Reputation management Dubai: how UAE law works

Reputation management in Dubai and the rest of the UAE starts from a fact that surprises readers from the UK, the US or Europe: the federal cybercrime decree makes some online speech a criminal offence, including insulting another person and, in some cases, publishing private material that is true. That cuts both ways. It gives a person harmed by a post a criminal route that many countries lack, and it exposes anyone who posts about others, or who files a complaint about a post, to real penalties.

So the first skill here is restraint, not speed. Before you write a reply, a review or a complaint, you need to know which of the UAE's separate legal layers applies, what the text actually says, and whether the content you want gone is false, private, merely unflattering or accurate and in the public interest. Those four cases lead to four different routes, and the last one has no legitimate route at all.

This is information, not legal advice. UAE law is applied by courts and prosecutors in ways a published text cannot show, and the Arabic text prevails over the English translation on the official legislation site. You need local counsel in the right emirate or free zone before you file, post or answer anything. This guide also has limits we state plainly: we read the federal cybercrime decree, the federal Crimes and Penalties Law page, the federal data protection law, the DIFC Data Protection Law 2020 (erasure and complaint provisions), and the ADGM office page for individuals. We could not read the Crimes and Penalties Law articles on defamation, the Executive Regulations of the federal data protection law, the ADGM Data Protection Regulations 2021 themselves, or any court judgment. Where a point depends on those, we say so.

Related readUAE Defamation Law Online: Claim, Complaint, Limits

Which UAE route fits which reputation problem

The table sorts the usual problems by first move. "Federal" means the national laws; DIFC and ADGM are financial free zones with their own data protection laws. Each row is a starting point for a conversation with counsel, not a verdict.

Three legal systems share the UAE: federal, DIFC and ADGM

The federal laws apply across the UAE. On top of them, two financial free zones, the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM), run their own data protection regimes. The federal data protection law says in Article 2 that it does not apply to companies in free zones that have special personal data legislation. So the first question for any data request is which regime governs the organization holding the data.

The DIFC describes its law as DIFC Law No. 5 of 2020, enacted in May 2020, and says the Commissioner of Data Protection is responsible for its supervision and enforcement. In the DIFC Data Protection Law text, Article 33 gives a right to require erasure where the data is no longer necessary, consent was withdrawn, processing is unlawful, or the person objects and the controller has no overriding grounds. It does not require erasure where the data is needed for legal compliance or legal claims, and it has a technical-infeasibility exemption. Article 60 lets a data subject lodge a complaint with the Commissioner, who may investigate, mediate or both. The ADGM Office of Data Protection page for individuals lists rights to erasure and rectification and describes a complaint form for the Office. We could not read the ADGM Data Protection Regulations 2021 themselves, so we give no section numbers or conditions for ADGM.

Related readGDPR Right to Erasure Exceptions: When Refusal Is Lawful

In practice: a mainland company falls under the federal law, a DIFC or ADGM entity under that zone's regime, and if you are unsure, ask the business which applies.

Defamation and online speech offences sit in the federal criminal law, which is national in scope. We did not read how it interacts with the free zones or their courts, so do not assume a free zone court is a route for a speech complaint without counsel's advice.

The cybercrime decree: insult, defamation and privacy as criminal offences

Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes was issued on 20 September 2021 and took effect on 2 January 2022, according to the official legislation site. The u.ae government portal describes it as targeting, among other things, the spread of false information and content harmful to the UAE's interests or security. The official legislation page carries the law and its download. We read the English translation from the site's download link.

Four provisions matter most to individuals and businesses.

AED 250,000 to 500,000fine range, with or without imprisonment, for insult or attributing a punishable or contemptible quality (Article 43)

AED 150,000 to 500,000fine range, or at least six months of imprisonment, for invasion of privacy (Article 44)

3 working daysto file a grievance against a writ to correct, remove or block content (Article 63)

Figures from Federal Decree-Law No. 34 of 2021 as read in an English translation; the Arabic text prevails.

Article 43, insult and defamation. The text punishes a person who "insults another or attributes a quality to him that would make that person subject to punishment or contempt", with imprisonment and/or a fine of AED 250,000 to 500,000. It treats an offence against a public official or public service worker, during or because of their duties, as aggravated. Note what the wording does not say: it does not turn on whether the statement is false. A harsh remark and a damaging accusation fall in the same article.

Article 44, invasion of privacy. The penalty is imprisonment of at least six months and/or a fine of AED 150,000 to 500,000 for several acts: eavesdropping on or recording conversations, taking photos of third parties in public or private places, publishing private material "even if it is true and genuine, with intention of harming the person", publishing photos of injured, dead or accident victims without consent, and tracking or sharing a person's location data. Altering a photo or recording in order to defame someone carries a higher floor: at least one year and/or AED 250,000 to 500,000.

Related readDefamation law France: claim, proof and the clock

Article 52, false news and rumors. Spreading false news or data, or misleading rumors, carries imprisonment of at least one year and a fine of at least AED 100,000. The penalty rises to at least two years and AED 200,000 if it incites public opinion against UAE authorities or occurs during an epidemic, crisis, emergency or disaster. A separate article, 54, covers using automated tools to spread false data.

Content orders and blocking. Article 53 sets a fine of AED 300,000 to 1,000,000 for failing to remove illegal content within the period an order sets, or refusing such orders without an acceptable excuse. Article 62 allows the competent authorities to issue writs to correct, remove or block content in respect of the crimes listed in Article 71. Article 63 requires a grievance against such a writ within three working days of learning of it, with appeals to the Federal Court within one week, as the translation reads. Article 59 lists punitive measures a court may impose, including closure or blocking of the violating site, and Article 66 lets the Attorney General order a website blocked where technically feasible.

Reach. Article 69 applies the law to offences committed abroad in four listed cases, including where the offender is found in the UAE after the offence and was not extradited. We did not find a provision on deportation in the text we read. Other offences, such as mocking or damaging the reputation of the UAE, its institutions or national figures (Article 25), are outside this guide.

Related readGermany defamation online: claims, crime, takedown

The penalties are figures in a text, and we have no verified data on what prosecutors charge or courts impose. The Crimes and Penalties Law also contains defamation offences; the two instruments we read reference its Articles 425 to 427 only in connection with reconciliation rules, and the text of those articles was beyond what we could read, so we do not describe them.

What this means if you are the one posting about others

If you write reviews, run an account that comments on businesses, or share videos of people, the practical lesson is that "true" is not always a safe harbor in the text we read, and "opinion" is not named as a defence either. The insult offence in Article 43 does not mention truth. The privacy offence in Article 44 punishes publishing private material even if true when the intent is to harm. Truth may still matter in practice, and we could not read the defamation articles of the Crimes and Penalties Law or any judgment that shows how courts weigh it. That uncertainty is the point: you should not rely on a defence you have not seen applied.

Things to avoid on a personal or business account:

• Sharing a screenshot of a private chat or a recording of a call.
• Writing a review that describes a named employee in insulting terms. State what happened to you, factually, and leave out adjectives about the person.

Deleting a post lowers harm but does not undo an offence already committed. If a complaint or summons arrives, stop posting about the subject and talk to counsel first.

What it means if you are thinking of filing a complaint

A complaint against a poster can work, because the law gives a real route and the decree's blocking and content powers exist. It is also a decision you cannot easily reverse. Once a criminal complaint is in the hands of the authorities, they decide what happens next. Before filing, ask four questions.

Related readIndia Defamation Online: Claim, Clock and Takedown

Is the content really within the offence? An honest negative review of a service that describes your experience is a different thing from a post that insults you personally or reveals your private life. A complaint about the first can look like an attempt to silence a customer and may draw more attention than the review ever had.

Is it true, and is it public-interest reporting? If the content is accurate and lawful reporting about something that matters to the public, we do not help use a complaint to remove it. That is a firm line, not a tactic we weigh. Journalists, consumers and employees report wrongdoing, and a route that exists for harm cannot be turned into a way to hide facts.

Who is the poster, and where? A complaint against an anonymous account abroad rarely ends in more than a block, and a foreign platform is not bound by a UAE order simply because it was issued.

Data protection: asking to correct or erase personal data

The federal data protection law, Federal Decree-Law No. 45 of 2021, is a civil-style route for personal data rather than speech. The official legislation text sets the rights.

Article 15 gives a data subject the right to ask a controller to correct inaccurate personal data and to have incomplete data completed. It also gives a right to request erasure in listed cases, including when the data is no longer needed, when consent is withdrawn, when the data subject objects and the controller has no legitimate reason to continue, and when processing violates the law. Article 15(3) removes the right in several cases, including requests that affect investigation procedures or the claiming and defending of rights, and requests that contradict other legislation the controller is subject to. Article 17 gives a right to object in three cases, which are direct marketing, statistical surveys unless needed for the public interest, and processing that violates Article 5. Article 24 allows a complaint to the UAE Data Office (called the Bureau in the text), which reviews it in coordination with the controller; if a violation is proven, administrative penalties apply under Article 26, which is implemented by a Cabinet decision we did not read.

Related readDefamation law South Africa: claim, defenses, clock

Article 2 excludes government data, personal data held by security and judicial authorities, a data subject processing their own data for personal purposes, certain health and banking data with their own laws, and free-zone companies with their own data legislation.

What the law means for a reputation problem is narrower than it first sounds. It works well against a business holding data about you that is wrong or no longer needed: a directory, a lead database, a former service provider. It is a weak fit for a post that insults you, because that is a speech question, and the exception for claims and legislation may apply. Whether a news publisher or search engine is bound to erase a link to accurate reporting is not something we could confirm. The Executive Regulations, which Article 15 says can add further cases, were not read. Treat the data route as one for data, not one for opinions.

The DIFC and ADGM regimes are separate, with their own conditions, exceptions and complaint offices. If your data sits with an organization in either zone, ask that organization for its data protection contact and check the zone's own guidance before filing.

Platforms and search engines: where UAE law reaches and where it does not

Most reputation damage happens on platforms headquartered outside the UAE, which follow their own rules and the laws of countries where they are based. A UAE writ under Article 62 is directed at content within the decree's reach; whether and how a specific foreign platform complies is not something the official texts we read settle. In practice the platform report is almost always the first route, because it costs nothing and asks only whether the content breaks the platform's rules on harassment, privacy or impersonation.

Related readOnline Harassment Laws by Country: Where Each Route Leads

Search engines are a different layer, governed by their own policy pages, which we did not read for this guide. Removing a page from results is not removing it from the web, so deal with the source first where you lawfully can, and strengthen what search shows with accurate pages of your own.

The order of operations, with a timeline

The sequence matters more than any single tool. Start by sorting the content into false, private, merely unflattering, or accurate and public interest. Then document before you act: dates, URLs, full-page captures and who saw the content. Then pick the lowest-risk route that fits.

1. Sort the contentDecide whether it is false, private, unflattering or accurate and in the public interest. The last category has no route we will use.
2. Record without engagingCapture the page, the date and the URL. Do not reply, tag or retaliate while you decide.
3. Check your own exposureIf you have posted, shared or commented on the subject, ask counsel whether that exposes you before you complain about anyone else.
4. Report on the platformFile under the platform's own rules on harassment, privacy or impersonation. Keep the case reference.
5. Send a data request if a business holds the dataIdentify the controller and the regime, then ask for correction or erasure in writing.
6. Consider counsel and a formal complaintOnly with local counsel who has explained the criminal process, the settlement dynamics and the risks to you.
7. Strengthen what search showsPublish accurate pages of your own so that a single bad result is not the whole picture.

A realistic timeline, written as experience and not as a promise, looks like this.

These windows are experience, not an official source, and they vary widely.

A worked scenario, invented

The following is an invented scenario with generic parties, to show the order of reasoning. Assume a small consultancy owner in Dubai, called the owner, finds three things: an anonymous post that calls her dishonest, with no evidence; a review by a former client describing a late delivery in blunt terms; and a directory listing that gives an old home address.

The anonymous post is the candidate for a legal route. It insults her and may attribute a quality that exposes her to contempt, so it sits near Article 43. But before any complaint, she checks her own accounts, finds that she once replied angrily to a similar post, and talks to counsel about that exposure. She also reports the post to the platform under its harassment rules, which is quick and does not need the post's author.

Related readAnti-SLAPP Law Explained: Early Dismissal and Fees

The review describes a real dispute factually, so she replies publicly and offers to resolve it. A complaint would risk looking like silencing a customer.

The directory is the clearest case. It is a business holding her personal data, which is wrong and no longer needed. She identifies the controller, checks whether it sits in a free zone, and sends a written correction and erasure request under the federal law, keeping the date.

The outcome is not predictable, but three items needed three routes, and the one to push hardest is the plain personal data.

Mistakes that make UAE routes fail or backfire

• Treating truth as a complete defence. The texts we read do not make truth a defence to insult, and the privacy article reaches true material shared to harm. Do not rely on a defence you have not seen applied.
• Posting in anger first. The first reply is often the evidence. Silence until you have a plan costs you nothing.
• Complaining about a genuine critic. It can turn a small review into a large story and a risk for you.
• Using the wrong regime. Federal, DIFC and ADGM data requests go to different offices.

Your next step: sort first, then decide who should hold the file

We work on accurate, lawful routes. We do not help hide accurate public-interest reporting, and our ethics page states what we will and will not do.

Questions people ask

Is it illegal to leave a negative review in the UAE?

An honest review that states your experience is not what the offences describe. The risk comes from insulting language, attributing a contemptible quality to a named person, or sharing private material. Federal Decree-Law No. 34 of 2021 punishes insult in Article 43 and privacy invasion in Article 44. Keep to dates, facts and the service, avoid personal adjectives, and take advice if a business objects.

Can someone be prosecuted for posting true information?

Possibly. Article 44 of the cybercrime decree covers publishing private material "even if it is true and genuine, with intention of harming the person". Article 43 does not mention truth. We could not read the Crimes and Penalties Law defamation articles or any judgment showing how courts treat truth, so do not assume it protects you. Ask counsel before posting anything that concerns a person.

Does the UAE have a right to be forgotten?

The federal data protection law gives a right to request erasure in listed cases under Article 15, with exceptions including claims and other legislation. It governs controllers holding personal data. We could not confirm that it requires a news publisher or search engine to remove accurate reporting, and the DIFC and ADGM regimes are separate. Treat it as a data right, not a general deletion right.

How do I report a cybercrime in the UAE?

The u.ae portal says cybercrimes can be reported to the nearest police station or by calling 999, and it mentions online reporting channels without linking them in the text we read. Keep screenshots, URLs, dates and any threatening messages. Speak to counsel first if you have also posted about the same person, because a report can bring scrutiny to both sides.

Can a UAE order remove a post on a foreign platform?

The decree allows authorities to issue writs and blocking orders, and it sets fines for failing to remove content on order. Whether a foreign platform complies depends on that platform and on where it operates, and the official texts we read do not settle it. A platform report under its own rules is usually the faster first step.

Which law applies if my data is held by a company in DIFC or ADGM?

The federal law says it does not apply to free-zone companies with their own data legislation. DIFC and ADGM each have their own data protection regime and office; the DIFC law lets you complain to its Commissioner under Article 60. Send your request to the organization first, name the regime, and check the zone's pages for how to complain to its data protection office.