TRW & Co · Data, Privacy & Cyber
Cybersecurity Law in the UAE
Cybersecurity law in the UAE spans national strategy, mandated security standards, criminal offences and sector reporting deadlines that can be as short as four hours. This guide explains which regimes bind your organisation, what boards and regulators expect, how to handle an incident legally, and how to allocate cyber risk in contracts and insurance.
Key pointThe same incident can trigger a four-hour Central Bank notice, a 24-hour FSRA notice and an immediate DESC notice in one group, so the deadlines must be mapped entity by entity before anything happens.
At a glance
No single cyber statute
Obligations come from the Cybercrime Law, the Information Assurance Regulation, Dubai's DESC law and sector rules for finance, health and government.
Cybersecurity Council leads
Established by the Cabinet in November 2020, the Council leads national strategy, including the National Cybersecurity Strategy for 2025 to 2031.
Four-hour bank reporting
The Central Bank's 2026 operational risk regulation requires notice within four hours of significant events affecting critical operations, then a 24-hour report.
ADGM 24-hour rule
The FSRA Cyber Risk Management Framework, in effect from 31 January 2026, requires material cyber incidents to be notified within 24 hours.
Dubai critical entities
Dubai Law No. 15 of 2024 lets DESC classify critical non-government entities, which must notify DESC immediately of hacks and leaks.
Swipe or scroll →
What cybersecurity law in the UAE covers
Cybersecurity law in the UAE is the set of federal, emirate and sector rules that tell organisations how to protect their systems, how to respond when those systems are attacked, and what happens to the people who attack them. It covers security standards and governance, incident reporting to regulators, criminal offences such as hacking and extortion, and the contracts, insurance and liability questions that follow an incident.
It is broader than data protection. A ransomware attack that shuts down a logistics platform, a denial-of-service attack on a payment service, or an intrusion into a factory's control systems may involve no personal data at all, yet still trigger reporting duties, regulatory scrutiny and disputes with customers and suppliers. Where personal data is affected, the data protection regimes apply as well; our page on data breach response covers that part.
The question becomes legal at three points: when an organisation is designated as critical or regulated and must meet a mandated standard; when it signs contracts that allocate cyber risk; and when an incident happens and the clock starts on notifications, evidence and decisions about attackers.
The legal and regulatory framework
There is, as far as we are aware at the time of writing, no single consolidated federal cybersecurity statute in force. Cybersecurity law in the UAE is instead a set of overlapping instruments, and the obligations that bind a particular organisation depend on what it is, where it is licensed and which sector it serves.
National strategy and federal bodies
The UAE Cybersecurity Council, established by the Cabinet in November 2020 and chaired by the Head of Cyber Security for the UAE Government, leads national strategy, contributes to the legal and regulatory framework and is tasked with a National Cyber Incident Response Plan. Its National Cybersecurity Strategy for 2025 to 2031 moves the emphasis towards governance, accreditation of security providers, supply-chain security and active defence.
The Telecommunications and Digital Government Regulatory Authority (TDRA) issued the UAE Information Assurance Regulation, which sets management and technical security controls. Critical entities designated under the national Critical Information Infrastructure Protection policy must implement it, and many other organisations use it as a benchmark. The national computer emergency response team, aeCERT, supports detection and response.
The Cybercrime Law
Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes criminalises unauthorised access to systems and websites, interception, damage to data and systems, electronic fraud and extortion, with heavier penalties where government or critical systems are targeted. It matters to victims as well as attackers: it is the basis for criminal complaints and evidence-gathering, and it means penetration testing and threat hunting must be properly authorised in writing. Our article on the UAE Cybercrime Law explains the offences.
Dubai and Abu Dhabi
Dubai Law No. 15 of 2024 concerning the Dubai Electronic Security Centre (DESC), issued on 4 September 2024, replaced the 2014 law that created DESC. It lets DESC define critical sectors and infrastructure and classify critical non-government entities, requires government and critical entities to notify DESC immediately of hacks, leaks and other threats, and gave entities up to one year to comply. Other Dubai regulators must set security controls for private entities they supervise, with DESC's approval.
In Abu Dhabi, the Department of Health's Healthcare Information and Cyber Security Standard (ADHICS), launched in 2019, is mandatory for public and private healthcare facilities and is tied to licensing. Abu Dhabi government entities apply their own information security standards.
Financial services
Financial regulators now impose the most specific cyber duties. The Central Bank's Operational Risk Management Regulation, communicated to licensed financial institutions in July 2026 and replacing the 2018 regime, requires notification to the Central Bank within four hours of an event that significantly affects critical operations, a summary report within 24 hours, independent penetration testing for critical functions, and board-approved tolerances for disruption.
The ADGM Financial Services Regulatory Authority's Cyber Risk Management Framework, in effect from 31 January 2026, requires a written framework, board accountability and notification of material cyber incidents no later than 24 hours after awareness. The DFSA in the DIFC applies its own cyber risk requirements and runs periodic cyber risk self-assessments of authorised firms.
| Regime | Who it binds | Core standard | Incident reporting |
|---|---|---|---|
| UAE Information Assurance Regulation (TDRA) | Designated critical entities; benchmark for others | Management and technical controls | Through national incident channels and sector regulators |
| Dubai Law No. 15 of 2024 (DESC) | Dubai government and critical non-government entities | DESC standards and approved sector controls | Immediate notification to DESC |
| CBUAE Operational Risk Management Regulation | Licensed financial institutions | Operational resilience, ICT and cyber controls | Within 4 hours for significant events; summary within 24 hours |
| FSRA Cyber Risk Management Framework | ADGM authorised firms | Written cyber risk framework, board accountability | Material incidents within 24 hours |
| ADHICS (Department of Health, Abu Dhabi) | Abu Dhabi healthcare facilities | Healthcare information and cyber security standard | Under DoH requirements |
| Federal PDPL and DIFC/ADGM data laws | Controllers and processors of personal data | Appropriate security measures | Personal data breaches, per each regime |
Where does your organisation sit? Four classification questions
The first practical step in applying cybersecurity law in the UAE is classification. Four questions decide most of the answer.
Are you critical, or serving someone who is?
Designation as a critical entity, whether federally or by DESC in Dubai, brings mandated standards and direct reporting. Suppliers to critical entities are rarely designated themselves, but they inherit the requirements by contract, audit rights and procurement rules. The national strategy's accreditation programme for security providers points the same way.
Are you regulated?
Banks, insurers, payment firms, exchanges, fund managers and other licensed financial institutions face the shortest reporting windows. Healthcare providers, telecoms licensees and government entities have their own regimes. A technology company that provides critical services to a regulated firm will usually be pulled into the firm's outsourcing and resilience obligations; our page on financial services outsourcing explains how.
Where are you licensed?
A DIFC or ADGM firm answers to the DFSA or FSRA, not to onshore financial regulators, for its regulated activities, but federal criminal law and national cyber bodies still apply. A Dubai mainland company may fall within DESC's reach if classified as critical. The answer can differ for each entity in a group.
Do you process personal data?
Almost every organisation does, so the federal data protection law or the DIFC or ADGM regime adds security duties and breach notification. The cyber and privacy programmes should share one incident process rather than run in parallel; see our page on privacy compliance programmes.
Governance and controls regulators expect
Across the regimes, regulators look for the same building blocks. The board or governing body owns cyber risk and receives regular reporting. A senior, suitably independent security lead runs the programme. There is a written framework mapped to a recognised standard, such as the UAE Information Assurance Regulation or an international equivalent, with risk assessments, asset inventories, access control, vulnerability management, logging, backup and recovery.
Testing is increasingly mandatory rather than good practice. The Central Bank's 2026 regulation requires independent external penetration testing for critical functions with results presented to the board, and business continuity exercises under severe but plausible scenarios. Third-party risk is treated as the firm's own risk: cloud providers, managed security providers and software suppliers must be assessed, contracted and monitored.
Regulators no longer ask whether you can prevent every attack. They ask whether your board knew the risk, tested the response and can show what it decided in the first four hours.
Artificial intelligence adds a further layer. Security teams use AI tools, attackers use them too, and regulators are asking firms how AI is governed. The cyber programme should cover AI systems as assets to protect and as tools that need oversight; our page on AI governance covers the wider framework.
Incident response under cybersecurity law in the UAE
When an incident happens, technical and legal work run in parallel. The sequence below focuses on the legal decisions; for personal data notifications, use it alongside our breach response guidance.
- Activate the plan and preserve evidence. Convene the incident team, involve legal counsel early, isolate affected systems and preserve logs, images and communications. Start a timestamped decision log.
- Classify the incident. Decide whether it significantly affects critical operations, whether it is "material" under the relevant regulator's criteria, and whether personal data is involved. Classification drives every deadline that follows.
- Make the regulatory notifications. File within the applicable windows: four hours to the Central Bank for significant events affecting critical operations, 24 hours to the FSRA for material incidents, immediately to DESC for Dubai critical entities, and to data protection regulators where personal data is involved.
- Engage law enforcement and national bodies. Report criminal activity to the police or public prosecution, and coordinate with national cyber bodies where required. Keep evidence handling consistent with a possible criminal case.
- Notify insurers and key counterparties. Cyber policies typically require prompt notice and consent before engaging vendors or negotiating. Customer and supplier contracts may impose their own notice periods.
- Decide on any extortion demand with advice. Before any payment is considered, assess sanctions and anti-money laundering exposure, insurer position and law enforcement views. The UAE participates in the international Counter Ransomware Initiative.
- Restore, remediate and report. Recover from clean backups, fix root causes, submit follow-up reports to regulators and brief the board on lessons learned.
Write the regulator-specific deadlines into the incident plan itself, entity by entity. A group with a Central Bank-licensed payments arm, an ADGM fund manager and a Dubai mainland technology company can face a four-hour, a 24-hour and an "immediate" deadline for the same event.
Contracts, insurance and liability
Under cybersecurity law in the UAE, most cyber losses are still allocated by contract before any regulator is involved. Customer contracts should define security standards, notice periods, cooperation duties, audit rights and liability caps that are realistic. Supplier contracts, especially with cloud and managed service providers, need incident notice periods short enough to let you meet your own regulatory deadlines; a supplier with 72 hours to tell you is no use if you have four hours to tell your regulator. Our pages on cloud and outsourcing and SaaS and technology contracts cover the clauses.
Cyber insurance policies shape response choices through panel vendor requirements, consent provisions and exclusions, including for war and state-backed attacks. Review the policy against the incident plan before you need it; our page on insurance and reinsurance covers coverage disputes.
After an incident, liability can arise in several directions: regulatory penalties under sector rules, contractual claims by customers, claims against negligent suppliers and, in the DIFC, direct compensation claims by individuals where personal data is involved. Directors may face questions about oversight. Preserving privilege over forensic reports, by commissioning them through counsel where possible, helps manage that exposure.
Risks and common mistakes
Testing systems without written authorisation
The Cybercrime Law penalises unauthorised access, and that includes well-intentioned testing that goes beyond what the system owner approved. Penetration tests, red-team exercises and threat hunts across group companies, cloud tenants or customer environments should rest on written authorisation from the party that controls each system, with a defined scope and rules of engagement. This is particularly important where testers work remotely from outside the UAE or where a group company tests a sister company's systems. A short authorisation letter avoids an avoidable criminal law question.
Supplier notice periods longer than your regulatory deadline
Many cloud, software and managed-service contracts still give suppliers 48 or 72 hours, or "without undue delay", to report incidents. For a Central Bank-licensed institution with a four-hour notification duty, or an ADGM firm with 24 hours, that gap is a compliance failure waiting to happen. Renegotiate notice periods for critical suppliers, require interim notifications as facts emerge, and make sure contracts give you the information you need to complete a regulator's template.
Treating cyber as an IT issue rather than a board issue
The Central Bank, FSRA and DESC regimes all place responsibility at governing-body level. Boards that receive no regular cyber reporting, have never rehearsed a major incident and have not approved disruption tolerances are exposed when a regulator asks what they knew. A short quarterly report, an annual tabletop exercise with the board and documented approval of the risk appetite are inexpensive and persuasive evidence of oversight.
Mishandling an extortion demand
Ransom negotiations carried out by IT staff or untested vendors, without legal oversight, create several risks: payments that breach sanctions, loss of insurance cover, destroyed evidence and statements that later undermine the organisation's position. Any engagement with attackers should be authorised at a senior level, documented, coordinated with insurers and law enforcement, and screened against sanctions and anti-money laundering rules. Our page on sanctions and export controls explains the screening issues.
Forgetting operational technology
Energy, utilities, logistics, manufacturing and building management systems run on operational technology that is often older, harder to patch and connected to corporate networks in ways nobody fully mapped. Attacks on these systems can cause physical disruption and safety risks, and they are a stated focus of national critical infrastructure policy. Include operational technology in asset inventories, risk assessments, incident plans and supplier contracts, not just office IT.
Cross-border angle
Cyber incidents ignore borders, and so do reporting duties, so cybersecurity law in the UAE is rarely the only regime in play. A UAE group with a UK subsidiary may need to consider UK regulators, including the Information Commissioner's Office and, for regulated financial firms, their UK supervisors. Saudi Arabia's National Cybersecurity Authority sets binding controls for many Saudi entities and their suppliers, which UAE vendors serving Saudi clients often have to meet. India's CERT-In requires certain incidents to be reported on a short timeline, which matters for UAE groups with Indian service centres.
Singapore's Cybersecurity Act regulates critical information infrastructure owners and their reporting, and China's data and cybersecurity laws impose controls on data and incident handling in China. For groups with operations in Bangladesh, local cybersecurity and digital security legislation, which has been revised in recent years, needs to be checked with local counsel at the time of the incident.
The practical solution is a single global incident plan with a jurisdiction matrix setting out each regulator, trigger and deadline. TRW & Co's offices in Dhaka, Singapore and London help coordinate that matrix and the response across time zones.
How TRW & Co helps
We advise on cybersecurity law in the UAE before, during and after incidents, working alongside your security team and technical vendors.
Regulatory mapping
We determine which cyber regimes bind each entity, including critical designation, sector rules and free-zone regulators, and build the reporting matrix your incident plan needs.
Governance and policy
We draft and review cyber governance frameworks, board reporting, incident response plans and testing authorisations, aligned with the Central Bank, FSRA, DFSA, DESC or sector standards that apply.
Contracts and supply chain
We negotiate security schedules, incident notice periods, audit rights and liability terms with cloud, software and managed-service providers, and with customers.
Incident counsel
We guide classification and notifications, commission forensic work under privilege where possible, prepare regulator filings and coordinate with insurers and law enforcement.
Extortion and sanctions advice
We advise boards facing extortion demands on sanctions, anti-money laundering and insurance issues, and on documenting the decision.
Post-incident disputes and investigations
We manage regulator enquiries and claims against suppliers or by customers. For regulatory investigations and litigation we work alongside locally licensed advocates and registered practitioners.
Explore our practices or contact us to review your incident readiness.
Checklist for decision-makers
- Do we know whether any entity in the group is, or supplies, a designated critical entity?
- Have we mapped every regulator we would need to notify, with its trigger and deadline, for each entity?
- Does the board receive regular cyber reporting and rehearse a major incident at least annually?
- Are penetration tests and red-team exercises authorised in writing by each system owner?
- Do critical supplier contracts require incident notice fast enough for our own deadlines?
- Does our cyber insurance align with the incident plan, including vendor panels and consent rules?
- Do we have a documented process for handling extortion demands, including sanctions screening?
- Is operational technology included in our asset inventory, risk assessments and incident plan?
Cybersecurity law in the UAE is converging on a simple expectation: know your obligations in advance, and be able to prove what you did and when. Organisations that prepare the legal side of their response alongside the technical side recover faster and face fewer questions afterwards.
Frequently asked questions
01Is there a single cybersecurity law in the UAE?
Not as far as we are aware at the time of writing. Obligations come from several instruments: the Cybercrime Law (Federal Decree-Law No. 34 of 2021), the UAE Information Assurance Regulation for designated critical entities, Dubai Law No. 15 of 2024 on DESC, sector rules from the Central Bank, FSRA, DFSA and health authorities, and the data protection laws. The national strategy aims at a more unified framework, so organisations should watch for new legislation and design programmes that can absorb it.
02Do private companies have to report cyber incidents?
It depends on the company. Licensed financial institutions must notify the Central Bank within four hours of significant events affecting critical operations; ADGM firms must notify the FSRA of material incidents within 24 hours; Dubai critical entities must notify DESC immediately. Where personal data is involved, data protection notification duties apply under the PDPL, DIFC or ADGM regimes. Unregulated companies may still have contractual duties to customers and should report crimes to the police.
03What is the UAE Information Assurance Regulation?
It is a set of management and technical information security controls issued by the TDRA. Entities designated as critical under the national Critical Information Infrastructure Protection policy must implement it. Many other organisations, especially those supplying government or critical sectors, adopt it as a benchmark or are required to by contract. The national strategy's accreditation programme for security providers builds on it.
04Can we pay a ransom?
Any decision on an extortion demand needs legal advice first. A payment can engage sanctions and anti-money laundering rules, may affect insurance cover, and should be coordinated with law enforcement. The UAE participates in the international Counter Ransomware Initiative. Boards should document who authorised any engagement with attackers and why, and should never let negotiations run without legal and senior oversight.
05Is penetration testing legal in the UAE?
Yes, when properly authorised. The Cybercrime Law penalises unauthorised access to systems, so tests and red-team exercises should rest on written authorisation from the party that controls each system, with a defined scope and rules of engagement. Take particular care where testers operate from abroad or where one group company tests another's systems or a customer's environment.
06How do cyber rules apply in the DIFC and ADGM?
Authorised firms in the DIFC and ADGM answer to the DFSA and FSRA for their regulated activities, including cyber risk requirements and incident reporting. The FSRA's Cyber Risk Management Framework has applied since 31 January 2026. Federal criminal law and national cyber bodies still apply in both centres, and each centre's data protection regime adds breach notification duties for personal data.
07What should our supplier contracts say about cyber incidents?
At minimum: security standards, a short incident notice period with interim updates, cooperation and information duties, audit rights, subcontractor controls, and liability terms that reflect the risk. Notice periods must allow you to meet your own regulatory deadlines; a supplier with 72 hours to tell you is a problem if you have four hours to tell the Central Bank.
Sources and official materials
- UAE Cybersecurity Council (u.ae) — Establishment and mandate of the Council
- UAE Information Assurance Regulation (u.ae) — TDRA security controls and critical entities
- Dubai Law No. 15 of 2024 concerning DESC — Dubai electronic security law, critical entities and notification
- ADHICS launch (Department of Health Abu Dhabi) — Healthcare cyber security standard for Abu Dhabi facilities
- Central Bank of the UAE — Operational risk and resilience rules for licensed institutions
- UAE Legislation portal — Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes
- Telecommunications and Digital Government Regulatory Authority — Information assurance and national digital policy
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
