Cybersecurity law & regulation in UAE (2026)
Cybersecurity in UAE: comprehensive law.
The UAE operates a multi-layered cybersecurity regime anchored by Federal Decree-Law No. 34/2021 (in force January 2022), which criminalises unauthorised access, hacking, and infrastructure attacks, complemented by a mandatory 72-hour breach-notification duty under the Personal Data Protection Law (Federal Decree-Law No. 45/2021). A dedicated UAE Cybersecurity Council (established by Cabinet in 2020) oversees national coordination, and the Cabinet-approved National Cybersecurity Strategy 2025-2031 (February 2025) sets a whole-of-government active-defence agenda backed by over $2 billion in investment.
Legal framework
UAE Cybersecurity Council + Federal Decree-Law No. 34/2021 (Cybercrime Law) + Federal Decree-Law No. 45/2021 (PDPL) + Signals Intelligence Agency (formerly NESA) Information Assurance Standards + National Cybersecurity Strategy 2025-2031
Key points: cybersecurity in UAE
Primary Cybercrime Law
Federal Decree-Law No. 34 of 2021 on Combatting Rumors and Cybercrimes (effective 2 January 2022) is the UAE's foundational cybersecurity statute, criminalising hacking, unauthorised access, infrastructure attacks, and AI/deepfake-enabled fraud; executives face personal criminal and civil liability for negligent cybersecurity governance.
Data Protection & Breach Notification
Federal Decree-Law No. 45/2021 (PDPL) mandates notification of personal data breaches to the UAE Data Office within 72 hours of discovery, with further notification to affected data subjects where risk is significant; administrative fines reach AED 5 million for non-compliance.
Critical Infrastructure Standards (SIA/NESA)
The National Electronic Security Authority (NESA), now operating as the Signals Intelligence Agency (SIA), enforces mandatory Information Assurance Standards for government entities and operators of critical national infrastructure across energy, water, transport, banking, and telecoms sectors; non-compliance carries regulatory sanctions.
National Cybersecurity Strategy 2025-2031
Approved by the UAE Cabinet on 3 February 2025 and published in September 2025, the strategy shifts national posture from capacity-building to active defence across five pillars: cybersecurity governance and risk management, national cyber resilience and defence, secure digital transformation, emerging-technology security, and ecosystem partnerships.
Sector-Specific Incident Reporting
Licensed financial institutions must notify the Central Bank of the UAE (CBUAE) of significant breaches affecting consumer data and notify affected consumers where financial or personal security is at risk; the Telecommunications and Digital Government Regulatory Authority (TDRA) requires prompt major-incident notification from telecoms operators.
UAE Cybersecurity Council & Incident Coordination
The UAE Cybersecurity Council, established by Cabinet resolution in November 2020, coordinates the National Cyber Incident Response Plan and oversees the broader legal and regulatory framework; organisations across sectors are required to report cyber incidents promptly to the Council or the relevant sector regulator.
Timeline of decisions
- IncidentUAE Cybersecurity Council Discloses Foiled Wave of AI-Backed Attacks on Vital Sectors
The UAE Cybersecurity Council announced it had thwarted a series of AI-augmented cyberattacks targeting the country's digital infrastructure and vital sectors, warning of a 'qualitative shift' in threat methodology by hostile actors. The incident accelerated inter-agency coordination and reinforced the AI-specific defensive mandates embedded in the 2025-2031 national strategy.
Bloomberg
- Guidance · officialUAE National Cybersecurity Strategy 2025-2031 Published
The UAE Cabinet approved the National Cybersecurity Strategy 2025-2031, structured around five pillars (governance, protection, innovation, capacity-building, and partnership) and backed by a $2 billion investment mandate; it shifts posture from capacity-building to active defence, expands compliance obligations to supply-chain participants, and integrates AI/ML security as a first-class requirement across all regulated sectors.
UAE Cabinet (uaecabinet.ae)
- Guidance · officialUAE Information Assurance Standard Version 2 (IAS v2) Released
The UAE Cybersecurity Council published a comprehensively revised Information Assurance Standard (v2, later v2.1) replacing the decade-old NESA IAS; it introduces 15 security-control families spanning management (M1-M6) and technical (T1-T9) domains, adds post-quantum cryptography, threat intelligence, and secure software engineering requirements, and integrates directly with seven National Cybersecurity Policies including Cloud, IoT, and AI/ML security. Compliance is mandatory for all government bodies and critical-infrastructure operators.
UAE Cybersecurity Council (csc.gov.ae)
- Guidance · officialNational Cloud Security Policy Established
The UAE Cybersecurity Council issued the National Cloud Security Policy, setting mandatory security requirements, covering data residency, access controls, encryption, and third-party vendor assessments, for government entities and critical-sector operators adopting cloud services; the policy forms part of a suite of seven thematic national cybersecurity policies underpinning the Information Assurance Standard framework.
UAE Government Portal (u.ae)
- Law · officialCabinet Decision No. 111 of 2023, PDPL Executive Regulations Impose Cybersecurity Obligations
The Cabinet issued Executive Regulations under the 2021 Personal Data Protection Law, mandating concrete technical controls for any organisation processing personal data: AES-256 encryption at rest, TLS 1.2+ in transit, multi-factor authentication, Data Protection Impact Assessments for high-risk processing, and a 72-hour breach notification duty to the UAE Data Office; a six-month grace period applied, with full enforcement expected by January 2027.
UAE Government Portal (u.ae)
- Law · officialFederal Decree-Laws No. 34/2021 (Cybercrime) and No. 45/2021 (PDPL) Enacted, Effective 2 January 2022
On the same date, the UAE enacted two landmark instruments: Decree-Law No. 34 of 2021 overhauled the cybercrime regime (replacing the 2012 law) criminalising hacking, phishing, ransomware, identity theft, and spread of false information, with extra-territorial reach covering crimes planned or directed from the UAE; simultaneously Decree-Law No. 45 of 2021 established the UAE's first federal personal data protection law, requiring security-by-design and incident response obligations; both laws took effect 2 January 2022.
UAE Legislation Portal (uaelegislation.gov.ae)
- Decision · officialUAE Cybersecurity Council Established by Cabinet
The UAE Cabinet created the UAE Cybersecurity Council as the central national cybersecurity authority, absorbing the functions of NESA; the Council is chaired by the UAE Government's Head of Cyber Security and is mandated to develop national strategy, build a comprehensive legal and regulatory framework, and operate a National Cyber Incident Response Plan, consolidating previously fragmented oversight under a single body.
UAE Government Portal (u.ae)
- Guidance · officialTRA Launches UAE National Cybersecurity Strategy 2019
The Telecommunications Regulatory Authority published the first dedicated National Cybersecurity Strategy, built on 5 pillars and 60 initiatives including a national cyber-incident response plan and protection of nine critical-infrastructure sectors, setting the strategic baseline for subsequent legislative and enforcement activity.
TDRA
- Guidance · officialUAE National Cybersecurity Strategy 2019 Launched
The UAE launched its first comprehensive National Cybersecurity Strategy, establishing a risk-based framework to protect government systems, critical national infrastructure, and the digital economy across six strategic pillars; it laid the governance and policy foundations that were subsequently operationalised through the creation of the UAE Cybersecurity Council in 2020.
UAE Government Portal (u.ae)
- Law · officialFederal Decree-Law No. 5 of 2012 on Combating Cybercrimes
The UAE enacted Federal Decree-Law No. 5 of 2012, replacing the 2006 law with significantly expanded coverage: it removed intent as a prerequisite for many offences, increased criminal penalties, added new categories of cybercrime (including attacks on critical infrastructure and electronic systems), and was published in full by TDRA as the operative cybercrime statute until superseded in 2022.
TDRA (tdra.gov.ae)
- Law · officialFederal Law No. 2 of 2006 on Prevention of Information Technology Crimes, UAE's First Cybercrime Law
The UAE became the first Arab country to enact a dedicated IT-crimes statute, criminalising unauthorised system access, electronic fraud, and data interference with imprisonment of at least one year and fines from AED 10,000, laying the legislative foundation for all subsequent UAE online-safety regulation.
WIPO Lex
- Law · officialFederal Law No. 2 of 2006, UAE's First Dedicated Cybercrime Law
The UAE enacted Federal Law No. 2 of 2006 on the Prevention of Information Technology Crimes, making the UAE the first Arab country to pass a standalone cybercrime statute; the 27-article law criminalised unauthorised system access, data interception, electronic fraud, and misuse of information technology, establishing the foundational legal framework for prosecuting digital offences that all subsequent legislation has built upon.
UAE Government Portal — Cyber Laws (u.ae)
Sources
- uaelegislation.gov.ae/en/legislations/1526/download
- u.ae/en/information-and-services/justice-safety-and-the-law/cyber-safety-a
- uaecabinet.ae/en/news/uae-cabinet-approves-national-cybersecurity-strategy-api-firs
- mediaoffice.ae/en/news/2025/february/03-02/mohammed-bin-rashid-chairs-cabinet-meetin
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/uae/topics/security-
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
- menacyberwire.com/post/uae-nesa-cybersecurity-framework-explained-2026
- iconnectitbs.com/nesa-compliance-uae/
- eventussecurity.com/uae/national-cybersecurity-strategy/
Next for UAE: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026