Using a VPN in the UAE: Recent change in law

An amendment to the 2012 Cyber Crime Law has seen an increase in the sanctions for use of a virtual private network (VPN) for criminal purposes. There has been no change to the substance of the offence or the ability of firms to use VPNs in their internal networks.

Article 9 of Federal Law Number five of 2012 on Combatting Cyber Crimes made it an offence to use a false IP address “for the purpose of committing a crime or preventing its discovery”. The offence was punishable by imprisonment or a fine between AED 150,000 and AED 500,000, or both.

Federal Law Number 12 of 2016 on Combatting Cyber Crimes, which amends Article 9 but otherwise leaves the 2012 law unchanged, has recently been enacted. Although the description of the Article 9 offence has been modified, the substance of the offence continues to relate to the use of a false IP address “for the purpose of committing a crime or preventing its discovery”. The sanctions for the offence, however, have significantly increased: the offence will be punishable by imprisonment or a fine between AED 500,000 and AED 2,000,000, or both.

The amendment to Article 9 prompted reports in the local press that the use of a VPN in the UAE had become unlawful. In response, the UAE Telecommunications Regulatory Authority issued a statement reassuring firms that the amended Article 9 does not “prevent the use of VPN technology by companies, institutions and banks to access their internal networks through internet”.

Contact us if you have any concerns about whether your use of VPN or other technologies to access systems in or outside the UAE is compliant with the law.