Civil Law and UAE: Preservation of Digital Evidence Strategy

1. Introduction

Digital evidence has become central to UAE civil and commercial disputes.

Contracts, emails, WhatsApp messages, Teams communications, electronic signatures, cloud records, CCTV, GPS information, accounting databases, blockchain records, photographs, metadata and system logs may all become relevant to a civil claim.

However, finding digital evidence is not the same as preserving digital evidence.

Preservation means taking reasonable and legally appropriate steps to ensure that potentially relevant electronic information:

is not deleted;

is not overwritten;

is not altered;

remains accessible;

retains its metadata;

can be authenticated;

can be traced to its source; and

can ultimately be produced before the court in a reliable form.

The UAE's Federal Decree-Law No. 35 of 2022 on Evidence expressly recognizes electronic evidence. Article 53 defines electronic evidence broadly, while Article 54 includes electronic records, electronic instruments, electronic signatures, electronic correspondence, modern communications and electronic media. Articles 55–60 establish its evidential treatment and methods of production.

Therefore, a proper digital-evidence strategy should begin before litigation becomes fully developed.

2. Meaning of Digital Evidence Preservation

Digital evidence preservation is the process of maintaining potentially relevant electronic information in a form that preserves its:

A. Authenticity

Evidence must be capable of being connected to its claimed source.

B. Integrity

The evidence should remain materially unchanged.

C. Reliability

The method by which the evidence was created, stored and retrieved should be capable of explanation.

D. Accessibility

The evidence should remain retrievable when required.

E. Metadata

Relevant information concerning creation, modification, transmission, location and other characteristics should not unnecessarily be destroyed.

F. Chain of custody

There should be a defensible record of who collected, copied, stored, transferred and examined the evidence.

The basic formula is:

Identify → Preserve → Collect → Authenticate → Analyse → Produce

3. Current UAE Legal Framework

Federal Evidence Law No. 35 of 2022

The principal federal evidence legislation is Federal Decree-Law No. 35 of 2022 Promulgating the Law of Evidence in Civil and Commercial Transactions.

The Law came into force on 2 January 2023.

Article 53

Electronic evidence includes evidence derived from data or information:

generated;

stored;

extracted;

copied;

transmitted;

reported; or

received

through information technology, provided it can be retrieved in an understandable manner.

This definition is deliberately broad.

4. Types of Digital Evidence

Article 54 recognizes numerous forms of electronic evidence, including:

electronic records;

electronic instruments;

electronic signatures;

electronic seals;

electronic correspondence;

modern means of communication;

electronic media; and

other electronic evidence.

Consequently, a preservation strategy should not be limited to emails.

It should potentially cover:

WhatsApp;

SMS;

Microsoft Teams;

Slack;

Zoom records;

cloud storage;

SharePoint;

OneDrive;

Google Drive;

CRM systems;

accounting systems;

ERP records;

mobile phones;

laptops;

servers;

databases;

CCTV;

access-control systems;

GPS;

photographs;

videos;

audio recordings;

blockchain transactions;

social-media communications;

electronic invoices;

electronic signatures; and

system-generated logs.

5. Why Preservation Is Different from Collection

A common mistake is to immediately collect everything.

The first question should be:

What information needs to be preserved so that relevant evidence is not lost?

Preservation normally comes first.

For example, suppose an employee leaves a company after allegedly copying confidential information.

The company may need to preserve:

the employee's laptop;

mobile device;

email account;

Teams account;

OneDrive;

SharePoint;

USB-device logs;

access logs;

cloud activity;

relevant documents;

deletion logs.

If the company immediately wipes the laptop, resets the account and reallocates the device, potentially important evidence may disappear.

6. Legal Significance of Integrity

Digital evidence can be copied perfectly many times.

Therefore, merely producing a screenshot does not necessarily answer all evidentiary questions.

The court may need to understand:

where the evidence originated;

whether the original data still exists;

how it was extracted;

whether metadata was preserved;

whether the screenshot accurately represents the underlying record;

whether the record was altered;

who controlled the account;

whether the communication is complete; and

whether the relevant device or system can corroborate it.

The preservation strategy should therefore preserve the underlying digital environment, where reasonably possible, rather than only the visible content.

7. Original Format

Article 60 of the Evidence Law provides that electronic evidence may be produced in its original format or through another electronic means, and the court may request its content in writing where its nature permits.

This has an important practical consequence.

A party should not automatically convert everything into:

PDF → print → scan → PDF

because such conversion may remove:

metadata;

timestamps;

embedded information;

system identifiers;

audit information;

digital-signature information.

The original electronic source should therefore be preserved whenever reasonably possible.

8. Preservation of Metadata

Metadata may provide information concerning:

date created;

date modified;

author;

sender;

recipient;

device;

file path;

document version;

location;

access;

modification;

transmission;

system activity.

For example, an email screenshot may show:

“Send this document tomorrow.”

But the underlying email record may also establish:

the sender's actual account;

exact timestamp;

recipient;

message ID;

attachments;

server information;

reply chain.

Therefore:

Content without context can be weaker than preserved original data.

9. Legal Hold Strategy

A legal hold is an internal preservation instruction requiring relevant personnel and systems to preserve potentially relevant information.

A UAE civil-litigation legal hold should identify:

Persons

directors;

employees;

consultants;

contractors;

finance personnel;

IT personnel.

Systems

email;

cloud storage;

CRM;

ERP;

messaging platforms;

mobile devices;

laptops;

servers.

Time period

For example:

1 January 2025 – 30 September 2026.

Subject matter

For example:

All communications concerning the disputed supply agreement.

The legal hold should be documented.

10. Suspension of Automatic Deletion

Digital systems routinely delete or overwrite information.

Examples:

email retention periods;

CCTV overwriting;

automatic cloud deletion;

employee account deletion;

mobile-device replacement;

database retention policies;

backup rotation.

Once litigation or a serious dispute is reasonably anticipated, the organization should consider whether routine deletion needs to be suspended for relevant information.

This is one of the most important elements of preservation.

11. Preservation Order

In appropriate proceedings, a court may issue an order preventing destruction or interference with relevant electronic evidence.

A particularly clear example appears in AES Middle East Insurance Broker LLC v GSB Capital Ltd.

The DIFC Court made a preservation order preventing the respondent from:

deleting;

destroying;

interfering with;

tampering with;

copying;

transferring; or

parting with possession or control

of specified electronic records, including metadata.

This is highly relevant to a UAE digital-evidence preservation strategy.

12. Case Law 1 — AES Middle East Insurance Broker LLC v GSB Capital Ltd, DIFC CFI 060/2023

This is one of the most important authorities for digital-evidence preservation.

The dispute involved confidential information allegedly obtained from former employees.

The DIFC Court issued a preservation order covering electronic documents and records, expressly including metadata.

Later disclosure involved an enormous electronic dataset.

The defendant's e-discovery provider obtained data from:

Outlook;

OneDrive;

SharePoint;

Microsoft Teams;

individual electronic devices.

The dataset exceeded 2 million documents, and AI-based technology was used to identify potentially relevant images before human review.

Principle

Digital preservation must be sufficiently broad to prevent destruction of relevant electronic records and metadata.

Practical importance

A preservation strategy should cover both:

documents

and

the surrounding digital information needed to authenticate and interpret them.

13. Case Law 2 — ICICI Bank Ltd v Bavaguthu Raghuram Shetty, DIFC CFI 034/2022

This case concerned disputed guarantees and electronic/copy signatures.

The Court considered:

wet-ink signatures;

electronically applied signatures;

expert handwriting evidence;

documentary evidence;

authorization; and

surrounding circumstances.

The Court emphasized that an electronic/copy signature was not automatically evidence of forgery. The real question included whether the signature had been applied or authorized by the alleged signatory.

Preservation lesson

Where an electronic signature is disputed, preservation should extend beyond the final signed PDF.

Where available, preserve:

signature records;

authentication records;

audit trails;

email transmission;

account information;

system logs;

related documents;

authorization records.

Principle

Preserving the surrounding digital evidence can be as important as preserving the electronic document itself.

14. Case Law 3 — Bank of Baroda (DIFC Branch) v Neopharma LLC & Others, DIFC CFI 043/2020

This case concerned disputed signatures and forensic document evidence.

The Court considered competing expert evidence and placed significant weight on the expert whose methodology was explained and supported by examination of contemporaneous documents.

The opposing expert's evidence was rejected because it contained vague and unsupported conclusions and methodological deficiencies.

Preservation lesson

A preservation strategy should maintain the original material needed for forensic examination.

If the original document or digital source disappears and only a screenshot or low-quality copy remains, the ability of an expert to examine it may be significantly reduced.

Principle

Preservation must preserve evidentiary quality, not merely evidentiary appearance.

15. Case Law 4 — Naima v Nadine, DIFC SCT 112/2024

This case involved an online professional network and a digital membership agreement.

The claimant relied on:

website terms;

online registration;

digital acceptance;

payment arrangements;

electronic subscription information.

The Court found that the defendant had accepted the online terms and ordered payment of the outstanding membership amount.

Preservation lesson

For online contracts, a preservation strategy should capture:

terms and conditions as they existed at the relevant date;

registration records;

acceptance records;

timestamps;

payment records;

account information;

website version;

confirmation emails.

Principle

Preserve the digital transaction environment, not merely a later screenshot of the webpage.

16. Case Law 5 — Alawwal Capital JSC v Rasmala Investment Bank Ltd, DIFC CFI 038/2023

This authority is relevant to large-scale electronic disclosure.

The case demonstrates the difficulty of dealing with substantial electronic records and the need to approach electronic disclosure through considerations of:

relevance;

proportionality;

organization;

search methodology; and

review.

Preservation lesson

Preservation should be broad enough to prevent loss but structured enough to avoid unnecessary destruction or uncontrolled alteration of data.

Principle

A defensible preservation system should be systematic, documented and proportionate.

17. Case Law 6 — DNB Bank ASA v Gulf Eyadah Corporation & Gulf Navigation Holding PJSC, DIFC CA 007/2015

This case concerned recognition and enforcement of an English judgment in the DIFC.

Although it was not principally a digital-evidence case, it illustrates an important cross-border evidence principle.

Where proceedings involve different jurisdictions, parties must carefully preserve:

foreign judgments;

court records;

certified copies;

electronic communications;

procedural documents;

authentication records.

Preservation lesson

Digital evidence may have to travel between jurisdictions.

Therefore, preservation must account for:

authenticity;

certification;

jurisdiction;

translation;

chain of custody;

admissibility.

Principle

Cross-border digital evidence requires both technical integrity and legal authentication.

18. Case Law 7 — Klesta Eshja & Hair Creators Salon LLC v Salah Masri & Others, DIFC CFI 066/2024

This is an important modern technology-related authority.

The dispute involved AI-generated legal material and inaccurate or misleading references.

The DIFC Courts have separately issued guidance emphasizing that AI-generated material should be verified for accuracy and reliability and that parties should be transparent about AI use. The Court may reject AI-generated content under the applicable rules.

Preservation lesson

When AI is used to process evidence, parties should preserve:

original source files;

original metadata;

search methodology;

AI-processing records where relevant;

human review records;

versions of extracted evidence.

Principle

AI-assisted evidence processing does not eliminate the need to preserve the underlying human-verifiable source evidence.

19. Case Law 8 — AES: AI-Assisted Evidence Review

The AES proceedings deserve separate attention because they show how digital preservation and modern technology interact.

The disclosure exercise involved more than two million documents.

Images were filtered using an AI-driven application to identify potentially relevant material, after which potentially relevant documents were manually reviewed. Attachments and document families were also disclosed when relevant documents were identified.

Importance

This illustrates a modern evidence model:

Large Dataset → Technology-Assisted Filtering → Human Review → Disclosure

not:

AI → Automatic Legal Decision

20. Digital Chain of Custody

A good preservation strategy should maintain a chain of custody.

Example:

The objective is to demonstrate:

What was collected, when, by whom, how and whether it was altered.

21. Hash Values

A hash is a digital fingerprint of a file or dataset.

A forensic investigator can calculate a hash value when collecting evidence.

If the same file is later hashed and the value remains identical, that supports the proposition that the file has not changed.

For example:

Original File → SHA-256 Hash → Secure Storage → Later Verification

Hashing does not by itself prove:

who created the document;

who sent it;

whether the original creator was authorized;

whether the underlying statement is true.

It primarily assists with integrity verification.

22. Screenshots: Useful but Limited

Screenshots can be valuable.

For example:

WhatsApp conversation;

website page;

social-media post;

online account;

dashboard.

But a screenshot may not preserve:

original metadata;

complete conversation;

deleted messages;

account history;

system logs;

source information;

modification history.

Therefore:

Screenshot + underlying source + metadata + authentication evidence

is generally a stronger preservation strategy than screenshot alone.

23. Email Preservation Strategy

For important emails, preserve:

original email;

sender;

recipient;

CC/BCC where available;

date and time;

subject;

attachments;

message headers;

server information;

mailbox location;

relevant replies;

associated metadata.

Do not rely exclusively on:

“Print → PDF”.

24. WhatsApp and Messaging Applications

Messaging evidence creates special preservation problems because:

messages can be deleted;

accounts can change;

devices can be replaced;

cloud backups may change;

users may switch phones;

timestamps may be affected by device settings;

exported chats may not contain every underlying system record.

A preservation strategy should therefore consider:

original device;

chat export;

screenshots;

relevant media;

backup records;

timestamps;

contact identity;

associated email/cloud information;

forensic extraction where proportionate and lawful.

25. Cloud Evidence

Cloud evidence creates an additional problem.

The evidence may not physically exist on the company's premises.

Examples:

Microsoft 365;

OneDrive;

SharePoint;

Teams;

Google Workspace;

cloud accounting;

SaaS applications.

The AES case is particularly instructive because the disclosure process involved Microsoft 365, Outlook, OneDrive, SharePoint, Teams and individual devices.

Strategy

Identify:

User → Account → Cloud Platform → Data → Metadata → Retention Policy

26. CCTV Preservation

CCTV is highly vulnerable to automatic deletion.

A system might overwrite recordings after:

7 days;

14 days;

30 days;

another defined period.

Therefore, where an incident occurs:

identify the camera;

identify the relevant date/time;

issue an immediate preservation instruction;

export the original recording;

preserve relevant surrounding footage;

retain system metadata;

record who extracted the footage;

preserve the extraction method.

A 30-second clip may be misleading if the preceding and subsequent footage is destroyed.

27. Database and System Logs

System logs can establish:

login;

logout;

access;

deletion;

modification;

download;

upload;

IP address;

system activity.

A preservation strategy should therefore include relevant logs where they may be material.

For example:

“Employee X deleted the file.”

A file may no longer exist.

But:

Deletion log + access log + backup + device evidence

may still establish what happened.

28. Blockchain and Digital Assets

Blockchain evidence presents a different preservation model.

A transaction may be independently recorded on a distributed ledger.

Preservation may include:

wallet address;

transaction hash;

block number;

timestamp;

blockchain network;

smart-contract address;

transaction data;

exchange records;

custody records.

The blockchain record should be preserved together with evidence connecting:

Blockchain address → person/entity → transaction → legal claim

A transaction hash alone does not necessarily prove who controlled the relevant wallet.

29. Electronic Signature Evidence

Electronic signature disputes require preservation of more than the signed document.

Preserve:

signed document;

signature certificate;

certificate chain;

authentication information;

timestamp;

signing platform;

audit trail;

IP information where legally available;

email invitation;

authentication records;

related correspondence.

The ICICI Bank v Shetty litigation demonstrates why the distinction between the signature itself and authorization for its use can become critical.

30. AI-Assisted Evidence Preservation

AI can assist in:

deduplication;

document classification;

relevance screening;

image identification;

anomaly detection;

translation;

OCR;

searching large datasets.

But AI should not replace preservation of the original evidence.

The DIFC Courts' guidance emphasizes transparency, accuracy, reliability, verification and awareness of potential bias when AI-generated material is used in proceedings.

Therefore:

AI may help find evidence; it should not become the only surviving representation of the evidence.

31. Preservation and Privacy

Digital preservation must also consider privacy and data-protection obligations.

A company should not assume:

“Litigation means we can collect everything.”

A proper strategy should consider:

relevance;

proportionality;

confidentiality;

personal data;

privileged information;

third-party information;

cross-border transfers;

access controls.

Preservation and privacy therefore need to operate together.

32. Preservation and Legal Privilege

Potentially privileged material should be identified and protected.

For example:

lawyer-client correspondence;

litigation strategy;

legal advice;

expert communications where privileged;

internal legal assessments.

A preservation process should avoid unnecessary disclosure of privileged material while ensuring that relevant evidence is not destroyed.

33. Employee Departure

Employee departure is a major digital-evidence risk.

Where litigation is reasonably anticipated, the organization should consider preserving:

departing employee's email;

laptop;

mobile phone where lawfully appropriate;

cloud account;

Teams/Slack;

file-access logs;

USB records;

downloads;

external sharing;

deletion events.

The preservation should occur before routine account deletion.

34. Litigation Hold Notice

A litigation-hold notice should generally communicate:

1. Subject matter

What dispute is involved?

2. Relevant period

Which dates matter?

3. Relevant custodians

Who may possess evidence?

4. Relevant systems

Where is the evidence stored?

5. Preservation duty

What must not be deleted?

6. Suspension

Which automatic deletion procedures must be suspended?

7. Contact

Who handles preservation questions?

35. Preservation of Evidence Held by Third Parties

Sometimes the evidence is controlled by:

banks;

telecom providers;

cloud providers;

social-media platforms;

payment processors;

logistics companies;

website operators.

The party should identify the third-party evidence early because external retention periods may be short.

Where necessary, appropriate court orders or procedural mechanisms may be required.

36. Evidence Destruction and Adverse Consequences

Destruction of potentially relevant evidence can create serious procedural problems.

The central concerns are:

intentional destruction;

reckless destruction;

failure to comply with a preservation order;

inability to produce original evidence;

unexplained gaps;

inconsistent metadata;

suspicious alteration.

The more important the evidence and the more obvious the preservation obligation, the greater the litigation risk.

37. Digital Evidence Preservation Checklist

Before litigation

Identify likely disputes.

Identify custodians.

Identify systems.

Map data locations.

Review retention periods.

Preserve critical evidence.

Document the preservation process.

When litigation becomes likely

Issue legal hold.

Suspend relevant automatic deletion.

Preserve devices.

Preserve cloud data.

Preserve emails.

Preserve messages.

Preserve logs.

Preserve CCTV.

Preserve metadata.

During collection

Use appropriate forensic methods.

Record chain of custody.

Calculate hashes where appropriate.

Keep originals protected.

Work from verified copies.

Document methodology.

Before production

Review relevance.

Review privilege.

Review confidentiality.

Check completeness.

Check metadata.

Authenticate important evidence.

Preserve an evidence-production record.

38. Preservation Matrix

39. Seven Core Principles

Principle 1 — Preserve Early

The longer a party waits, the greater the risk of deletion or overwriting.

Principle 2 — Preserve the Original

Do not rely exclusively on screenshots or printed copies.

Principle 3 — Preserve Metadata

Metadata may establish authenticity and chronology.

Principle 4 — Preserve Context

An isolated message may have a different meaning from the complete conversation.

Principle 5 — Document Chain of Custody

The court should be able to understand how the evidence reached the litigation.

Principle 6 — Use Technology Carefully

AI and forensic tools may assist review, but human verification remains important.

Principle 7 — Balance Preservation with Privacy

Preservation should be targeted, lawful and proportionate.

40. Relationship Between Evidence Law and Civil Law

Digital evidence is primarily an evidentiary mechanism, but it can determine substantive civil-law outcomes.

For example:

Contract

Email + electronic signature → proves agreement.

Tort

CCTV + GPS + system logs → proves conduct and causation.

Fraud

Bank records + messages + metadata → establishes transaction pattern.

Employment

Emails + access logs → establishes misuse of confidential information.

Property

Electronic registration + payment records → establishes transaction history.

Banking

Digital authorization + audit trail → establishes execution.

Therefore:

Digital evidence is the bridge between factual events and civil-law rights.

41. Difference Between Preservation and Authentication

These should not be confused.

Preservation

Asks:

Was the evidence kept safely and without alteration?

Authentication

Asks:

Is this evidence what the party claims it is?

Admissibility

Asks:

Can the court legally receive and rely upon it?

Weight

Asks:

How persuasive is the evidence?

Thus:

Preservation → Authentication → Admissibility → Weight

42. Important Current UAE Rule

Under Articles 55–60 of the Federal Evidence Law, electronic evidence is integrated into the general documentary-evidence framework, and electronic evidence can be produced in original or appropriate electronic form.

Article 58 is particularly significant because the party alleging invalidity of specified electronic evidence bears the burden of proving that allegation.

This makes the initial integrity and reliability of preserved evidence extremely important.

43. Mainland UAE Courts and DIFC/ADGM

A distinction must always be made.

Mainland UAE

Federal Evidence Law No. 35 of 2022 provides the principal federal evidentiary framework for civil and commercial transactions.

DIFC

DIFC has its own procedural and evidentiary framework, and its courts have developed substantial jurisprudence concerning electronic disclosure, preservation, electronic signatures and digital evidence.

ADGM

ADGM operates under its own legal framework and procedural rules.

Therefore:

A DIFC judgment concerning electronic disclosure should not automatically be treated as binding precedent on an onshore UAE court.

It may nevertheless provide useful persuasive or comparative guidance.

44. Six Important Authorities — Quick Revision

45. Practical UAE Digital Evidence Strategy

A strong strategy can be remembered as:

I-P-S-C-A-P

I — Identify

Identify potentially relevant data.

P — Preserve

Stop relevant deletion and alteration.

S — Secure

Secure devices, accounts, cloud systems and originals.

C — Collect

Use appropriate forensic or technical methods.

A — Authenticate

Establish source, integrity and authorization.

P — Produce

Produce the evidence in an appropriate legally usable form.

46. Advanced Formula

For examination purposes:

SOURCE + INTEGRITY + METADATA + CUSTODY + AUTHENTICATION = STRONG DIGITAL EVIDENCE

And for litigation management:

TRIGGER → LEGAL HOLD → PRESERVATION → COLLECTION → REVIEW → PRODUCTION

47. Common Mistakes

Mistake 1

Keeping only screenshots.

Mistake 2

Deleting the original after making a PDF.

Mistake 3

Failing to preserve metadata.

Mistake 4

Allowing automatic deletion to continue.

Mistake 5

Failing to preserve the entire relevant conversation.

Mistake 6

Changing or resetting a relevant device.

Mistake 7

Using AI to summarize evidence and then destroying the original dataset.

Mistake 8

Failing to document chain of custody.

Mistake 9

Collecting excessive irrelevant personal data without considering privacy.

Mistake 10

Assuming an electronic signature automatically proves authorization.

48. Conclusion

The UAE's modern evidence framework recognizes digital information as a legitimate and important form of evidence. Federal Decree-Law No. 35 of 2022 expressly covers electronic records, electronic signatures, emails, modern communications and electronic media.

The most important lesson from UAE and DIFC jurisprudence is that digital evidence should be preserved as an evidentiary system, not merely as a screenshot or isolated file.

A reliable strategy therefore preserves:

the original source;

relevant metadata;

surrounding communications;

system records;

audit trails;

devices where appropriate;

cloud records;

chain of custody;

authentication information; and

the methodology used to collect and analyse the material.

The AES litigation demonstrates the importance of preservation orders and metadata; ICICI Bank v Shetty demonstrates the importance of preserving evidence surrounding electronic signatures; Bank of Baroda v Neopharma demonstrates the importance of reliable forensic methodology; and Naima v Nadine demonstrates the evidential importance of preserving the digital contracting environment.

One-line exam answer

Preservation of digital evidence in UAE civil law is the systematic protection of relevant electronic records, metadata, devices, communications and system information from loss or alteration so that their authenticity, integrity, reliability and admissibility can be demonstrated before the court.

Memory Formula

DIGITAL EVIDENCE = PRESERVE + PROTECT + PROVE + PRODUCE