Civil Law And UAE Privacy vs Disclosure Balancing in Civil Litigation

1. Introduction

Privacy versus disclosure balancing is the process by which a UAE court determines how far a party must disclose documents, personal information, electronic communications, financial records or other evidence while protecting legitimate privacy, confidentiality and data-protection interests.

The central problem is:

A litigant must have sufficient evidence to prove or defend a civil claim, but litigation should not become a licence to disclose irrelevant or unnecessarily sensitive private information.

In the UAE, this balance is particularly important because civil litigation increasingly involves emails, WhatsApp messages, financial records, employee information, CCTV, cloud data, personal-data records and AI-generated or electronically stored evidence.

There is no single UAE statutory rule called a "privacy-versus-disclosure balancing test." Instead, the issue is addressed through a combination of civil-procedure rules, evidence law, privacy/data-protection legislation, confidentiality principles and judicial discretion.

For current mainland UAE civil-law analysis, the Federal Decree by Law No. 25 of 2025 on the Civil Transactions Law, effective from 1 June 2026, must be kept in mind. Historical cases decided under the 1985 Civil Transactions Law remain useful for principles, but their compatibility with the new legislation should be checked.

2. Meaning of Privacy Versus Disclosure

Privacy

Privacy protects information relating to a person or entity that should not unnecessarily be exposed to others.

Examples include:

personal identification information;

family information;

medical information;

private correspondence;

bank and financial information;

employment records;

photographs;

location information;

passwords and credentials;

personal electronic communications;

confidential business information.

Disclosure

Disclosure means providing relevant documents or information to the opposing party or the court for purposes of resolving the dispute.

Examples include:

contracts;

invoices;

bank statements;

emails;

WhatsApp communications;

accounting records;

photographs;

expert reports;

corporate records;

electronic logs.

The balancing problem

The court therefore asks:

Is the requested information sufficiently relevant and necessary to justify the interference with privacy or confidentiality?

The answer normally depends on relevance, materiality, necessity, proportionality, confidentiality, procedural fairness and the availability of less intrusive alternatives.

3. UAE Legal Framework

A. Civil Transactions Law

Civil liability and protection of personal interests operate within the broader UAE civil-law framework.

The new Federal Decree by Law No. 25 of 2025 on the Civil Transactions Law, effective 1 June 2026, is now the principal mainland civil-law reference.

It should be read together with procedural and evidentiary legislation when a privacy issue arises during litigation.

B. Personal Data Protection Law

The Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) is particularly important.

The PDPL regulates the processing of personal data and contains requirements concerning:

lawful processing;

consent and its exceptions;

data security;

confidentiality;

data-subject rights;

risk assessment;

data protection impact assessments;

processing using modern technologies.

Importantly, the PDPL recognises circumstances in which processing may occur for legal claims, judicial proceedings and defence of legal rights. Thus, privacy protection does not automatically prevent the use of personal data in litigation.

The legal question becomes whether the disclosure is legally justified and appropriately limited.

4. Disclosure Is Not the Same as Unlimited Access

A crucial principle is:

The existence of relevant information does not automatically mean that every document containing that information must be disclosed in its entirety.

For example, suppose a defendant asks for:

"All emails concerning the claimant."

That request may be substantially broader than:

"Emails exchanged between the claimant and defendant concerning the disputed contract between January and March."

The second request is more closely connected to the dispute and causes less intrusion into unrelated private information.

This distinction is particularly important in modern electronic litigation.

5. Main Factors Used in Balancing

5.1 Relevance

The first question is whether the information has a genuine connection with an issue in dispute.

Irrelevant personal information should ordinarily not become discoverable merely because it exists.

5.2 Materiality

A document may be relevant but still have little practical importance.

For example:

a personal email mentioning a transaction in passing may be relevant;

the actual contractual correspondence may be materially more important.

Courts can therefore distinguish between useful evidence and information that merely provides background.

5.3 Necessity

The court may consider whether the information is genuinely necessary for determining the dispute.

If the same issue can be proved through:

a contract;

an invoice;

an expert report;

there may be less justification for producing extensive private correspondence.

5.4 Proportionality

Proportionality is particularly important.

The court can consider:

Importance of evidence ÷ degree of privacy intrusion

The greater the intrusion, the stronger the justification normally required.

5.5 Confidentiality

A document may contain:

trade secrets;

confidential financial information;

third-party personal data;

privileged communications;

commercially sensitive information.

The appropriate response may be redaction or restricted access, rather than complete refusal of disclosure.

5.6 Less Intrusive Alternatives

A court may consider whether privacy can be protected by:

redaction;

anonymisation;

confidentiality undertakings;

limited disclosure;

disclosure only to lawyers;

private hearing;

sealed documents;

restricted publication.

This is often preferable to an absolute choice between "full disclosure" and "no disclosure."

6. Privacy Does Not Automatically Defeat Evidence

A party cannot normally rely on the word "privacy" as a blanket objection to relevant evidence.

The important distinction is:

Legitimate privacy objection

The information is:

unrelated to the dispute;

excessively broad;

highly sensitive;

unnecessary;

available through a less intrusive method.

Weak privacy objection

The information is:

directly relevant;

material to liability;

necessary to establish a defence;

already properly before the court;

capable of being protected through redaction or confidentiality measures.

Therefore, privacy is generally a balancing consideration, not an automatic exclusionary rule.

7. Privacy and Electronic Evidence

The issue becomes especially complicated with:

WhatsApp;

Telegram;

emails;

cloud storage;

mobile phones;

social-media accounts;

CCTV;

workplace monitoring;

metadata;

GPS/location information;

AI systems.

For example, a WhatsApp conversation may contain both:

messages directly relevant to the contract; and

highly private conversations unrelated to the dispute.

The appropriate approach is usually to identify the relevant portion, rather than allowing unrestricted examination of the entire device.

8. Important Case Laws

Because reported mainland UAE appellate decisions specifically applying a standalone "privacy-versus-civil-disclosure balancing test" are limited, several of the clearest authorities come from the DIFC Courts. They are UAE authorities but must be identified as DIFC authorities, not automatically treated as binding mainland UAE precedents.

Case 1: DFSA v Commissioner of Data Protection & Anna Waterhouse

[2018] DIFC CFI 051 & CFI 085

This is one of the most important UAE authorities concerning personal data versus litigation disclosure.

Ms Waterhouse requested personal data held by the DFSA. At the same time, regulatory proceedings were already underway in which disclosure mechanisms existed.

The DIFC Court considered the relationship between:

data-subject access rights;

disclosure in litigation;

regulatory proceedings;

privacy;

proportionality.

The Court emphasised the important distinction between personal data and documents containing personal data.

A person having a right to personal data does not necessarily mean that the person automatically has a right to every document in which that data appears. (DIFC Courts)

Principle

Data-protection rights should not automatically be converted into a substitute for ordinary litigation disclosure.

The Court also considered whether there was a more appropriate route for obtaining the requested information through the existing proceedings.

Importance

This case is highly relevant to:

data-subject access requests;

civil disclosure;

regulatory litigation;

electronic documents;

privacy claims.

Case 2: R.E. Lee International (Middle East) Ltd v Imran Khan

[2023] DIFC CFI 087

The claimant applied for the proceedings to be conducted privately.

The DIFC Court refused the privacy application.

The Court considered the general principle of open justice and whether publication of allegations would cause significant or disproportionate harm.

The case demonstrates that a party's privacy or reputational concerns do not automatically override the public character of judicial proceedings. (DIFC Courts)

Principle

Privacy must be justified by sufficiently serious circumstances; ordinary sensitivity surrounding litigation is not automatically enough to make proceedings private.

Importance

This case is particularly useful when privacy is being asserted against:

public hearings;

publication of judgments;

open court proceedings;

allegations made during litigation.

Case 3: KPMG LLP v DFSA & Milind Ajit Navalkar v DFSA

[2022] DIFC CFI 008 & CFI 007

KPMG and Mr Navalkar challenged decisions concerning the privacy of regulatory proceedings.

The Court discussed the strong presumption in favour of transparency and public proceedings.

The decision is important because it explains that restrictions on publicity require a sufficiently strong justification and that privacy applications involve consideration of serious harm, unfairness and proportionality.

The judgment also discusses the open-justice principle and the circumstances in which documents placed before a tribunal may become subject to public access. (DIFC Courts)

Principle

The starting point is transparency; privacy is an exception requiring justification.

Importance

The case helps explain the relationship between:

confidentiality;

disclosure;

public access;

reputational harm;

proportionality.

Case 4: Arqaam Capital Ltd v DFSA

[2012] DIFC CFI 006

This case concerned proceedings before the Financial Markets Tribunal involving applications relating to both privacy/confidentiality and disclosure.

The Tribunal had ordered that the proceedings be heard publicly while refusing particular disclosure requests. The matter reached the DIFC Court. (DIFC Courts)

The relevant DIFC framework contained a presumption that proceedings and decisions would be public, while also providing mechanisms allowing confidential treatment of material.

Principle

The case demonstrates that:

Public proceedings and confidential treatment of particular information can coexist.

A court or tribunal does not necessarily have to choose between:

completely private proceedings; or

unrestricted disclosure.

It may impose narrower protections.

Importance

This is particularly useful for:

confidential commercial documents;

financial information;

regulatory proceedings;

restricted disclosure;

publication of judgments.

Case 5: Al Ramz Capital LLC v DFSA

[2025] DIFC CFI 087

Al Ramz sought to challenge a Financial Markets Tribunal privacy decision.

The FMT had rejected an application seeking private proceedings and restrictions on publication.

The DIFC Court refused permission to appeal.

The decision records that the applicable framework contained a strong presumption of regulatory transparency and that privacy required satisfaction of the applicable statutory requirements, including serious harm and proportionality. (DIFC Courts)

Principle

Commercial or reputational harm must be sufficiently demonstrated before the ordinary principle of transparency is displaced.

The case is especially relevant where disclosure may affect:

financial institutions;

market participants;

regulatory proceedings;

business reputation.

Case 6: Skatteforvaltningen v Elysium Global (Dubai) Ltd & Emerald Industries LLC

[2026] DIFC CFI 088/2025

This is a particularly useful and recent UAE authority.

The second defendant sought privacy because the proceedings involved serious allegations of fraud which it disputed.

The DIFC Court considered:

open justice;

reputational harm;

commercial damage;

privacy;

proportionality;

anonymisation;

redaction.

The Court stated that hearings are ordinarily public, but privacy can be ordered where necessary in the interests of justice. It also recognised that privacy may be limited rather than absolute. (DIFC Courts)

The Court ultimately directed that the jurisdiction challenge be heard privately, while providing for publication of the judgment, subject to possible anonymisation or redaction. (DIFC Courts)

Principle

This is an excellent example of graduated privacy protection.

The court did not simply say:

"Private or public."

Instead, it considered:

private hearing;

public judgment;

anonymisation;

redaction.

Importance

This illustrates modern judicial balancing in cases involving serious allegations and potential commercial/reputational harm.

Case 7: Al Soor Investments LLC v Julius Baer

[2022] DIFC CFI 088/2019

This case concerned an application for pre-action disclosure.

The DIFC Court explained that the applicant must identify the anticipated case with sufficient clarity and identify documents that are genuinely relevant and material.

The court rejected the idea that pre-action disclosure could become a broad investigative exercise.

The court emphasised the requirements under RDC 28.48, including whether disclosure would:

fairly dispose of anticipated proceedings;

assist settlement;

save costs.

(DIFC Courts)

Principle

Disclosure should be focused on identifiable relevant material rather than becoming a general investigation into another person's affairs.

Privacy significance

Although this is principally a disclosure case rather than a privacy case, it provides an important mechanism for protecting privacy: restrict the scope of disclosure at its source.

Case 8: Lunars v Liuns

[2022] DIFC CFI 042

The claimant sought pre-action disclosure partly to investigate whether it had a viable claim against particular defendants.

The Court refused the request.

It emphasised that pre-action disclosure cannot be used simply to discover whether a party has a case. The documents sought must be sufficiently identified and connected to the anticipated litigation. The Court also stressed that disclosure should not become disproportionate or create an investigative "train of inquiry." (DIFC Courts)

Principle

A disclosure request must have a defined litigation purpose; it cannot be used as unrestricted information gathering.

Privacy significance

This principle provides practical protection for:

personal data;

confidential business information;

third-party records;

private communications.

Case 9: Jonathan Lau v Qashio Holding Company Ltd

[2026] DIFC CFI 058

This recent DIFC decision provides further guidance on pre-action production.

The Court stressed that requests should be directed toward specific identifiable documents or narrowly defined categories.

Broad requests requiring extensive searches or merely generating possible lines of investigation are inappropriate.

The Court explained that documents must have a sufficient connection with the anticipated issues and that relevance and materiality must be demonstrated. (DIFC Courts)

Principle

Modern disclosure must be targeted, proportionate and connected to identifiable issues.

This is particularly valuable in disputes involving huge volumes of electronic data.

9. Case Law Table

10. Privacy vs Disclosure: Practical Balancing Test

A UAE court dealing with this problem can conceptually analyse the issue through the following sequence.

Step 1 — Is the information relevant?

If no, disclosure should ordinarily not be required.

Step 2 — Is it material?

Would the information potentially affect determination of an issue?

Step 3 — Is it necessary?

Can the issue be proved through less intrusive evidence?

Step 4 — What privacy interest exists?

Consider:

personal data;

medical information;

family information;

financial information;

confidential business information;

third-party information.

Step 5 — How serious is the intrusion?

A request for one contract is very different from unrestricted access to an individual's entire mobile phone.

Step 6 — Can disclosure be limited?

Possible methods include:

redaction;

anonymisation;

confidentiality orders;

restricted inspection;

sealed documents;

limited categories;

private hearing.

Step 7 — Is the restriction proportionate?

The court weighs the need for a fair trial against the privacy or confidentiality interest.

11. Example: WhatsApp Evidence

Suppose A sues B for repayment of AED 500,000.

A requests B's entire mobile phone.

B objects on privacy grounds.

The court should distinguish between:

Relevant

WhatsApp messages between A and B concerning the AED 500,000 transaction.

Potentially irrelevant

B's:

family conversations;

medical communications;

unrelated business conversations;

personal photographs.

A blanket inspection of the phone would create a substantially greater privacy intrusion than production of the relevant WhatsApp conversation.

Therefore, a targeted disclosure order may better satisfy both interests.

12. Example: Bank Records

Suppose a shareholder alleges that a director improperly transferred company money.

The shareholder requests:

"All bank records of the director for the last five years."

That request potentially affects substantial private financial information.

A narrower request could be:

"Bank records showing transfers from the company's account to accounts controlled by the director during the period of the disputed transactions."

The second request has a much clearer connection to the claim.

13. Example: Employee Litigation

An employee claims wrongful withholding of compensation.

The employer possesses:

payroll records;

HR emails;

performance reports;

medical information;

family information;

unrelated disciplinary material.

Only the records relevant to the employment dispute should ordinarily be targeted.

Personal information unrelated to the issues should not become discoverable merely because it happens to be stored in the same HR system.

14. Example: Corporate Fraud

A claimant alleges fraud by a company.

The defendant seeks privacy because disclosure could damage its reputation.

The court must distinguish between:

privacy from unjustified public exposure, and

withholding evidence necessary for determination of fraud allegations.

The 2026 Skatteforvaltningen decision demonstrates the possibility of a middle solution: a hearing may be private at an interlocutory stage while the resulting judgment can still be published, subject to anonymisation or redaction where necessary. (DIFC Courts)

15. Privacy, Open Justice and Confidentiality Are Different

These concepts should not be confused.

Privacy

Protects personal or private interests.

Confidentiality

Protects information that should not be improperly disclosed.

Open justice

Promotes transparency of judicial proceedings.

Disclosure

Ensures that parties have access to relevant evidence necessary for fair adjudication.

They may conflict, but they can also operate simultaneously.

For example:

Public hearing + confidential annex + redacted judgment

can protect privacy without sacrificing the transparency of the judicial process.

16. Data Protection Does Not Create a Litigation Shield

The PDPL should not be misunderstood as giving a litigant an automatic right to refuse every disclosure request involving personal data.

Where processing is legally justified for:

legal claims;

judicial proceedings;

defence of legal rights;

personal data may potentially be processed.

But this does not mean:

"Everything is disclosable."

The purpose, scope, necessity and safeguards remain important.

Thus:

Lawful litigation purpose ≠ unlimited disclosure.

17. Third-Party Privacy

The problem becomes more difficult when documents contain information belonging to people who are not parties to the litigation.

For example, a company's email chain may contain:

employee names;

customers' telephone numbers;

bank details;

passport information;

private addresses.

The court may need to balance:

the litigant's need for evidence; and

the privacy rights of third parties.

Possible solutions include:

redaction;

anonymisation;

confidentiality undertakings;

restricted inspection;

production only to legal representatives.

18. Digital Litigation and Proportionality

The issue is particularly important because electronic evidence can be enormous.

A single mobile phone can contain:

hundreds of thousands of messages;

photographs;

location history;

health information;

financial information;

private communications;

deleted-data remnants.

Therefore, modern civil litigation should increasingly move from:

"Give me everything."

to:

"Identify the specific information necessary to determine the dispute."

The reasoning in Al Soor, Lunars and Jonathan Lau strongly supports focused and proportionate approaches to pre-action production. (DIFC Courts)

19. Privacy and AI-Assisted Litigation

AI creates new privacy-disclosure problems.

Examples include:

AI analysis of employee communications;

predictive litigation tools;

automated document review;

facial-recognition records;

AI-generated evidence summaries;

automated extraction of WhatsApp messages;

machine-learning analysis of customer data.

A party should not necessarily be entitled to unrestricted access to the entire dataset merely because an AI system processed it.

The court may instead require:

relevant data only;

defined date ranges;

defined custodians;

defined keywords;

anonymisation;

human review;

confidentiality protections.

20. Key Legal Principles

Principle 1

Privacy is important but is not an absolute bar to relevant evidence.

Principle 2

Disclosure must have a genuine connection with the dispute.

Principle 3

Relevant evidence should not automatically mean unrestricted access to entire documents or devices.

Principle 4

Personal data and documents containing personal data are not necessarily the same thing.

Principle 5

Courts can use redaction and anonymisation to reconcile privacy with disclosure.

Principle 6

Fishing expeditions are inconsistent with focused disclosure.

Principle 7

Open justice creates a strong presumption of public proceedings in the DIFC, subject to recognised exceptions.

Principle 8

Serious reputational or commercial harm can be relevant to a privacy application, particularly where allegations have not yet been determined.

Principle 9

Interlocutory privacy protection may be narrower than permanent secrecy.

Principle 10

The proper balance depends on the facts, legal framework and nature of the information.

21. Mainland UAE vs DIFC

This distinction is essential.

Mainland UAE

The analysis principally involves:

Civil Transactions Law;

Civil Procedure legislation;

Evidence legislation;

PDPL;

cyber/privacy legislation;

applicable court procedures.

DIFC

The DIFC has its own:

laws;

Rules of the DIFC Courts;

data-protection framework;

disclosure regime;

open-justice principles;

specialist jurisprudence.

Therefore, DIFC cases should be used as persuasive UAE comparative authorities unless the dispute is actually governed by DIFC law.

22. Short Exam Answer

Privacy versus disclosure balancing in UAE civil litigation concerns the reconciliation of a litigant's right to obtain relevant evidence with the privacy and confidentiality interests of individuals and businesses.

The court should examine relevance, materiality, necessity and proportionality. Personal data should not automatically be treated as immune from disclosure where it is legitimately required for judicial proceedings. At the same time, a party should not receive unrestricted access to irrelevant personal information merely because it is contained in a relevant document or electronic device.

UAE/DIFC authorities demonstrate the use of targeted disclosure, confidentiality, redaction, anonymisation and private hearings. DFSA v Waterhouse distinguishes personal data from documents containing such data; R.E. Lee, KPMG, Arqaam Capital and Al Ramz Capital demonstrate the importance of transparency and the circumstances in which privacy may be justified; while Al Soor, Lunars and Jonathan Lau emphasise focused and proportionate disclosure. The 2026 Skatteforvaltningen decision further illustrates that a court may protect privacy at an interlocutory stage while preserving transparency through a published, potentially anonymised judgment. (DIFC Courts)

23. Conclusion

The UAE approach to privacy versus disclosure in civil litigation is best understood as a controlled balancing exercise rather than an absolute priority for either privacy or disclosure.

The fundamental objective is to ensure a fair determination of the dispute while preventing litigation from becoming an unrestricted examination of a person's private life or a company's confidential affairs.

The preferred modern approach is therefore:

Relevant + material + necessary disclosure, combined with proportionate privacy safeguards.

In practical terms, UAE courts can reconcile the competing interests through targeted document production, redaction, anonymisation, confidentiality restrictions, limited disclosure and, where justified, private hearings.

The DIFC authorities are especially developed on this issue, while mainland UAE practice must additionally be analysed through the current post-1 June 2026 Civil Transactions Law, Evidence Law, procedural framework and PDPL.