Ask a Lawyer

Yes, screenshots are commonly used to support cybercrime and defamation complaints in the UAE, and in many cases they are the starting point of an investigation. Because offences under Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes take place online, the police and Public Prosecution rely on digital evidence such as screenshots of posts and messages, links, usernames, phone numbers and timestamps. To make your evidence as strong as possible, capture the full context rather than cropped fragments: show the sender's account, the date and time, and the surrounding conversation, and keep the original messages on your device rather than deleting them. Authorities may also verify the material through their own technical means and platform cooperation, so preserving the original source matters. While screenshots are persuasive, how much weight they carry is ultimately decided by the investigators and the court alongside other evidence. If you want help gathering and presenting digital evidence properly, you can compare verified UAE legal professionals on LEXAI experienced in defamation and cybercrime cases.

In the UAE, the fact that a statement is true does not automatically protect you from a defamation or insult complaint. The cybercrime law, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, and the Penal Code focus on protecting people's honour, reputation and privacy, so publicly exposing damaging information about someone, even if accurate, can still lead to a complaint, particularly where it harms their reputation or invades their privacy. This is different from systems where truth is a complete defence. Insults and the unauthorised disclosure of private facts can be offences regardless of accuracy, and how truth and intent are weighed depends on the specific charge and circumstances, which is for the Public Prosecution and the court to assess. Because of this, publicly accusing or shaming someone online in the UAE carries real legal risk even when you are convinced you are right. Before publishing accusations, or if you have received a complaint, you can compare verified UAE legal professionals on LEXAI to understand your position before acting.

Under the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), individuals — called data subjects — are given a set of rights over their personal data. These generally include the right to be informed about how your data is processed, the right to request access to the data a controller holds about you, the right to have inaccurate data corrected, and the right to request erasure of your data in defined circumstances. The law also recognises rights to restrict or stop certain processing, to object to particular uses, to data portability (receiving your data in a structured, machine-readable form where applicable), and to withhold or withdraw consent. There are conditions and exceptions — for example, where the controller must keep data to comply with another legal obligation. To exercise a right, you normally submit a request directly to the organisation (the controller), which must respond within the period set by the law and its Executive Regulations. If they refuse or ignore you, you can escalate to the UAE Data Office. For complex disputes, you can compare verified UAE legal professionals on LEXAI.

Yes. Where a UAE organisation relies on your consent as its lawful basis for processing under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you generally have the right to withdraw that consent at any time. Consent under the PDPL must be a clear, specific and informed indication of agreement, and withdrawing it should be as straightforward as giving it. Practically, you notify the controller — for example by replying to a marketing email's opt-out, using an account privacy setting, or sending a written request to the company's privacy contact. Withdrawal stops future processing that depended on that consent, but it does not automatically make earlier processing unlawful, and it does not force deletion of data the controller must keep on another lawful basis (such as a legal obligation or an ongoing contract). If a business keeps processing your data purely on the basis of consent you have withdrawn, that may breach the law, and you can raise it with the UAE Data Office. Confirm the current procedure with the Data Office, and for disputes you can compare verified UAE legal professionals on LEXAI.

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) distinguishes ordinary personal data from special categories that carry heightened protection because misuse can cause greater harm. These sensitive categories generally include data revealing a person's racial or ethnic origin, religious or philosophical beliefs, political opinions, criminal record, health and genetic data, biometric data used to identify a person, and data concerning sex life. The law also gives particular attention to the personal data of children. Processing these categories typically requires stronger justification and safeguards than processing routine information such as a name or email address, and businesses are expected to apply appropriate technical and organisational security measures. If your organisation handles health, biometric or other sensitive data, you should map where it sits, limit access, document your lawful basis, and confirm the exact requirements and any conditions in the law's Executive Regulations and with the UAE Data Office. Mishandling sensitive data exposes a business to enforcement and complaints. For a compliance review tailored to your sector, you can browse verified UAE legal professionals on LEXAI.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), appointing a Data Protection Officer (DPO) is not required of every organisation — it is triggered by the nature and scale of the processing. The law generally requires a controller or processor to appoint a DPO where its processing would create a high risk to the confidentiality and privacy of personal data, for example processing involving large volumes of sensitive data, systematic and extensive evaluation of individuals, or new technologies that carry significant risk. A DPO can be an employee or an external appointee and is responsible for monitoring compliance, advising the business, and acting as a contact point with the UAE Data Office. Even where a formal DPO is not mandatory, a small business still must comply with the law's core duties — lawful basis, security measures, honouring data-subject rights and breach handling — so assigning clear internal responsibility for data protection is good practice. Because the exact triggers are detailed in the law and its Executive Regulations, confirm your position with the UAE Data Office. For a tailored assessment, you can browse verified UAE legal professionals on LEXAI.

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) does not set a single fixed retention period for all data; instead it applies a storage-limitation principle. A controller should keep personal data only for as long as is necessary to fulfil the purpose for which it was collected. Once that purpose is achieved and there is no other lawful ground to retain it, the data should be deleted or anonymised. In practice, retention periods vary by data type and context because other UAE laws — such as commercial, tax, labour or anti-money-laundering rules — may require certain records to be kept for set minimum periods, and those obligations can lawfully justify holding data longer. So there is no universal answer; a business should define and document a retention schedule mapped to each purpose and to any overriding legal requirement, and securely dispose of data when the period ends. As an individual, you can ask a controller why it still holds your data and request erasure where no valid basis remains. Confirm specific retention rules with the relevant authority. For tailored retention-policy advice, you can browse verified UAE legal professionals on LEXAI.

Yes. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) recognises your right to object to the processing of your personal data for certain purposes, and direct marketing is a typical example where you can require a business to stop. Where a company uses your data to send you promotional communications, you can withdraw any consent it relied on and object to further marketing processing. In practice you do this by using the opt-out or unsubscribe mechanism the business provides, adjusting your account preferences, or sending a written request to its privacy contact asking it to cease marketing to you. Once you object to marketing, the controller should stop using your data for that purpose, though it may continue to process the same data for other lawful purposes unrelated to marketing, such as fulfilling an order or meeting a legal obligation. Note that electronic marketing is also subject to other UAE telecom and consumer rules. If a business keeps marketing to you after you have clearly opted out, you can raise it with the UAE Data Office. For persistent or commercial disputes, you can compare verified UAE legal professionals on LEXAI.

Reckless or dangerous driving in the UAE is treated as one of the most serious traffic offences and can be handled as a criminal matter, not just a fineable violation. Under the UAE Federal Traffic Law, driving in a way that endangers lives or property, such as excessive speeding, weaving aggressively, racing on public roads, or driving that causes an accident, can attract heavy fines, black points, vehicle impoundment, and referral to the Public Prosecution where imprisonment is possible. The outcome depends on the seriousness of the conduct and whether anyone was harmed; cases causing death or serious injury are routinely referred to the criminal courts. Penalties are decided case by case by the prosecution and courts, so the precise fine or term cannot be assumed in advance. If you have been charged with reckless driving or your case has been referred to prosecution, treat it as a criminal defence matter and act quickly. You can compare verified UAE legal professionals on LEXAI who handle traffic and criminal cases for your circumstances.

The UAE's data protection framework treats children's personal data as deserving particular care, consistent with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the country's broader child-protection laws. Because children may not fully understand the consequences of sharing their information, organisations processing their data are expected to apply heightened caution: being especially clear and transparent, limiting collection to what is genuinely necessary, applying strong security, and, where consent is the basis for processing a minor's data, obtaining it from a parent or legal guardian as required. Services aimed at or likely to be used by children should design their data practices with the child's best interests in mind and avoid using a minor's data in ways that could harm them. For businesses, this means age-appropriate notices, careful default settings, and a clear process for guardians to exercise rights on a child's behalf. The precise conditions and any age thresholds are governed by the law and its Executive Regulations, so confirm them with the UAE Data Office. For help designing compliant services for minors, you can browse verified UAE legal professionals on LEXAI.