General UAE Legal Questions LawLaw No. (11) of 2014

Article (1) The following words and expressions, wherever mentioned in this Law, will have the meaning indicated opposite each of them unless the context implies otherwise: Emirate: The Emirate of Dubai. Government: The Government of Dubai. Government Entities: Government departments, agencies, public corporations, councils, and authorities, including free zone authorities, and any other entity affiliated to the Government. DCES: The Dubai Centre for Electronic Security established pursuant to this Law. Board of Directors: The board of directors of the DCES. Executive Director: The executive director of the DCES. Government Information: The Government Information, data, documents, and Information resources whether printed, written on paper, Electronically saved, processed, sent by post or Electronic media, appearing in video or audio recordings, or disclosed during face to face conversations or through any other means of communication. Information System: A physical or virtual implement or set of interrelated or independent implements that are used to store, sort, organise, retrieve, process, develop, and exchange Information in accordance with saved commands and instructions. This includes all inputs, outputs, and infrastructure related to the Information System. Information Systems are used by Government Entities to manage and process Information. Establishment of the DCES

Article (5) The DCES is the Government Entity responsible for maintaining Government Information Security in the Emirate. For this purpose, the DCES may: 1. set and implement the Government Information Security policy of the Emirate; 2. set, and supervise the implementation of, standards for ensuring Electronic security in the Emirate; 3. prepare, in coordination with concerned Government Entities, a strategic plan to manage any risks, threats, or attacks on Government Information; 4. verify the efficiency of the telecommunication network security systems and Information Systems of Government Entities; 5. monitor compliance by Government Entities with the Information Security requirements issued by the DCES, and follow up implementation of these requirements; 6. combat various cybercrimes and Information technology crimes;

-- 3 of 10 --

Law No. (11) of 2014 Establishing the Dubai Centre for Electronic Security Page 4 of 10 7. coordinate with Government, regional, and international entities with respect to the work of the DCES; 8. provide technical and advisory support to all Government Entities in the Emirate; 9. receive complaints and suggestions related to Government Information Security; 10. prepare and finance the studies and research required to develop Electronic security in the Emirate in coordination with Government Entities; 11. set, in coordination with Government Entities in the Emirate, the necessary rules for authorising the import, export, and use of encryption and jamming software and devices, and provide telecommunication network and Information System penetration testing services; 12. propose legislation concerning Electronic security; 13. raise awareness, in coordination with Government Entities, of the importance of Electronic security; and 14. hold, and participate in, conferences and seminars, and cooperate with regional and international organisations in relation to the work of the DCES. Board of Directors

Article (6) 1. The DCES will have a Board of Directors comprised of a chairman, vice chairman, and a number of experienced and competent members appointed pursuant to a resolution of the Ruler. The term of membership of the Board of Directors will be three (3) years, renewable upon expiry. 2. The Board of Directors will be convened at the invitation of its chairman, or vice chairman where the chairman is absent, at least once every two (2) months, or where necessary. Meetings of the Board of Directors will be valid if attended by the majority of its members provided that the chairman or vice chairman is in attendance. 3. The Board of Directors will pass its resolutions by majority vote, and in the event of a tie, the chair of the meeting will have a casting vote. Resolutions of the Board of Directors will be recorded in minutes of meetings signed by the chair of the meeting and attending members. Functions of the Board of Directors

Article (7)

-- 4 of 10 --

Law No. (11) of 2014 Establishing the Dubai Centre for Electronic Security Page 5 of 10 a. The Board of Directors is the highest authority in charge of managing the affairs of the DCES, and will be responsible for achieving the objectives and implementing the policies for which the DCES is established. The Board of Directors will exercise the authorities and powers required to achieve the objectives of the DCES, and, in particular, may: 1. set, and oversee the implementation of, the general policy of the DCES; 2. approve and review the work plans and programmes of the DCES, and assess their applicability on annual basis; 3. set the strategic goals of the DCES and the procedures required to oversee the implementation of the same, provided that these goals are reviewed, and compliance with them is assessed, on annual basis; 4. take the necessary action to ensure compliance by the DCES with the laws, the resolutions and regulations issued in pursuance of these laws, and any legislation related to the work and activities of the DCES; 5. assess and follow up the executive management of the DCES, and ensure that it achieves the objectives of the DCES; 6. approve the organisational structure of the DCES; 7. approve the annual budget and final accounts of the DCES; 8. form permanent and temporary committees and specialised work teams, and determine their duties and powers in order to achieve the objectives of the DCES; 9. determine the duties of each member of the Board of Directors in a manner that ensures integration of their roles to achieve the objectives of the DCES; 10. review, and make the necessary comments on, the performance reports submitted by the Executive Director; and 11. perform any other duties related to the objectives of the DCES. b. The Board of Directors may delegate any of the powers stipulated in paragraph (a) of this Article to the chairman or any member of the Board of Directors, or to the Executive Director. Executive Body

Article (10) The Executive Director will supervise the daily work, and manage and regulate the business, of the DCES, and represent it in its relations with third parties and before judicial authorities. In particular, the Executive Director will have the duties and powers to: 1. propose the policies, strategic, development, and operational plans, initiatives, and programmes that will achieve the objectives of the DCES, and submit these to the Board of Directors; 2. prepare work plans and programmes, and projects related to these plans and programmes, and submit these to the Board of Directors for approval; 3. prepare the organisational structure, administrative, financial, and human resources bylaws, and contracting, project, and auction regulations, and submit these to the Board of Directors for approval; 4. prepare, and submit to the Board of Directors, the draft annual budget and final accounts of the DCES; 5. appoint the technical and administrative staff required to perform the work of the DCES in accordance with its internal regulations and bylaws; 6. submit to the Board of Directors annual reports on the performance of the DCES; 7. implement and follow up the resolutions passed, and the policies, plans, and programmes set by the Board of Directors;

-- 6 of 10 --

Law No. (11) of 2014 Establishing the Dubai Centre for Electronic Security Page 7 of 10 8. approve financial transactions subject to the rules stipulated by the financial regulations and bylaws applicable in the DCES; 9. sign, in the name of the DCES and on its behalf, on contracts, agreements, and memoranda of understanding in accordance with the relevant powers granted to the Executive Director by the Board of Directors; 10. supervise the directorates and organisational units of the DCES, prepare periodic and annual reports on the progress of its work, and submit these reports to the Board of Directors; 11. contract with experts and advisers, and determine and pay their remuneration, in accordance with the bylaws applicable in the DCES; and 12. perform any other duties assigned by the Board of Directors. Confidentiality

Article (15) 1. The DCES will set the rules required to prevent any attempt to interrupt, disrupt, vandalise, or alter telecommunication networks or contents of Information Systems. It may take any action to prevent any such acts or attempts within and outside of the Emirate. 2. In emergency and urgent situations, the DCES will be authorised to monitor, penetrate, tackle, cancel, disrupt, or block the telecommunication networks and devices, Information Systems, or Electronic Mail of any person or entity where it is proved to the satisfaction of the DCES that this person or entity participates in any act that may compromise the security, beliefs, economy, heritage, culture, or public order of the Emirate, its relations with others, the vital establishments and public and private entities in the Emirate, or the life or property of any person. In these circumstances, the competent public prosecution authority must be notified, within one (1) week, of the measure taken by the DCES, in order to take the necessary action in respect of that measure. Financial Resources of the DCES