CIVIL LAW AND UAE ULTRA-BASIC CYBER LAW KEYWORDS REVISION SET

1. Meaning of Cyber Law

Cyber Law means the body of laws governing activities involving:

computers;

computer networks;

internet services;

electronic communications;

digital data;

online platforms;

electronic transactions;

cybersecurity;

privacy;

digital evidence;

cybercrime.

In the UAE, cyber law is not contained in one single statute. Important legislation includes the Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes, the Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, the Federal Decree-Law No. 45 of 2021 on Personal Data Protection, and the Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions. The official UAE legislation platform continues to identify Federal Decree-Law No. 34 of 2021 as the principal federal Cybercrimes Law.

2. Ultra-Basic Cyber Law Keywords

3. Main UAE Cybercrime Law

The principal statute is Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes.

It addresses offences involving information networks, information technology tools, electronic systems and digital communications. The law covers matters such as unlawful access, interference with systems/data, online fraud, privacy violations and prohibited online content.

Revision Point

Federal Decree-Law No. 34 of 2021 = Core UAE Cybercrime Law.

4. Hacking

Hacking means unauthorised access to:

websites;

information systems;

computer networks;

information technology tools.

The Cybercrimes Law provides criminal consequences for unlawful access, with enhanced consequences where the conduct causes damage, interruption, deletion, alteration, disclosure, copying or acquisition of data.

Simple Formula

Unauthorised access + protected digital system = potential cybercrime.

5. Data Interference

Data interference includes unlawful acts affecting:

availability;

integrity;

confidentiality;

accuracy;

existence of data.

Examples:

deleting files;

changing records;

destroying databases;

copying confidential information;

disrupting data availability.

6. System Interference

A cyber offender may attack the functioning of an information system itself.

Examples:

shutting down servers;

introducing malicious software;

disrupting a company's network;

preventing authorised users from accessing systems.

The distinction is important:

Data attack → information affected

System attack → functioning of infrastructure affected

7. Unauthorised Access

Unauthorised access is one of the fundamental concepts of cyber law.

The central questions are:

Was the system protected?

Did the person have authority?

Was access beyond the authority granted?

Was there knowledge or intent required by the particular offence?

Was damage caused?

8. Cyber Fraud

Cyber fraud involves dishonest digital conduct designed to obtain:

money;

property;

credentials;

financial information;

services;

unlawful economic advantage.

Examples include:

phishing;

fake payment websites;

fraudulent electronic communications;

manipulation of online accounts;

fraudulent digital transactions.

9. Phishing

Phishing is a fraudulent attempt to obtain confidential information by pretending to be a legitimate person or organisation.

Typical targets:

passwords;

bank information;

OTPs;

account credentials;

identity information.

Revision Formula

Fake identity + electronic communication + attempt to obtain confidential information = phishing risk.

10. Identity Theft

Identity theft occurs when a person's identifying information is unlawfully used to impersonate or exploit that person.

Examples:

using another person's account;

impersonating another individual online;

creating fraudulent accounts;

using stolen identification information.

11. Privacy

Cyber law strongly intersects with privacy law.

Privacy concerns may arise through:

unauthorised recording;

surveillance;

publication of private information;

unlawful access to accounts;

disclosure of personal photographs;

interception of communications.

The UAE courts have recently addressed the criminal threshold for invasion of privacy using information technology.

12. Electronic Privacy

Electronic privacy means protection of a person's private information and digital activities.

Potentially protected material may include:

photographs;

messages;

communications;

personal data;

account information;

private recordings;

location information.

13. Online Defamation

Online defamation involves unlawful publication of statements or material through:

social media;

websites;

messaging applications;

email;

digital platforms.

The UAE Cybercrimes Law interacts with general criminal law and civil compensation principles.

14. Cyber Blackmail

Cyber blackmail generally involves using digital information or threats to force a person to:

pay money;

perform an act;

refrain from an act;

disclose information.

A common pattern is:

Private information → threat of disclosure → demand → pressure on victim.

The Dubai courts have considered the relationship between electronic communications, threats, blackmail and criminal intent.

15. Electronic Evidence

Electronic evidence is central to cyber litigation.

Under the UAE Evidence Law, electronic evidence includes evidence derived from data or information:

generated;

stored;

extracted;

copied;

transmitted;

reported; or

received

through information technology and capable of being retrieved in understandable form.

Examples:

emails;

WhatsApp messages;

server logs;

CCTV;

metadata;

GPS records;

electronic contracts;

digital photographs;

transaction records;

blockchain records.

16. Authentication

Authentication asks:

Is this digital material genuine?

The court may consider:

sender identity;

account ownership;

telephone number;

device;

metadata;

server records;

timestamps;

technical examination;

surrounding circumstances.

Digital evidence is therefore not automatically conclusive merely because it is electronic.

17. Attribution

Attribution means connecting a digital act to the person alleged to have performed it.

For example:

Message → account → telephone/device → user → surrounding evidence

Attribution is particularly important in hacking and online impersonation cases.

18. Digital Forensics

Digital forensics is the technical examination of electronic systems and devices.

It may examine:

computers;

mobile phones;

servers;

databases;

cloud systems;

deleted files;

metadata;

logs;

digital communications.

19. Chain of Custody

Chain of custody records:

who collected the evidence;

when it was collected;

how it was preserved;

who examined it;

whether it was altered.

This protects the integrity of digital evidence.

20. Personal Data Protection

The Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, provides a federal framework for personal-data protection.

Personal data includes information capable of identifying a natural person directly or indirectly. The legislation also distinguishes sensitive and biometric information.

Important Keywords

personal data;

sensitive personal data;

biometric data;

processing;

controller;

processor;

consent;

security;

confidentiality;

data breach.

21. Data Processing

Data processing can include:

collection;

recording;

organisation;

storage;

modification;

retrieval;

use;

disclosure;

transmission;

deletion.

Therefore, cyber compliance is not limited to preventing hacking.

22. Data Breach

A data breach occurs where protected information is unlawfully:

accessed;

disclosed;

altered;

destroyed;

lost;

acquired.

A breach may produce several legal consequences simultaneously:

Cybercrime + data protection + employment + contract + civil damages.

23. Cybersecurity

Cybersecurity means protecting digital systems against:

unauthorised access;

malware;

data theft;

system disruption;

manipulation;

destruction;

unauthorised disclosure.

Cybersecurity is both a technical and legal responsibility.

24. Electronic Transactions

The UAE's electronic-transactions framework gives legal recognition to electronic records, electronic signatures and electronic transactions.

This means that a contract does not automatically lose legal significance merely because it exists digitally.

25. Electronic Signature

An electronic signature helps establish:

identity;

approval;

authentication;

intention to sign;

integrity of a document.

However:

Authentication of a signature and authority to sign are separate questions.

26. WhatsApp Evidence

WhatsApp communications can become relevant evidence in UAE litigation.

A recent Dubai Court of Cassation authority, Civil Cassation No. 468 of 2024, concerned WhatsApp communications relating to a substantial loan transaction. Reported discussions of the decision emphasize authentication and attribution rather than treating paper form as the sole test of legal significance.

Exam Point

Electronic communication may establish legally relevant facts when authenticity and attribution are sufficiently established.

27. Cybercrime and Civil Liability

A cyber offence may create both:

Criminal consequences

imprisonment;

fines;

confiscation or other statutory consequences.

Civil consequences

compensation;

restoration;

damages for proven financial loss;

compensation for legally recognized non-economic harm.

A criminal conviction does not automatically prove every amount of civil damages claimed.

This distinction was emphasized by the Dubai Court of Cassation in Judgment No. 611 of 2025.

28. Causation

A cyber claimant must generally connect:

Digital conduct → injury → causation → loss.

For example:

Hacking
↓
Deletion of business data
↓
Business interruption
↓
Proven financial loss

The claimant still needs evidence connecting the conduct with the claimed loss.

29. Quantum of Cyber Damages

Cyber damages may involve:

lost revenue;

restoration costs;

investigation expenses;

business interruption;

reputational harm;

data-recovery costs;

professional expenses where legally recoverable.

The Dubai Court of Cassation's 2025 technology-related damages decision illustrates the distinction between establishing wrongful conduct and proving the precise additional financial loss.

30. Cybercrime and Criminal Procedure

Some cyber offences involve procedural requirements concerning complaints.

For example, Abu Dhabi Court of Cassation Criminal Appeal No. 1829/2025 addressed the complaint requirement in an electronic-defamation case under Article 43 of the Cybercrimes Law and the Criminal Procedure Law. The reported ruling focused on the validity of the victim's complaint and the subsequent role of legal representation.

31. Territorial Jurisdiction

Cybercrime creates difficult jurisdictional questions because:

Actor may be in Country A

Server may be in Country B

Victim may be in UAE

Damage may occur in UAE

UAE courts may therefore have to examine:

place of conduct;

place of result;

victim's location;

defendant's residence;

applicable statutory jurisdiction;

cross-border cooperation.

Academic analysis of UAE cases has identified instances where UAE courts considered jurisdiction where digital harm or its result occurred within the UAE.

32. Cross-Border Cybercrime

Cybercrime frequently crosses national borders.

Problems include:

foreign servers;

foreign cloud providers;

overseas defendants;

foreign evidence;

conflicting privacy laws;

extradition;

mutual legal assistance.

This makes international cooperation important.

33. Platform Liability

A platform may become legally relevant when questions arise about:

user-generated content;

unlawful disclosure;

account misuse;

notice of unlawful conduct;

technical control;

cooperation with authorities.

However, UAE law should not simply be equated with U.S.-style safe-harbour regimes. Reported UAE jurisprudence specifically establishing a comprehensive intermediary safe-harbour doctrine remains limited.

34. Social Media Liability

Social-media activity can create several forms of legal exposure:

Publication → privacy

False statement → defamation

Threat → cybercrime

Unauthorised access → hacking

Fraudulent communication → cyber fraud

Data disclosure → privacy/data-protection issues

35. AI and Cyber Law

Artificial intelligence creates new cyber-law questions:

AI-generated phishing;

automated hacking;

deepfakes;

synthetic identities;

automated fraud;

AI-generated defamation;

automated surveillance;

manipulation of digital evidence.

The legal question is not simply:

“Was AI involved?”

It is:

Who controlled the system, what conduct occurred, what legal duty applied, and what evidence proves causation and responsibility?

36. Blockchain and Cyber Law

Blockchain raises issues concerning:

digital ownership;

authentication;

wallet control;

transaction attribution;

fraud;

smart contracts;

digital evidence.

A blockchain record may establish that a transaction occurred, but additional evidence may be needed to establish who controlled the relevant wallet and the legal purpose of the transaction.

37. Cryptocurrency

Cryptocurrency disputes may involve:

ownership;

transfer;

fraud;

custody;

payment;

tracing;

restitution;

contractual obligations.

Dubai Court of Cassation Civil Cassation No. 486 of 2024 has been reported in connection with cryptocurrency/USDT-related disputes and electronic communications. It is better treated as a digital-asset/evidence authority than as a direct interpretation of the Cybercrimes Law.

38. Smart Contracts

A smart contract uses computer code to automate contractual performance.

Legal sequence

Agreement → Code → Automated execution → Digital record → Possible dispute

Automation does not necessarily eliminate traditional questions concerning:

consent;

authority;

legality;

interpretation;

breach;

mistake;

fraud;

remedies.

39. Digital Evidence vs Traditional Evidence

40. Important Cyber-Law Case Laws

Case 1 — Dubai Court of Cassation, Civil Cassation No. 611 of 2025

Principle

The case involved alleged interference with computer systems and electronic information.

The Court distinguished between:

proof of wrongful conduct

and

proof of additional financial damage and its amount.

A criminal finding can have binding consequences regarding established wrongdoing, but the civil claimant must still establish additional damage and quantum with appropriate evidence.

Importance

Very important for:

hacking claims;

data deletion;

cyber damages;

technical expert evidence;

causation;

quantum.

Case 2 — Dubai Court of Cassation, Criminal Cassation No. 536 of 2024

Principle

The Court addressed invasion of privacy through information technology.

The reported judgment states that the material element could be established through acts of spying or voyeurism without consent using a computer network or information technology tool. It also addressed the distinction between specific intent and general criminal intent.

Importance

Useful for:

digital privacy;

surveillance;

unauthorised recording;

criminal intent;

electronic privacy.

Case 3 — Abu Dhabi Court of Cassation, Criminal Case No. 917 of 2023

Principle

The decision has been reported in relation to:

hate speech;

defamation;

social-media communications;

prohibited online expression.

It demonstrates the importance of analysing the precise statutory elements of an online communication rather than treating every offensive digital statement identically.

Importance

Useful for:

social media;

online defamation;

prohibited content;

criminal liability for digital publication.

Case 4 — Abu Dhabi Court of Cassation, Criminal Appeal No. 1829 of 2025

Principle

The case concerned the procedural complaint requirement for an electronic-defamation offence.

The reported judgment considered whether the complaint was validly initiated by the victim and whether later participation by a lawyer affected its validity.

Importance

Useful for:

complaint requirements;

procedural validity;

electronic defamation;

prosecution of cyber offences.

Case 5 — Dubai Court of Cassation, Civil Cassation No. 468 of 2024

Principle

The case concerned a substantial loan transaction documented through WhatsApp communications rather than a conventional signed paper contract.

The reported judicial treatment illustrates that electronic communications may have significant evidentiary value where identity, attribution and authenticity are sufficiently established.

Importance

Useful for:

WhatsApp evidence;

electronic contracts;

digital admissions;

attribution;

electronic communications.

Case 6 — Dubai Court of Cassation, Civil Cassation No. 277 of 2009

Principle

This is a historical electronic-evidence authority arising under the earlier electronic-transactions framework.

The reported decision recognised that electronic communications such as emails could have evidentiary force when attributable to the sender's electronic system and satisfying the applicable evidentiary requirements.

Importance

It demonstrates the development of UAE law from early electronic-commerce jurisprudence toward the modern Evidence Law and Electronic Transactions framework.

Case 7 — Dubai Court of Cassation, Personal Status Cassation No. 451 of 2021

Principle

The case involved WhatsApp communications in a personal-status dispute and illustrates the ability of modern electronic communications to carry legal significance when properly attributed and evaluated.

Importance

Useful for:

WhatsApp;

electronic communications;

attribution;

digital evidence.

It should be treated primarily as an electronic-evidence authority, not as a direct interpretation of the 2021 Cybercrimes Law.

41. Important Legal Distinction

The above cases should not all be described as direct interpretations of Federal Decree-Law No. 34 of 2021.

They fall into different categories:

This distinction is important in a legal examination or research paper.

42. Cyber Law and Civil Law

Cyber conduct can create a combination of:

Criminal liability

For prohibited cyber conduct.

Civil liability

For resulting damage.

Contractual liability

Where a cyber incident breaches a contractual obligation.

Data-protection liability

Where personal data is improperly processed or compromised.

Regulatory liability

Where sector-specific cybersecurity requirements are breached.

Therefore:

One cyber incident can produce several parallel legal consequences.

43. Cyber Negligence

Cyber negligence may arise where a person or organisation fails to exercise required care.

Possible examples:

inadequate security;

failure to protect credentials;

careless disclosure of confidential data;

failure to implement appropriate safeguards;

negligent handling of customer information.

Liability ultimately depends on the applicable statutory, contractual and civil-law duties and proof of causation and damage.

44. Cybersecurity Contract Clauses

A technology contract should ideally address:

cybersecurity standards;

data ownership;

data processing;

confidentiality;

incident notification;

access controls;

encryption;

audit rights;

subcontractors;

liability;

indemnity;

termination;

data deletion;

business continuity;

incident response.

45. Cyber Incident Response

Basic legal response:

Detect → Preserve → Investigate → Contain → Notify where legally required → Recover → Document → Claim/defend

Evidence should be preserved before systems are altered unnecessarily.

46. Cybercrime and Expert Evidence

Cyber disputes often require technical experts.

Experts may analyse:

system logs;

computers;

mobile devices;

databases;

IP information;

metadata;

deleted files;

account activity.

But:

Expert provides technical analysis; court makes the legal determination.

The 2025 Dubai Court of Cassation technology-damages decision illustrates the importance of expert evidence for proving technical loss and its quantum.

47. Cybercrime and Proof

A useful examination framework is:

Identity

Who performed the act?

Authority

Were they authorised?

Conduct

What exactly happened?

Technology

Which system/device/account was used?

Evidence

What proves it?

Causation

Did the conduct cause the harm?

Damage

What loss resulted?

Remedy

What legal consequence follows?

48. Cyber Law and Good Faith

Good faith remains relevant even in digital transactions.

Parties should not:

manipulate digital records;

abuse electronic systems;

fabricate communications;

conceal material cyber incidents;

exploit technical vulnerabilities dishonestly.

Digital technology changes the method of conduct, but fundamental legal principles continue to apply.

49. Cyber Law and Public Order

Certain online conduct may implicate:

public morals;

national security;

public order;

reputation;

privacy;

social values.

Therefore, freedom to communicate online is not equivalent to unrestricted immunity from legal responsibility.

50. Cyber Law and Digital Contracts

Digital contracting requires attention to:

Offer → Acceptance → Identity → Authority → Electronic record → Signature/authentication → Performance → Evidence

A WhatsApp message, email or electronic signature may be legally relevant, but its evidentiary weight depends upon authenticity, attribution and context.

51. Cyber Law and Corporate Liability

Companies should consider:

employee access;

administrator privileges;

vendor access;

cybersecurity controls;

incident response;

data protection;

contractual allocation of cyber risk.

A company may simultaneously be:

victim;

claimant;

defendant;

data controller;

contractual party.

52. Cyber Law and Employees

Employee cyber conduct may involve:

misuse of company systems;

unauthorised copying;

disclosure of confidential information;

credential misuse;

insider attacks;

unauthorised access after termination.

Important evidence may include:

access logs;

email;

device records;

authentication logs;

company policies;

employment agreements.

53. Cyber Law and Intellectual Property

Cyber disputes may overlap with:

copyright;

trademarks;

trade secrets;

confidential information;

software rights;

database rights.

Example:

Employee downloads confidential source code → cyber issue + confidentiality issue + IP issue + possible civil claim.

54. Cyber Law and Consumer Protection

Online consumers may face:

phishing;

fraudulent websites;

fake products;

unauthorised payments;

misuse of personal information;

deceptive digital advertising.

Cyber law may therefore interact with consumer law and contract law.

55. Cyber Law and Banking

Cybersecurity is particularly important in:

online banking;

electronic payments;

mobile banking;

digital wallets;

payment gateways;

cryptocurrency platforms.

Potential disputes include:

account takeover;

fraudulent transfers;

credential theft;

payment manipulation;

unauthorised transactions.

56. Cyber Law and Digital Assets

Digital assets create new legal questions concerning:

ownership;

custody;

transfer;

tracing;

freezing;

recovery;

fraud;

enforcement.

Traditional concepts of property, contract, evidence and restitution increasingly interact with digital technology.

57. Cyber Law and Courts

Courts increasingly need to understand:

electronic evidence;

digital records;

cybersecurity;

technical expert reports;

electronic signatures;

online transactions.

The UAE's Evidence Law expressly recognises electronic evidence, making digital material an established part of modern civil and commercial litigation.

58. Cyber Law and Civil Remedies

Possible civil remedies include:

compensation;

restitution;

injunction;

preservation orders;

recovery of property;

account of losses where appropriate;

contractual remedies;

orders relating to unlawful conduct.

The precise remedy depends on the applicable legislation and facts.

59. Cyber Law and Evidence — Golden Formula

Remember:

Digital Evidence = Authenticity + Attribution + Integrity + Relevance + Reliability + Legal Weight

60. Cyber Law — Ultra-Basic Revision Formula

Cybercrime

Unauthorised Access + Digital Misuse + Protected System/Data = Cyber-Law Issue

Cyber Damages

Wrongful Digital Conduct + Causation + Proven Loss = Potential Civil Liability

Digital Evidence

Record + Authentication + Attribution + Integrity = Evidentiary Value

Privacy

Personal Information + Unauthorised Digital Interference = Potential Privacy Liability

Data Protection

Personal Data + Processing + Legal Obligation = Data-Protection Compliance

61. One-Line Revision Keywords

Cyber law = law of the digital environment.

Cybercrime = unlawful digital conduct.

Hacking = unauthorised access.

Data interference = unlawful manipulation of data.

System interference = disruption of digital infrastructure.

Cyber fraud = fraudulent digital conduct.

Phishing = deceptive acquisition of information.

Identity theft = misuse of identity.

Privacy = protection against unlawful intrusion.

Cyber blackmail = digital threat for coercive purpose.

Online defamation = unlawful reputational publication.

Data breach = unauthorised compromise of data.

Cybersecurity = protection of information systems.

Authentication = proving genuineness.

Attribution = connecting activity to a person.

Metadata = information about information.

Digital forensics = technical investigation.

Chain of custody = preservation history.

Electronic evidence = evidence generated or stored digitally.

Electronic signature = electronic authentication mechanism.

Personal data = identifiable-person information.

Sensitive data = specially protected personal information.

Data processing = collection/use/storage/etc.

Encryption = coded protection.

Malware = malicious software.

Blockchain = distributed digital record.

Cryptocurrency = cryptographic digital asset.

Smart contract = code-based automated performance.

Cyber negligence = failure to meet applicable digital-security duties.

Cyber damages = compensation for proven digital harm.

Cyber jurisdiction = determining which court/law applies.

Cyber expert = technical assistance to the court.

Digital attribution = connecting a digital act with its actor.

Digital integrity = assurance that evidence has not been altered.

Platform liability = potential responsibility connected with platform activity.

62. Six Most Important Case-Law Revision Points

The modern cases should be read alongside the current Cybercrimes Law and Evidence Law rather than treating older electronic-evidence decisions as direct interpretations of today's entire cyber-law framework.

63. Ultra-Basic Exam Answer

Cyber law in the UAE regulates unlawful conduct involving computers, information networks, electronic communications and digital information. Its principal federal statute is Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes. Cyber law operates together with legislation concerning electronic transactions, personal-data protection and electronic evidence. Important areas include hacking, data interference, cyber fraud, privacy violations, online defamation, cyber blackmail, identity theft and unauthorised access.

Digital evidence is particularly important because modern cyber disputes frequently depend on emails, WhatsApp messages, system logs, metadata, electronic records and forensic reports. The UAE Evidence Law expressly recognises electronic evidence. Courts have also developed jurisprudence concerning electronic communications, privacy and cyber-related damages.

The principal legal questions in a cyber dispute are identity, authority, conduct, authentication, attribution, causation, damage and remedy. Therefore, UAE cyber law is not merely criminal law; it also interacts with civil liability, contract law, data protection, evidence, intellectual property, employment and commercial law.

64. Final Memory Formula

CYBER LAW = SYSTEM + DATA + ACCESS + PRIVACY + COMMUNICATION + EVIDENCE + SECURITY + LIABILITY + REMEDY

And for examinations:

Cybercrime → Identify the prohibited digital conduct → prove attribution → examine electronic evidence → establish causation → determine criminal/civil consequences.

Key legislation to remember

Federal Decree-Law No. 34 of 2021 — Cybercrimes
Federal Decree-Law No. 46 of 2021 — Electronic Transactions and Trust Services
Federal Decree-Law No. 45 of 2021 — Personal Data Protection
Federal Decree-Law No. 35 of 2022 — Evidence in Civil and Commercial Transactions.

Most important distinction: the Cybercrimes Law primarily establishes criminal offences, while the Evidence Law, Personal Data Protection Law, electronic-transactions legislation and civil-law rules provide the broader framework for digital transactions, evidence, privacy and civil consequences.