example

An online seller falsely advertises an expensive electronic device and takes payment without delivering it.

Possible legal areas:

Cybercrime + consumer protection + contract + civil liability

32. Intellectual Property Online

Cyber law also overlaps with intellectual property.

Examples:

software piracy;

illegal copying;

unauthorized distribution;

copyright infringement;

domain-name disputes;

unauthorized use of digital content.

The appropriate legal route may involve copyright, trademark, commercial or cybercrime legislation depending on the conduct.

33. Cloud Computing Disputes

Cloud disputes can concern:

unauthorized access;

deletion of data;

service interruption;

data location;

confidentiality;

cybersecurity;

cross-border transfer;

contractual liability.

Important contractual questions include:

Who owns the data?

Who controls the data?

Where is it stored?

What security obligations exist?

Who bears the risk of loss?

What happens after termination?

34. Employee Cyber Misconduct

Employees can create cyber risks by:

copying confidential data;

sending company information to personal accounts;

deleting files;

accessing systems after termination;

stealing customer information;

disclosing trade secrets.

A company may have:

employment claims;

contractual claims;

civil claims;

criminal complaints;

intellectual-property claims.

35. Case Law — Dubai Cassation Civil No. 353 of 2025

This authority has been discussed in connection with electronic communications, banking and accounting evidence.

Its broader significance is that electronic financial records and communications may form part of the evidentiary assessment in commercial disputes, but their weight depends upon authentication and the overall evidence. (Law Gratis)

Principle

Electronic financial evidence should be examined together with the surrounding contractual and accounting evidence.

36. Cross-Border Cybercrime

The internet does not respect national borders.

For example:

UAE victim → UAE bank → foreign server → foreign hacker → cryptocurrency wallet in another jurisdiction.

This raises:

jurisdiction;

evidence gathering;

extradition;

international cooperation;

asset tracing;

recognition and enforcement.

The applicable criminal and procedural rules can therefore become substantially more complicated.

37. DIFC and ADGM Cyber Disputes

A cyber dispute can also arise within:

DIFC;

ADGM.

The legal analysis must identify the relevant jurisdiction.

Important rule

A DIFC or ADGM judgment should not automatically be described as binding mainland UAE precedent.

For example, DIFC cases may apply DIFC legislation rather than mainland UAE federal law.

38. Gate Mena DMCC v Tabarak Investment Capital

This DIFC Court of Appeal authority is useful for understanding disputes involving Bitcoin and digital assets.

It demonstrates how courts may have to consider whether digital assets fit within traditional concepts of property and contractual rights.

Importance

It is useful for:

cryptocurrency;

digital property;

asset tracing;

enforcement.

But it is a DIFC authority, not a binding mainland UAE Court of Cassation precedent. (Law Gratis)

39. Seven Important Case Laws — Quick Table

The first six are Dubai judicial authorities; Gate Mena is a DIFC Court of Appeal authority and should be treated separately. The modern UAE case law directly addressing highly technical cyber issues remains comparatively limited, so some cases operate primarily as electronic-evidence or digital-asset authorities, rather than as direct interpretations of Federal Decree-Law No. 34 of 2021. (Law Gratis)

40. Simple Cyber Law Case Study

Facts

A company's former employee:

accesses the company's server after termination;

downloads customer data;

deletes certain files;

sends the data to a competitor;

the company loses customers.

Possible legal issues

Issue 1 — Unauthorized access

Was access legally authorised?

Issue 2 — Data protection

Was personal data unlawfully obtained or disclosed?

Issue 3 — Confidentiality

Did the employee breach contractual confidentiality obligations?

Issue 4 — Cybercrime

Does the conduct fall within the Cybercrime Law?

Issue 5 — Evidence

Can server logs and forensic reports establish the conduct?

Issue 6 — Damage

Can the company prove its financial losses?

Issue 7 — Civil liability

Can the company establish causation between the conduct and the loss?

This demonstrates why cyber disputes frequently involve several laws simultaneously.

41. Cyber Law Evidence Checklist

Before bringing a cyber-related civil claim, preserve:

Digital evidence

☐ Emails
☐ WhatsApp messages
☐ Screenshots
☐ Server logs
☐ Access logs
☐ IP information
☐ Metadata
☐ CCTV
☐ Cloud records
☐ Payment records
☐ Blockchain transactions

Supporting evidence

☐ Contracts
☐ Confidentiality agreements
☐ Employment records
☐ Invoices
☐ Accounting statements
☐ Expert reports
☐ Incident reports

Important rule

Do not rely exclusively on a screenshot when stronger underlying evidence is available.

42. Simple Cyber Law Issue-Spotting Formula

For examination purposes, use:

A-E-D-C-R

A — Access

Was there unauthorized access or interference?

E — Electronic evidence

Can the conduct be proved digitally?

D — Data

Was personal, confidential or commercially sensitive data involved?

C — Causation

Did the conduct cause the claimed harm?

R — Remedy

Is the appropriate response criminal prosecution, regulatory action, civil damages, injunction, restitution or another remedy?

43. Cyber Law and Civil Law Formula

A simple civil-law approach is:

Cyber Wrong → Duty → Breach → Causation → Damage → Evidence → Remedy

For example:

Unauthorized access
↓
Legal/contractual duty breached
↓
Customer data stolen
↓
Proven financial loss
↓
Forensic and financial evidence
↓
Civil compensation

44. Final Revision Table

45. Conclusion

UAE cyber law is best understood as a multi-layered legal system rather than a single "hacking law." Federal Decree-Law No. 34 of 2021 is the principal cybercrime statute, while the Personal Data Protection Law, Electronic Transactions Law, Evidence Law, Consumer Protection Law and civil-liability rules address different parts of the digital relationship. (U.AE)

The most important practical principle is:

Digital conduct must be legally classified, digitally proved and connected to the appropriate remedy.

For an exam, remember:

HACKING → DATA → PRIVACY → FRAUD → EVIDENCE → CONTRACT → LIABILITY → DAMAGE → REMEDY

And for a cyber-related civil claim:

Wrongful Digital Conduct + Proof + Causation + Actual Damage = Potential Civil Remedy

Important 2026 note: the UAE's current cyber framework remains anchored in the 2021 Cybercrime Law and related digital legislation; the separate 2025 Civil Transactions Law, effective 1 June 2026, is relevant where a cyber incident also produces a civil-liability, contractual, damages or compensation dispute. (UAE Legislation)