Anita Siassios

June 2013

With the GCC region tipped as being the world’s fastest-growing market for e-commerce, it is easy to understand how many traditional “bricks and mortar” stores are establishing an online presence alongside the ever-increasing number of online outlets. However, there are some legal issues that should be considered when engaging in e-commerce in the UAE, and set out below is an overview of these issues below.


The development of new technologies has meant that commercial transactions and contracts can now be entered into via a variety of electronic means. The most common methods of contracting with a customer are by ‘click-to-accept’ means (i.e. a physical act by the customer to indicate their consent to the contract) and deeming consent by a customer’s general use of a website.

In the UAE, the Electronic Transactions and E-Commerce Law (Federal Law No 1 of 2006) generally permits the execution of contracts between two parties via electronic means, and expressly states that the consent and acceptance of contracts may be expressed via electronic communications.

The risk of contracting in this manner is that the way in which the terms and conditions are delivered to the customer permits scope for the customer to dispute that any agreement ever occurred. Steps should be taken to ensure that there is as little scope as possible for there to be any dispute as to whether or not the terms and conditions of the contract have been considered and accepted by the customer. For example, have the customer ‘click-to-accept’ the terms which relate to his/her purchase of goods as opposed to just having the terms placed in the ‘legal’ section on the website where the customer may or may not see them.


If a website owner is collecting and using personal data, then it is essential that the collection and in particular use of the personal data is in accordance with applicable law.

Although there is no specific data protection legislation in the UAE (with the exception of some of the UAE’s free zones where specific legislation governs data protection in those free zones) data protection is governed and regulated by a combination of legislative and practical measures, including the UAE Penal Code.   Specifically, Article 379 prohibits the use or disclosure of ‘secret’ information without the consent of the person to whom the secret relates.

In an online setting it is essential that the basis upon which personal information is submitted by this “consent” take the form of an electronic contract between the user and the owner of the site. This electronic contract generally takes the form of a privacy policy of the website.


Content is the material that makes up a website, and includes all things such as images, text, audio-visual material, advertisements, graphics and user generated content.  Whether the content is owned by the owner of the website, or licensed to the website owner by a third party, the website owner should ensure that it has the necessary right to display the content on their website, and also regulate how users of the website use such content.  This is best achieved through the website terms and conditions.

If a website allows users to interact and upload comments, material, etc., it is necessary to consider whether or not the website terms and conditions adequately provide for this and appropriately address what users can/cannot upload. In addition, a website owner should consider what rights it is granted to the content uploaded by its users. For example, will the website owner require the right to edit, remove, copy, and/or share the content uploaded by users?

Finally, alongside all of this sits the UAE regulatory regime which governs content (including digital content).  The key laws and regulations are the Publications and Publishing Law – UAE Federal Law No 15 of 1980, the Cyber Crimes Law – UAE Federal Decree No 5 of 2012 on Combating Cybercrimes and the National Media Council Resolution No. 20 of 2010 on the Criteria for Media Content.  For entities either set up in TECOM in Dubai or in 2454 in Abu Dhabi, the TECOM Codes of Guidance 2003 and the Media Zone Authority Content Code apply to these entities respectively.

Entities based in the UAE, and to some extent, entities based outside of the UAE specifically targeting customers within the UAE need to ensure they comply with these laws and regulations or else risk receiving any of the penalties prescribed in these laws and regulations.  Some of the penalties are quite severe, particularly under the new Cyber Crimes Law (fines can reach up to 1m dirhams, depending on the infringement).


Retailers often conduct promotional campaigns to drive consumer traffic to their stores. In the UAE, promotional campaigns offering incentives or benefits in the form of instant prizes are categorized as sales promotions. Sales promotions are regulated on an emirate-by-emirate basis by the relevant Department of Economic Development. (The relevant authority in Dubai is the Dubai Department of Economic Development, for example.)

The issue of whether on-line sales promotions are subject to this requirement raises an interesting issue, particularly for promotions operated from off-shore. Ultimately, however, for entities based outside of the UAE and targeting consumers in the UAE, compliance with the local regulatory regime cannot be discounted and can still require consideration.


Many entities, whether online or otherwise, are more and more frequently using social media to reach a wider audience and promote their business.  We regularly advise our clients to ensure that they have effective social media policies in place to regulate their employees’ use of social media and to ensure that there is a consistent approach with how the business is promoted. More importantly, the social media policy will (hopefully) raise awareness to the individual employees that the regulatory regime governing content also applies to content displayed on social media platforms.  Simply posting comments on behalf of an employer does not exonerate an employee of any liability under this regulatory regime.


E-commerce transactions generally require some form of an online payment gateway to facilitate the transaction. There are a range of such providers operating in the UAE. The website owner will generally enter into an agreement with the gateway provider, to provide certain services for the payment of a fee. For e-commerce businesses that rely on online payments, it is necessary to carefully consider the terms of agreements with gateway providers, and in particular ensure that the gateway providers provide adequate assurances that the transactions facilitated by their systems will be completed.