Ask a Lawyer

Using a VPN is not automatically illegal in the UAE, but how you use it matters. Under Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, the offence arises when someone uses a VPN, proxy or similar technology to commit a crime or to prevent its discovery, for example to access blocked content unlawfully, hide criminal activity, or commit fraud. Many businesses, banks and individuals in the UAE use VPNs for legitimate security and privacy reasons, and that ordinary use is generally tolerated. The legal risk comes from the underlying purpose: if a VPN is used to do something that is itself illegal in the UAE, the use of the VPN can be treated as an aggravating element. Because the law focuses on intent and the act committed, the safest approach is to avoid using a VPN to bypass lawful restrictions or to commit any offence. If you are unsure whether a specific activity is permitted, you can compare verified UAE legal professionals on LEXAI to get advice tailored to your situation.

For non-citizens, a conviction for online defamation or related cybercrime offences in the UAE can lead to deportation in addition to other penalties. Online insults and defamatory accusations are offences under Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, and UAE law allows the court to order deportation of a foreigner convicted of certain crimes, sometimes alongside a fine or imprisonment. Whether deportation is ordered depends on the offence, its severity and the court's assessment, so it is not automatic in every case but is a real possibility. This is why even seemingly minor online disputes, such as an insulting post or message, should be taken seriously by residents. If you are facing a complaint, early legal advice can be important, because outcomes such as settlement or withdrawal of a complaint by the victim can sometimes affect how a case proceeds. To understand the residency implications of a specific case and protect your status, you can compare verified UAE legal professionals on LEXAI experienced in cybercrime and immigration-linked matters.

Yes, online harassment can be a crime in the UAE. Conduct such as repeatedly sending abusive or threatening messages, insulting someone, invading their privacy, or using electronic means to disturb or intimidate them is addressed by Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, alongside provisions of the Penal Code. The law protects people from insults, threats, blackmail, privacy violations and the misuse of technology to harm others, so persistent online abuse directed at an identifiable victim can support a complaint. If you are being harassed, preserve the evidence, including messages, account details and screenshots, and consider blocking the person while keeping records. You can then report the matter to the police or the relevant emirate's e-crime channel, such as Dubai Police's eCrime platform or Abu Dhabi's Aman service. The Public Prosecution can investigate and pursue the offender, and penalties are set by the law and the court. For help assessing whether the behaviour amounts to a crime and how to respond, you can compare verified UAE legal professionals on LEXAI.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you have a right to request erasure of your personal data held by a controller in defined situations — for example where the data is no longer needed for the purpose it was collected, or where you withdraw the consent the processing relied on and there is no other lawful basis. Start by sending a written request to the organisation, ideally to its data protection contact or privacy team, clearly identifying yourself and the data you want deleted. The controller must consider the request and respond within the timeframe set by the law and its Executive Regulations. Erasure is not absolute: a business may lawfully retain data it needs to meet another legal or regulatory obligation, to establish or defend a legal claim, or for other grounds recognised by the law. If the controller refuses without a valid basis or fails to respond, you can lodge a complaint with the UAE Data Office, the federal supervisory authority. For a contested or high-value matter, you can browse verified UAE legal professionals on LEXAI to get tailored advice.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), a controller that experiences a personal data breach — a security incident leading to unauthorised access, disclosure, loss or alteration of personal data — has specific obligations. The core duties are to assess the incident, and where it poses a risk to the privacy, confidentiality or security of the affected individuals' data, to notify the UAE Data Office, and in defined circumstances to notify the affected data subjects. A processor that becomes aware of a breach must inform the controller. The notification should describe the nature of the breach, the data and individuals affected, the likely consequences, and the measures taken or proposed to address it and limit harm. The precise notification timing, thresholds and content are set out in the law and its Executive Regulations, so confirm the current requirements with the UAE Data Office rather than relying on assumptions. Businesses should also keep an internal record of breaches. Before an incident occurs, having an incident-response plan and clear contracts with processors is essential. For help building one, you can compare verified UAE legal professionals on LEXAI.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), responsibilities depend on whether you are a controller or a processor. A controller is the person or entity that determines the purposes and means of processing personal data — essentially deciding why and how the data is used. A processor is a separate party that processes personal data on the controller's behalf and under its instructions, such as a cloud host, payroll bureau or email-marketing platform. The controller carries primary accountability: establishing a lawful basis, honouring data-subject rights, applying security measures, and ensuring any processor it appoints gives sufficient guarantees. The processor must act only on the controller's documented instructions, keep data secure, support the controller in meeting its obligations, and not engage sub-processors without authorisation. The relationship should be governed by a written contract setting out the subject matter, duration, scope and each party's duties. Many businesses are controllers for their own customer data and processors for clients they serve. Mapping your role for each data flow is the first compliance step. For drafting processing agreements, you can browse verified UAE legal professionals on LEXAI.

Yes, but cross-border transfers of personal data out of the UAE are regulated under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The general principle is that data may be transferred to another country or international organisation where an adequate level of protection exists — for example, where the destination has data protection laws and oversight comparable to the UAE's, or where there is a binding instrument that provides appropriate safeguards. Where adequacy is not established, the law sets out alternative conditions that can permit a transfer, such as the data subject's explicit consent, the necessity of the transfer to perform a contract, to protect vital interests, or other grounds recognised in the law. Controllers remain responsible for ensuring the data stays protected after it leaves the UAE. The detailed mechanisms and any list of approved jurisdictions are governed by the law's Executive Regulations and guidance from the UAE Data Office, so confirm current requirements there. If you believe your data was transferred improperly, you can raise it with the Data Office. For cross-border compliance advice, you can compare verified UAE legal professionals on LEXAI.

Generally no — the financial free zones run their own data protection regimes. The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) provides the UAE-wide baseline, but the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each have their own standalone data protection laws and independent regulators (the DIFC operates under its Data Protection Law, and ADGM under its own data protection regulations). If your entity is established in and processes data within one of these free zones, that zone's law and its commissioner's office usually apply to you rather than the federal PDPL. The free-zone regimes are closely modelled on international standards and share many concepts — lawful basis, data-subject rights, breach notification and cross-border rules — but the precise obligations, timelines and registration requirements differ. The practical step is to confirm which regime governs each data flow, because a group operating across mainland and free zones may be subject to more than one. For a clear assessment of which law applies to your structure, you can compare verified UAE legal professionals on LEXAI who handle privacy and free-zone matters.

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), an organisation cannot process personal data unless it has a valid lawful basis. Consent — a clear, specific, informed and freely given agreement from the individual — is one basis, but it is not the only one. The law recognises several other grounds where processing is permitted without consent, including where it is necessary to perform a contract to which the data subject is a party, to comply with a legal obligation on the controller, to protect the vital interests of the individual, to carry out functions in the public interest, or to serve legitimate interests of the controller that do not override the individual's rights. The right basis depends on the context: an employer processing payroll, a hospital handling patient records, and a shop running a loyalty programme may each rely on different grounds. Choosing and documenting the correct basis for each processing activity is a core compliance step, and you cannot simply default to consent for everything. Confirm the exact conditions in the law and its Executive Regulations. For help mapping your bases, you can compare verified UAE legal professionals on LEXAI.

Yes, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) recognises a right to data portability among the rights it grants to individuals. In broad terms, this allows you to obtain the personal data you provided to a controller in a structured, commonly used and machine-readable format, and — where technically feasible — to have it transmitted to another controller. The right is designed to reduce lock-in and give people more control, for example when switching between service providers. It generally applies to data you provided and where the processing is carried out by automated means on a basis such as your consent or a contract, rather than to every piece of data a company holds. To use it, send a written request to the controller's privacy contact specifying what you want and, if relevant, the provider you want it sent to. The controller must respond within the period set by the law and its Executive Regulations, subject to limited exceptions, such as where transfer would adversely affect others' rights. For the exact scope and format requirements, confirm with the UAE Data Office, and for disputes you can compare verified UAE legal professionals on LEXAI.