TRW & Co · Intellectual property
Trade Secrets and Confidential Information in the UAE
Trade secrets UAE businesses depend on are protected without registration, but only if the holder can show the information is secret, valuable because it is secret, and guarded by reasonable measures. This guide explains the federal and DIFC rules, how to handle employee exits, and which remedies work when confidential information leaks.
Key pointTrade secret cases are usually decided by evidence created long before the leak: access logs, signed acknowledgements and a documented exit process. A narrowly drafted confidentiality clause backed by controls is worth more than a broad non-compete.
At a glance
No registration needed
Trade secrets are protected for as long as the information stays secret; there is nothing to file with the Ministry of Economy and Tourism.
Three-part legal test
Information must be secret, have commercial value because it is secret, and be protected by reasonable measures taken by its lawful holder.
Main onshore statute
Federal Law No. 11 of 2021 on industrial property protects undisclosed information, with civil compensation, precautionary seizure and criminal penalties.
Non-compete limit
Onshore non-competes must be in the contract, limited in time, place and type of work, and last no more than two years.
DIFC limitation period
DIFC trade secret claims must be brought within three years after misappropriation is, or reasonably should have been, discovered.
Swipe or scroll →
Trade secrets UAE businesses rely on, from pricing models and source code to customer lists and process know-how, are protected without registration, but only if the holder can prove three things: the information is secret, it is valuable because it is secret, and reasonable steps were taken to keep it that way. Onshore, the main statute is the federal Industrial Property Law; in the DIFC, a dedicated trade secrets part of the DIFC Intellectual Property Law applies.
This article explains how that protection works in practice, how it interacts with employment contracts and non-competes, what remedies are realistic when a senior employee or partner leaves with information, and where the onshore courts, the DIFC and ADGM differ. It is a practical companion to our practice page on trade secrets in the UAE.
Trade secrets UAE: the short answer
- No registration, no certificate. A trade secret exists for as long as it stays secret and the holder protects it. There is nothing to file with the Ministry of Economy and Tourism.
- Three-part test. Onshore and in the DIFC, protection depends on secrecy, commercial value derived from secrecy, and reasonable measures to preserve it. The third limb is where most claims are won or lost.
- Several overlapping routes. A holder can combine a statutory claim, a contract claim, employment remedies and, in serious cases, a criminal complaint.
- Employee exits are the main risk. Most disputes start when someone leaves. Contracts, exit processes and evidence gathered in the first days decide the outcome.
- Forum matters. Onshore courts, the DIFC Courts and the ADGM Courts apply different rules, evidence practices and limitation periods.
The legal framework for trade secrets
There is no single trade secrets code. Protection for trade secrets UAE-wide comes from a set of statutes that each cover part of the problem, and the right combination depends on where the business is established and who took the information.
Federal Law No. 11 of 2021 on industrial property
Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights treats "undisclosed information" as industrial property. Information qualifies if it is not generally known or readily accessible to people in the relevant field, has commercial value because it is secret, and has been subject to reasonable measures by its lawful holder to keep it secret. Protection lasts for as long as those conditions continue to be met.
The law identifies unfair practices, such as breach of confidentiality agreements, inducing employees to disclose, theft and espionage, and the knowing use of information obtained in those ways. It also confirms what is fair: independent development, lawful examination of products on the market and use of public sources. Remedies include civil compensation, precautionary seizure and criminal penalties for intentional infringement, including substantial fines and possible imprisonment. The Ministry of Economy and Tourism lists the law and its implementing regulation on its intellectual property legislation page.
Employment, contract and civil law
The Labour Law, Federal Decree-Law No. 33 of 2021, requires employees to keep the employer's secrets during and after employment, permits a post-termination non-compete of up to two years if it is limited in time, place and type of work, and allows dismissal without notice for disclosing secrets in certain circumstances. The text is published by the Ministry of Human Resources and Emiratisation.
Contract claims sit alongside these rules. The new Civil Transactions Law, Federal Decree-Law No. 25 of 2025, in force from 1 June 2026, governs contract and tort claims for agreements made under it and addresses the misuse of confidential information exchanged during negotiations. That matters for bidders, prospective buyers and joint venture partners who receive sensitive data before a deal is signed.
Criminal law
The Crimes and Penalties Law penalises disclosure of secrets entrusted to a person by reason of their profession or position. Where information is taken through email, cloud storage or unauthorised system access, the federal cybercrime law, Federal Decree-Law No. 34 of 2021, adds further offences. A criminal complaint gives the case the weight of the Public Prosecution, but the holder loses control of timing.
DIFC and ADGM
The DIFC Courts apply DIFC Law No. 4 of 2019, the DIFC Intellectual Property Law, which has its own part on trade secrets. It uses a similar three-part test, defines misappropriation (including acquisition by improper means and use by someone who ought to have known the information was obtained in breach of a duty), and requires claims to be brought within three years after the misappropriation is discovered or should reasonably have been discovered. ADGM applies English common law under its legal framework, so the equitable action for breach of confidence and contractual claims are available before the ADGM Courts.
What counts as a trade secret, and what does not
Almost any business information can be among the trade secrets UAE law protects if the three conditions are met. Typical examples are formulas, manufacturing parameters, source code and model weights, pricing and margin data, tender strategies, supplier terms, customer lists with buying histories, product roadmaps and deal pipelines.
Some things fall outside. General skill and experience an employee acquires on the job is theirs to take to the next role. Information already circulating in the industry, or that a competitor can derive by lawfully examining a product, is not secret. And information that the business itself shared widely without restriction will struggle to meet the "reasonable measures" test.
The dividing line between protectable know-how and an employee's general skill is the most contested point in departing-employee cases. The more specific, documented and access-controlled the information, the easier it is to show it belongs to the business. Our guide to copyright ownership, including software, explains how code can be protected by copyright and as a trade secret at the same time.
Building reasonable measures: a protection programme
Every route turns on what the holder did before the loss. Courts and court-appointed experts look for evidence of controls in operation, not just a policy on the intranet. A defensible programme for trade secrets UAE companies hold usually follows these steps.
- Identify and classify. Keep a short register of the information that really matters, who owns it and where it sits. You cannot prove you protected information you never identified.
- Restrict access. Apply need-to-know access, log access to sensitive repositories, limit downloads and personal devices, and review permissions when people change roles.
- Contract for it. Use confidentiality, invention assignment and return-of-materials clauses in employment contracts, and NDAs with clear definitions and governing law for partners, suppliers and bidders.
- Mark and remind. Label confidential documents, require periodic acknowledgements and give short, role-specific training. These records show staff knew what was confidential.
- Run structured exits. Recover devices, revoke access the same day, remind leavers in writing of continuing obligations and, for senior leavers, review recent download and email activity.
- Prepare a response plan. Decide in advance who investigates, who preserves evidence, and when lawyers and forensic specialists are called.
The evidence that wins trade secret cases is usually created months before anyone leaves: access logs, signed acknowledgements, a classification register and a documented exit process. A business that can produce these quickly is in a far stronger position before a judge considering urgent relief.
Employee exits, non-competes and garden leave
Most disputes over trade secrets UAE employers face involve a departing employee, often a senior salesperson, engineer or executive joining a competitor. The employment terms and the way the exit is handled shape every remedy that follows.
Non-competes onshore and in the free zones
An onshore non-compete must be written into the employment contract, protect a legitimate interest such as access to clients or business secrets, be limited in place, time and type of work, and last no more than two years after the contract ends. Courts will not enforce a blanket ban on working for any competitor anywhere in the region. Our article on non-compete clauses in the UAE sets out the drafting detail.
A non-compete is a blunt instrument. Confidentiality and non-solicitation clauses are often more useful, because they target the actual harm and survive scrutiny more easily.
DIFC and ADGM employers
The DIFC and ADGM have their own employment laws. Restrictive covenants there are assessed under contract law and, in ADGM, English common law principles, so reasonableness is judged differently. See our practice page on restrictive covenants in the UAE.
Managing the exit itself
A trade secret claim brought against the backdrop of an unlawful dismissal is weaker, because the employee has a credible counter-claim. Ending the contract properly, paying end-of-service entitlements and documenting the handover protects the business's position on confidentiality.
Remedies and forums compared
When information leaks, the holder usually runs several tracks at once. The table compares the main options.
| Route | Legal basis | Best for | Main limitation |
|---|---|---|---|
| Statutory claim onshore | Federal Law No. 11 of 2021 on industrial property | Misuse by competitors, former staff or partners | Must prove secrecy, value and reasonable measures |
| Contract claim | NDA, employment, supply or JV agreement; civil law | Parties bound by confidentiality terms | Binds only parties; loss must be proved |
| Labour remedies | Federal Decree-Law No. 33 of 2021 | Current staff and recent leavers | Labour process and MOHRE steps may apply first |
| Criminal complaint | Industrial Property Law, Crimes and Penalties Law, cybercrime law | Deliberate theft, hacking, data exfiltration | Prosecution controls the file and timing |
| DIFC Courts claim | DIFC Law No. 4 of 2019, trade secrets part | DIFC entities and contracts with DIFC jurisdiction | Three-year limitation from discovery |
| ADGM Courts claim | English common law of confidence and contract | ADGM entities and contracts | Jurisdiction must be established |
Urgent relief is often the most valuable outcome. Onshore, the summary judge can order precautionary measures such as seizure of materials and devices. The DIFC and ADGM Courts can grant injunctions and orders to preserve evidence. Our page on emergency and interim relief in the UAE explains how these applications work.
Illustrative scenario: a sales director leaves
This scenario is illustrative and uses generic parties.
A Dubai mainland distributor learns that its regional sales director has resigned to join a competitor. In the two weeks before resigning, the director forwarded pricing spreadsheets and a customer pipeline to a personal email account.
The distributor's position is strong in some respects: it has an access log showing the downloads, a signed confidentiality clause and a classification policy that labels pricing data as restricted. It is weaker in others: the non-compete covers "the GCC" for three years, which exceeds what the Labour Law allows, and the company did not revoke system access until the director's last day.
A sensible plan focuses on the confidentiality obligations and the evidence, not the overreaching non-compete. The company preserves the logs, sends a measured letter requiring return and deletion with a signed undertaking, and prepares an application for precautionary measures if the director does not comply. It considers a criminal complaint only if there is evidence of wider misuse. It also writes to the new employer, carefully, putting it on notice.
Risks and common mistakes
The same errors recur in disputes over trade secrets UAE businesses bring, and most are avoidable.
Relying on a generic confidentiality clause
Boilerplate that labels "all information" confidential is hard to enforce, because it does not identify what is actually secret and treats trivial and critical information alike. Courts and experts look for specific categories, practical controls and evidence that the business behaved as if the information mattered. Tailor definitions to the business, and back them with access rules and marking so the clause reflects reality.
Over-reaching non-competes
A non-compete that exceeds two years onshore or is unlimited in geography invites the argument that it should not be enforced. Employers sometimes rely on it in place of confidentiality and non-solicitation obligations that would have been upheld. Draft restrictions narrowly, tie them to the employee's real access, and rely on confidentiality as the primary protection.
Losing the evidence in the first week
Wiping a leaver's laptop for reissue, letting email retention policies run, or allowing IT to investigate without forensic discipline can destroy the proof needed for urgent relief. As soon as a leak is suspected, preserve devices and logs, document the chain of custody and involve specialists who can give evidence if required.
Sharing too much in deal negotiations
Bidders and prospective partners often receive the most sensitive information with only a short NDA in place. Use staged disclosure, clean-team arrangements for competitors, data-room logging and an NDA that deals with return, deletion and residual knowledge. The Civil Transactions Law now gives a clearer basis for claims, but prevention is cheaper than litigation.
Feeding confidential data into AI tools
Staff pasting pricing, code or client data into public AI tools may undermine the "reasonable measures" limb and breach client confidentiality obligations. Set rules on which tools may be used, for which data, and under which contractual terms. Our article on who owns AI-generated content in the UAE covers the contract terms to check.
Cross-border angle
Information leaves the UAE easily. A former employee may move to Riyadh, London, Singapore or Dhaka, and a competitor may be incorporated abroad. Protecting trade secrets UAE companies hold then depends on where assets and people are, which court can grant effective relief, and whether a UAE judgment or award can be enforced there.
Choose governing law and dispute resolution clauses in NDAs and employment contracts with enforcement in mind. Arbitration may suit cross-border partners, while DIFC or ADGM jurisdiction clauses can give access to common-law injunctions. Where information passes through group companies, align intra-group confidentiality and data-sharing terms with the UAE data protection rules, including the Personal Data Protection Law where customer data is involved.
What to do next: a checklist
- List the five to ten categories of information that would hurt most if a competitor had them.
- Check that access to each category is limited, logged and reviewed.
- Review employment contracts, NDAs and supplier terms for specific confidentiality, return and assignment clauses.
- Re-draft non-competes so they meet the onshore limits or the applicable DIFC or ADGM standard.
- Adopt a written exit procedure for senior leavers, including same-day access revocation.
- Agree who responds to a suspected leak, and how evidence is preserved.
- Set a policy on AI tools and confidential data.
TRW & Co advises on protection programmes, contracts and leak response, and coordinates urgent applications. Where representation before UAE onshore courts or the DIFC or ADGM Courts is required, we work alongside locally licensed advocates and registered practitioners. To discuss trade secrets UAE protection for your business, contact our Dubai team or email info@trw.co.
Frequently asked questions
01Do I need to register a trade secret in the UAE?
No. Unlike patents, trade marks or designs, trade secrets are not registered with the Ministry of Economy and Tourism or any other authority. Protection exists for as long as the information remains secret, has commercial value because of its secrecy, and is protected by reasonable measures. That means the business must be able to prove its controls if a dispute arises: access restrictions, confidentiality agreements, marking, training and records of who could see the information. Registration-based rights such as patents can complement trade secret protection, but they require public disclosure, so the choice between them is strategic.
02What law protects trade secrets in the UAE?
Onshore, the main statute is Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights, which protects undisclosed information and provides civil and criminal remedies. The Labour Law, the Civil Transactions Law, the Crimes and Penalties Law and the cybercrime law add employment, contractual and criminal protection. In the DIFC, DIFC Law No. 4 of 2019 contains a dedicated trade secrets part. ADGM applies English common law, including the action for breach of confidence. The applicable route depends on where the parties are established and what the contracts say.
03Can a former employee use what they learned at my company?
Former employees may use their general skill, knowledge and experience, which belong to them. They may not use or disclose specific confidential information belonging to the employer, such as pricing data, customer pipelines, source code or technical processes, particularly where it was protected and identified as confidential. The line between the two is fact-specific and often disputed. Clear definitions in the employment contract, access logs and documented exit reminders make it far easier to show that particular information was the employer's trade secret rather than the employee's general know-how.
04How long can a non-compete last in the UAE?
Under the onshore Labour Law, a post-termination non-compete may last no more than two years after the contract ends and must be limited in place, time and type of work to what protects the employer's legitimate interests, such as access to clients or business secrets. In the DIFC and ADGM, which have their own employment laws, restrictive covenants are judged under contract and common law principles of reasonableness. In practice, confidentiality and non-solicitation clauses often provide more reliable protection than a broad non-compete.
05What can I do if an employee has taken confidential files?
Act quickly. Preserve devices, email and system logs; revoke access; and document what was taken and when. A letter requiring return, deletion and a signed undertaking often resolves the matter. If not, urgent relief such as precautionary seizure onshore or an injunction in the DIFC or ADGM Courts may be available, alongside claims for compensation. In serious cases, a criminal complaint under the industrial property, penal or cybercrime laws is possible. The right combination depends on the evidence, the forum and the commercial goal.
06Are trade secrets protected in the DIFC differently?
Yes. DIFC Law No. 4 of 2019 has its own trade secrets part with a three-limb test, a definition of misappropriation that reaches people who knew or ought to have known information was improperly obtained, and a three-year limitation period running from when misappropriation was or should reasonably have been discovered. Claims are heard by the DIFC Courts, which apply common-law style procedure and can grant injunctions. DIFC entities and contracts that choose DIFC jurisdiction can use this regime.
Sources and official materials
- Intellectual Property Legislations, Ministry of Economy and Tourism — Federal Law No. 11 of 2021 and related IP statutes
- Ministry of Human Resources and Emiratisation — Labour Law, confidentiality and non-compete rules
- DIFC Intellectual Property Law, DIFC Law No. 4 of 2019 — Trade secrets part and three-year limitation
- DIFC Courts — Forum for DIFC trade secret claims
- ADGM Legal Framework — English common law in ADGM
- UAE Legislation portal — Official federal laws, including the Civil Transactions Law
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
