A cyberattack can cost a company money, invite lawsuits, leak sensitive data, and hurt its reputation for years. In the UAE, cybersecurity is now as much a legal matter as a technical one. Federal laws, national policies, and sector rules all put obligations on companies that handle sensitive data or run digital services.
Banks, healthcare providers, tech firms, government contractors, and virtual asset businesses each have their own requirements. Knowing which ones apply to you is the first step to staying out of legal trouble and keeping your systems safe.
The starting point is Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, which came into force on January 2, 2022. It addresses unauthorized system access, data theft, online fraud, digital impersonation, and attacks that take networks offline. It also covers the misuse of private or confidential information.
In practice, companies need tight access controls, clear staff policies, proper security logs, and a set process for reporting cybercrime. Effective habits protect your systems and help preserve evidence if something goes wrong.
Then there is Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law (PDPL). It governs how personal data is used and protected: lawful use, consent where it’s required, purpose limits, data minimization, individual rights, and transfers of data out of the country.
Encryption, access controls, retention rules, and plain privacy notices are the usual way companies meet these requirements. Keep in mind that the law has certain exclusions, and that the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) each run their own data protection regimes. So before choosing which privacy rules to follow, a company has to work out its legal status and where it operates.
On February 3, 2025, the UAE Cabinet approved the National Cybersecurity Strategy. It rests on five pillars: governance, protection, innovation, national skills, and partnership. The goals are better cyber resilience, safer digital services, more local expertise, and closer cooperation between the public and private sectors.
The strategy doesn’t create a new certification requirement for every business, but it does show where national policy is heading, and companies will feel that in their own security practices.
The Critical Information Infrastructure Protection (CIIP) Policy matters too. A government publication update dated July 2, 2026 pointed again to the country’s focus on vital digital assets and essential services. The policy deals with identifying critical assets, reviewing cyber risk, putting security controls in place, responding to incidents, and restoring services.
Energy, transport, healthcare, finance, and telecommunications could all fall within its reach, depending on formal designation and the rules that apply. Don’t assume you’re covered, or exempt, without checking your own position.
The Dubai Electronic Security Center (DESC) issues the Information Security Regulation for Dubai Government entities. It addresses governance, risk control, technical safeguards, audits, and assurance.
Contractors and service providers who handle government data can end up bound by similar duties through their contracts or sector rules. Dubai also has its own security standards for Internet of Things (IoT) devices and electronic biomedical equipment.
In ADGM, the FSRA Cyber Risk Management Rules took effect on January 31, 2026. Covered financial firms must treat cyber risk as part of their wider business risk, and the rules touch on board oversight, supplier security, incident response, and operational resilience. ADGM guidance also sets a 24-hour deadline for notifying the Financial Services Regulatory Authority (FSRA) of certain material cyber incidents.
DIFC operates under Data Protection Law No. 5 of 2020. Amendments that took effect on July 15, 2025 gave affected individuals a private right of action in the DIFC Courts. That makes clear privacy notices, well-drafted data contracts, and careful handling of overseas transfers more important than before.
The Central Bank of the UAE (CBUAE) sets detailed information and communication technology (ICT) security rules for the institutions it licenses. Updates to Articles 8 and 9 took effect on September 14, 2026, covering cyber risk, access control, network security, supplier oversight, incident response, and disaster recovery.
Article 8.9 deals with keeping a financial institution’s Master System of Record up to date and stored in the UAE, with stated rules for foreign branches.
The Capital Market Authority (CMA) added Article 47 through Decision No. 04/2026, effective February 28, 2026. It requires a formal cyber risk framework with Board approval. The Virtual Assets Regulatory Authority (VARA) has its own technology and security rules for covered crypto firms, including wallet security, cryptographic keys, audits, staff responsibilities, and cyber incident response.
Also Read - AI Agents and Bank Accounts: 7 Security Risks to Know
The sensible place to begin is a legal review that matches each applicable law to the right business entity, license, and location. After that, a formal cyber risk assessment can show where the gaps are, whether in access control, cloud security, data privacy, supplier oversight, or incident response.
ISO/IEC 27001 gives you a solid structure for an information security management system, and the NIST Cybersecurity Framework 2.0 is useful for assessing and managing cyber risk. Neither one replaces your obligations under UAE law, though.
These rules put duties on business leaders, not only on IT teams. Good policies, regular audits, secure systems, trained staff, and recovery plans that have actually been tested all help a company meet its legal obligations and keep essential services running. What counts in the end is how quickly you can respond when a threat shows up, and whether customers still trust you afterwards.