United Arab EmiratesFederal Decree-Law on Combating Rumours and Cybercrime, hacking offences
Federal Decree-Law No. 34 of 2021, Arts. 1-3 (Hacking)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access, or remain on, a website, information system, computer, or information network without authorization, in violation of a licence, or illegally.
- Reading a public, unauthenticated page without defeating any access control has not itself been held to fall inside or outside this section.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Art. 2(1): imprisonment and/or a fine of AED 100,000 to 300,000 for hacking a website, information system, network, or ITE. Art. 2(2): imprisonment of at least six months and/or a fine of AED 150,000 to 500,000 where the hacking causes damage, destruction, interruption, or the cancellation, disclosure, alteration, copying, or dissemination of data. Art. 2(3): imprisonment of at least one year and/or a fine of AED 200,000 to 500,000 where the hacking is committed to acquire data or information for illegal purposes. Art. 3 sets materially higher penalties, including temporary imprisonment, for the same conduct against a government entity's systems.
Penalty structure
Three tiers under Art. 2 alone: AED 100,000 to 300,000 (base offence), AED 150,000 to 500,000 (damage or disclosure results), and AED 200,000 to 500,000 (illegal-purpose acquisition), each also carrying imprisonment. AED 500,000 is the highest fixed ceiling of the three; Art. 3's government-entity variant is materially higher again.
- Rule
- Fixed only
- As of
- Currency
- AED
- Fixed cap
- 500,000
What it makes you log
Logging duty
Articles 1 to 3 define hacking and set the penalties for hacking a website, an electronic information system, an information network or information technology equipment, and for hacking a government entity's systems. They impose no duty to create, keep, produce or review a log or record.
- Kind
- None
- As of
What this law does
Article 1 defines Hacking as the unauthorized access, access in violation of the provisions of a license, or illegal access to or stay on an information system, a computer, an operating system, or an information network.
Article 2 punishes hacking a website, electronic information system, information network or piece of information technology equipment with imprisonment and a fine of not less than AED 100,000 or more than AED 300,000; the penalty rises to imprisonment of at least six months and a fine of AED 150,000 to 500,000 where the hacking causes damage, destruction, interruption, or the copying or disclosure of data, and to imprisonment of at least one year and a fine of AED 200,000 to 500,000 where it is committed to acquire data or information for illegal purposes.
The offence's definition turns on access being unauthorized, in violation of a licence, or illegal, and does not on its own terms require defeating a technical security measure. Article 3 imposes materially higher penalties, including temporary imprisonment, where the same conduct targets a government entity's systems.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .