Dubai Court of Cassation Confirms Strict Reading of Article 8 of the UAE Cybercrime Law

6 min 23 sec

Written by

Mohamed Selim

Senior Associate

m.selim@tamimi.com View LinkedIn Profile

Eslam Hassan Ali

Senior Associate

e.hassan@tamimi.com View LinkedIn Profile

As businesses increasingly rely on digital tools and remote working, the line between convenience and criminal liability can be a fine one. In a judgment issued on 12 August 2026 in Cassation No. 794 of 2026, the Dubai Court of Cassation upheld the conviction of a senior executive who had forwarded his employer’s confidential project data from his work email account to his personal email account without authorisation and in breach of the company’s information security and data loss prevention (DLP) policies.

The judgment confirms a strict reading of Article 8 of Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes (the Cybercrime Law) and offers important guidance for employers and employees alike.

Case background

The accused held the position of chief executive of projects at a leading commercial real-estate company with a portfolio valued in the billions of dirhams. On 6 February 2024, the day before his employment was terminated, he forwarded confidential information relating to the company’s projects — to which he had access by virtue of his position — from his corporate email account to his personal email account without the company’s authorisation. The company’s DLP systems detected the transfer.

The Public Prosecution charged him under Article 126(1) of the Federal Crimes and Penalties Law and Article 8 of the Cybercrime Law. The company also filed a civil claim seeking provisional compensation.

On 27 February 2025, the Criminal Court of First Instance sentenced the accused to three months’ imprisonment and a fine of AED 500,000, ordered his deportation and ordered the deletion of the company’s data from his personal email account, while referring the civil claim to the competent civil court. The custodial sentence fell below the statutory minimum because the court exercised its discretion to reduce the penalty under Article 99(3) of the Federal Crimes and Penalties Law.

The accused appealed the first instance judgment. The Criminal Court of Appeal appointed an IT expert from His Highness the Ruler’s Court, who confirmed that the files had been transferred from the accused’s corporate email account to his personal email account without any authorisation or exception permitting the transfer.

On 11 March 2026, the Criminal Court of Appeal dismissed the appeal on the merits and upheld the first instance judgment, while suspending the custodial sentence for three years. The accused then appealed to the Court of Cassation.

Before the Court of Cassation, the accused argued that, as a senior manager required to work outside the office, he had prior authorisation to send the email for work purposes. In support, he relied on his offer letter, a consultant’s technical report, and WhatsApp messages allegedly showing that documents had previously been exchanged through personal channels. He further argued that there was no evidence that he knew of his termination, that his statements did not amount to a confession, and that the court-appointed expert’s report was deficient.

The Court’s findings

The Court of Cassation dismissed the appeal and ordered the forfeiture of the appeal deposit. Its key findings were as follows.

Article 8 imposes an absolute prohibition

Article 8 punishes, with temporary imprisonment of not less than five years and a fine of between AED 500,000 and AED 3 million, anyone who, without authorisation, obtains, possesses, modifies, destroys, discloses, leaks, cancels, deletes, copies, publishes, or republishes confidential information or data of a financial, commercial, or economic establishment using information technology or an information technology means.

The Court held that the provision imposes an absolute prohibition on these acts, permitting them only with the authorisation of the establishment concerned, which reflects the legislature’s aim of protecting confidential corporate data in light of the spread of information technology. The Court also noted that the subsequent amendment introduced by Federal Law No. 5 of 2024 did not alter the substance of the original text.

Notably, in earlier criminal cases involving similar conduct, the UAE criminal authorities in practice applied Article 45 of the Cybercrime Law (or, depending on the circumstances, its near equivalent, Article 432 of the Federal Crimes and Penalties Law) rather than Article 8.

Article 45 penalises anyone who, without authorisation, electronically discloses confidential information obtained in the course of, or by virtue of, their work, job, or profession. In practice, the authorities typically required evidence either that the employer had suffered harm as a result of the disclosure, or that the employee had unlawfully obtained a benefit for themselves or for a third party through it. These elements are often difficult to prove, which may lead to the dismissal of criminal proceedings.

Article 8 does not require the level of evidence needed under Article 45, nor does it require the information to be disclosed to a third party. The offence under Article 8 is more straightforward: it is complete once the unauthorised act itself is proven (for example, copying confidential data or forwarding it to a personal email account).

As the Criminal Court of First Instance put it, this is an offence of endangerment, requiring neither harm to the establishment nor disclosure or use of the information for personal benefit. In this case, therefore, it made no difference whether the accused had passed the information on to anyone else. Indeed, the court-appointed expert found no evidence that he had disclosed, published or exploited it, yet the conviction stood.

No authorisation, no defence

The court-appointed technical expert found that the data was classified as highly sensitive under the company’s internal classification, that internal instructions prohibited the use of personal email or external storage to keep or transfer company files, and that no contractual document, formal authorisation, or documented exception permitted the accused to depart from those instructions. On this basis, the Court held that the defence of prior authorisation was manifestly invalid.

The accused’s work-from-home justification also failed on the facts. The company had provided him with corporate devices, including a laptop and an iPad, which allowed him to perform his duties remotely without using his personal email account. The Court therefore rejected his explanation that he had forwarded the files to his personal email account in order to work from home, noting that the emails were sent only one day before his employment was terminated.

Key takeaways

Knowledge of termination was immaterial

While the lower courts found that the accused knew he was about to be dismissed and copied the data the day before, the Court held that whether he knew of his termination or not, it had no bearing on the establishment of the offence.

Departure from previous practice

This judgment departs from previous practice. The matter was not treated as a case of an employee disclosing confidential information, which would have required proof of additional elements. Instead, the judgment reinforces a new approach of applying Article 8 to employees who, without authorisation, electronically copy confidential information and/or forward it from their corporate email account to their personal email account.

As the UAE has a civil law system, there is no doctrine of binding precedent as in common law jurisdictions. Accordingly, while this judgment highlights the new approach, there is no guarantee that it will be followed in future cases, and the position remains to be tested.

Settlement vs. the right of the state

Importantly, an Article 8 offence cannot be settled. Article 67 of the Cybercrime Law allows the Public Prosecution or the Court to accept reconciliation with the accused, which ends the criminal case, but only for the offences listed in that article, and Article 8 is not among them.

For offences not so listed, the State retains the right to pursue criminal proceedings irrespective of any settlement with, or waiver by, the victim. As such, once a complaint is made and the Public Prosecution brings charges, a later settlement with, or waiver by, the employer will not necessarily bring the criminal proceedings to an end.