Entrusting another person with confidential information is ultimately an act of trust. In the United Arab Emirates, this trust is strongly protected by law. Whether the information concerns an employer’s business plans, a client’s personal data, a government project, or a company’s trade secrets, disclosing secrets can lead to severe civil and criminal liability. Understanding when a person is legally “entrusted with secrets” and what constitutes unlawful “disclosing secrets” is therefore essential for anyone living and working in the United Arab Emirates.
The United Arab Emirates protects confidentiality through Federal Law by Decree No. 31 of 2021 Promulgating the Crimes and Penalties Law, Federal Decree by Law No. 33 of 2021 Concerning Regulating Labour Relations, Federal Decree-Law No. 34 of 2021 On Countering Rumors and Cybercrimes, Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data, Federal Law by Decree No. 32 of 2021 Concerning Commercial Companies, and Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights. These federal decree laws are in force and, together with their executive regulations, resolutions and sector-specific rules that are expressly applicable to each statute, form the core of the modern regime governing disclosure of secrets.
This article explains the key legal rules on disclosing secrets under United Arab Emirates law, the meaning of being entrusted with secrets, the interaction with labour, cybercrime and data protection provisions, and practical steps that residents and businesses should take to remain compliant and protect their rights.
Legal framework governing disclosure of secrets in the UAE
The general criminal rules relevant to unlawful disclosure of secrets are set out in Federal Law by Decree No. 31 of 2021 Promulgating the Crimes and Penalties Law, which repealed Federal Law No. 3 of 1987 and entered into force on 2 January 2022. This federal decree law is in force and constitutes the primary source on criminal liability for unlawful disclosure of confidential information.
Within this law, several provisions deal with disclosure of secrets in different contexts, including:
- Disclosure of professional or occupational secrets by persons who, by virtue of their profession, craft, position or art, have been entrusted with secrets and divulge them without lawful justification.
- Disclosure of official secrets, particularly by employees in government entities or those performing a public function, with higher penalties where state interests, public security or defence information are involved.
- Disclosure connected with privacy, honour and reputation, including where the disclosure is made using modern means of communication and information technology.
Specialised legislation then complements these general rules for particular types of information:
- Employment and workplace information – Federal Decree Law No. 33 of 2021 on the Regulation of Labour Relations, together with its implementing regulations and circulars issued by the Ministry of Human Resources and Emiratisation, imposes a legal duty of confidentiality on employees, protects work secrets, and permits the inclusion of non‑disclosure and non‑competition clauses to safeguard an employer’s legitimate interests.
- Cyber and electronic disclosures – Federal Decree Law No. 34 of 2021 on Combatting Rumours and Cybercrimes criminalises unlawful access to information systems, disclosure of data obtained through such access and spreading confidential or misleading information online. It replaced the former Federal Law No. 5 of 2012 on Combatting Cybercrime and remains the main reference governing online conduct in this area.
- Personal data and privacy – Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data establishes the federal personal data protection framework in the United Arab Emirates. References to executive regulations or implementing decisions should be made only where the specific instrument is separately identified and cited.
- Commercial and industrial secrets – Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights is the clearer federal statute governing undisclosed information. Federal Law by Decree No. 32 of 2021 Concerning Commercial Companies also contains narrower confidentiality provisions, including Article 354 on disclosure of company secrets, but it should not be described as the principal general statute on trade secrets.
- Civil liability and remedies – Civil and commercial claims may arise under contract, tort and the relevant special statutes. In particular, Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights provides an express right to claim compensation and seek precautionary measures in the event of infringement of protected undisclosed information.
This framework means that disclosing secrets in the United Arab Emirates can trigger both criminal proceedings led by the Public Prosecution and civil proceedings initiated by the injured employer, business partner, individual or other rights holder through the courts.
Meaning of entrusted with secrets and scope of protected information
The concept of being “entrusted with secrets” is central to understanding criminal liability under United Arab Emirates law. According to legal interpretation of Federal Decree Law No. 31 of 2021 by United Arab Emirates courts and commentators, a person is considered entrusted with secrets when:
- He or she acquires the secret by virtue of his or her position, profession, craft, or service (for example, employee, manager, lawyer, doctor, accountant, engineer, public servant, consultant, technician or contractor).
- The information is not generally known or easily accessible to the public.
- The person knows, or ought reasonably to know, that the information is confidential and not to be disclosed except in clearly defined circumstances.
United Arab Emirates law deliberately uses broad wording when defining the types of secrets protected. Although there is no single exhaustive definition of “confidential information”, the courts and legal practice in the United Arab Emirates generally recognise the following as capable of being protected secrets:
- Commercial and trade secrets such as formulas, designs, source code, manufacturing methods, business strategies, pricing structures, supplier lists, client databases, tenders, financial forecasts and marketing plans.
- Technical and scientific information including research data, prototypes, inventions not yet disclosed in patent applications and technical know‑how.
- Personal and private data of individuals such as identification details, medical records, financial information, location data and any data that can identify a person, particularly where collected and processed by employers, banks, hospitals, educational institutions or digital platforms.
- Workplace information such as internal policies, disciplinary records, investigation files, performance reviews, salary structures and information about internal disputes, provided these are not officially public.
- Official and governmental information including non‑public documents, policy drafts, security‑related data and information concerning the defence of the state or its international relations, as set out in specific provisions of the Crimes and Penalties Law and other federal legislation dealing with state security and public order.
The critical element is not only the sensitivity of the information but also the context in which it is received. If an individual obtains information in the course of performing a function where trust is essential, that individual is generally regarded as entrusted with secrets. Once entrusted, that individual may owe a continuing duty of confidentiality, even after the employment or contractual relationship ends, unless a specific legal or contractual provision provides otherwise. In the employment context, this approach has been confirmed in practice by the United Arab Emirates courts, and should be stated by direct reference to Article 16 of Federal Decree by Law No. 33 of 2021 Concerning Regulating Labour Relations and to the applicable contractual confidentiality obligations.
Criminal offences for disclosing secrets under the Crimes and Penalties Law
Under Federal Decree Law No. 31 of 2021 on the Crimes and Penalties Law, unauthorised disclosure of secrets is treated as a formal crime. Legal analysis and judicial practice confirm that the offence is complete once the act of disclosure occurs, regardless of whether financial loss or material harm can be proven. The act of disclosing secrets in breach of a legal duty of confidentiality can therefore be sufficient to trigger criminal liability.
The general rules may be summarised as follows, based on the current text of the law and official explanatory materials:
- Any person who, by virtue of his or her profession, craft, position or art, is entrusted with secrets and discloses them without lawful justification may face imprisonment and a fine. The penalties can include at least 1 year of imprisonment and significant financial penalties, particularly where the disclosure is intentional and involves sensitive, private or commercially valuable information.
- If the person disclosing secrets is a public employee or is deemed to perform a public function, the penalty is increased. In serious cases involving state security, defence or vital national interests, the Crimes and Penalties Law allows for very severe sanctions that may extend to long‑term imprisonment.
- Where the disclosure involves invasion of privacy, such as publishing private images, recordings or correspondence without consent, the crime may be prosecuted under both the general provisions of the Crimes and Penalties Law and the specialised cybercrime provisions, with cumulative penalties depending on the specific facts.
The intention of the legislator, as reflected in official commentaries, is to protect both private and public interests by deterring any misuse of confidential information that a person acquires because others have placed their trust in that person. The law does not require that the accused receive a financial benefit from the disclosure for the crime to be established. Personal motives such as revenge, curiosity, or desire to embarrass another person are sufficient if they result in unlawful disclosure that satisfies the legal elements of the offence.
Defences are limited. In certain restricted situations, disclosure may be justified by law, for example:
- Where an individual is legally required to provide information to a competent authority such as the police, the Public Prosecution, the courts, a regulatory body or another official investigation body.
- Where professional rules permit limited disclosure in order to protect the public from harm, subject to strict conditions, such as certain obligations placed on auditors, compliance officers, healthcare professionals or financial institutions.
- Where the information has already become public by lawful means, and the disclosure does not add new confidential elements or breach specific statutory prohibitions that continue to apply even after partial disclosure.
Individuals should not assume that a perceived public interest or personal moral conviction is sufficient to excuse disclosure. Under United Arab Emirates law, the prudent course is always to consult a qualified law firm before disclosing any information that might fall within the category of secrets entrusted to them.
Workplace secrets labour law and employer employee obligations
For residents working in the private sector, the most immediate framework governing disclosure of workplace secrets is Federal Decree Law No. 33 of 2021 on the Regulation of Labour Relations and its executive regulations. According to official guidance issued by the Ministry of Human Resources and Emiratisation, this federal decree law is the primary instrument regulating employment relationships in the United Arab Emirates mainland private sector.
Key points regarding confidentiality and work secrets include:
- Statutory duty of confidentiality – Article 16 of Federal Decree Law No. 33 of 2021 imposes obligations on employees to respect the confidentiality of work secrets and to refrain from retaining, in a personal capacity, any original papers or copies of documents relating to such secrets without the employer’s permission. This statutory duty applies during employment and, in many situations, continues after termination where the nature of the information and the terms of the contract so require.
- Non‑disclosure and non‑competition clauses – Employers may, where the nature of the role allows access to clients or work secrets, include contractual clauses prohibiting the worker from competing with the employer for a specified period after the end of the employment. Under Federal Decree Law No. 33 of 2021 and its executive regulations, the non‑compete period generally must not exceed 2 years from the date the employment ends, and must be reasonable in terms of geographic scope and type of activity, in order to be enforceable.
- Serious misconduct and dismissal – Under Article 44(5) of Federal Decree by Law No. 33 of 2021 Concerning Regulating Labour Relations, the employer may dismiss a worker without notice, after written investigation and a reasoned written decision, if the worker discloses work secrets related to industrial or intellectual property and this results in losses to the employer, loss of an opportunity for the employer, or personal benefit to the worker.
- Fines for public officers under labour legislation – Persons charged with implementing the Labour Law who disclose work secrets that come to their knowledge by virtue of their position may face fines, even after they leave their public position, illustrating the seriousness with which the United Arab Emirates legal system treats confidentiality at all levels.
In parallel, employers and other rights holders may pursue civil remedies for breach of confidentiality under the applicable contract, the general rules of civil liability, and the relevant special legislation. Where the matter concerns undisclosed information, Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights provides the safer and more precise statutory basis for compensation and precautionary measures. The present draft should not state that the Civil Transactions Law contains special limitation rules specifically for trade-secret claims unless the exact statutory provision is identified and cited.
For employees and managers living in the United Arab Emirates, the practical consequences are clear:
- Everything learned in the course of employment that is not obviously public should be treated carefully and should not be shared with competitors, friends, family or on social media without explicit authorisation.
- Documents, spreadsheets, emails, lists and digital files belonging to the employer should not be copied to personal devices or cloud accounts without explicit, written permission and a clear business need.
- Before moving to a new employer, especially a competitor, a worker should carefully review any non‑competition and non‑disclosure clauses and seek advice from a law firm to avoid accidental violation.
Cybercrime online disclosures and digital confidentiality
In the digital era, many instances of disclosing secrets in the United Arab Emirates occur through electronic means. This reality is addressed directly by Federal Decree Law No. 34 of 2021 on Combatting Rumours and Cybercrimes, which came into force on 2 January 2022 and superseded earlier cybercrime legislation. This law remains in force and is a principal reference governing online activity, including social media, messaging applications and other digital platforms.
Federal Decree Law No. 34 of 2021 interacts with Federal Decree Law No. 31 of 2021 and extends protection in several important ways:
- Unauthorised access and extraction of data – Unauthorised access to any website, information system, network, or electronic data, even without causing damage, is a criminal offence. If the offender copies, transfers, alters, destroys or discloses data obtained through such access, the penalties increase significantly. Where the data relates to a bank, a health institution, a governmental body or is classified as confidential or sensitive, fines and imprisonment terms are higher.
- Electronic publication of secrets – Publishing or sharing confidential information relating to individuals, companies or government entities on social media platforms, messaging applications, or websites, without consent and without lawful justification, may be punished under the Cybercrime Law. The law specifically targets the use of technology to violate privacy, reputation and confidentiality and contains provisions addressing photographs, videos, voice recordings and electronic correspondence.
- Spreading false or misleading information – The Cybercrime Law criminalises the creation or dissemination of false or misleading content which may disturb public order, harm state interests, affect public health or safety, or damage the reputation of individuals or institutions. Even if the content contains elements of truth, sharing confidential elements without permission can still amount to disclosing secrets in a manner that is punishable.
- Use of electronic devices and applications – Penalties can apply not only to those who create or publish confidential or unlawful material, but also to those who host, store, manage or administer it through applications or systems if they are aware of the unlawful nature of the content and fail to act in accordance with their legal obligations.
In practice, this means that an employee who forwards internal documents to a private email, uploads client lists to a personal cloud account, or shares screenshots of workplace chats containing confidential information may face charges under both the Crimes and Penalties Law and the Cybercrime Law. The United Arab Emirates authorities treat such offences seriously, especially where they relate to security, public health, financial institutions, critical infrastructure or matters of public order.
Individuals and companies in the United Arab Emirates should therefore implement strong digital security and awareness measures, including:
- Clear internal policies on the use of email, cloud storage, portable devices, remote access and personal devices used for work (often referred to as bring‑your‑own‑device arrangements).
- Technical controls such as access restrictions, encryption, multi‑factor authentication and monitoring of data transfers for critical systems and repositories of confidential information.
- Training for employees on the legal implications of forwarding, copying, or posting work‑related information online or on personal devices, with specific reference to the Cybercrime Law, the Crimes and Penalties Law and data protection obligations.
- Quick reporting mechanisms so that suspected cyber breaches, phishing incidents or accidental disclosures can be escalated to management, information technology teams and legal counsel without delay, and so that appropriate reports can be submitted to competent authorities where required.
Remedies penalties and practical guidance for UAE residents and businesses
When secrets are disclosed in breach of United Arab Emirates law, several types of remedies and penalties may apply, depending on the nature and seriousness of the act and on whether the conduct is pursued under criminal, civil, administrative or regulatory procedures.
From the criminal perspective, according to the Crimes and Penalties Law and the Cybercrime Law as applied by the courts and interpreted by official entities such as the United Arab Emirates Ministry of Justice, the United Arab Emirates Public Prosecution and sectoral regulators:
- Persons entrusted with secrets who disclose them unlawfully may face imprisonment, which can extend to several years, and fines that may reach hundreds of thousands or, in some cyber‑related cases, millions of dirhams.
- If the offender is a public employee, or if the disclosed secrets concern state security, defence, public order or other vital interests, the penalties are aggravated and may extend to long‑term imprisonment, in some instances with additional consequences such as removal from public office or deportation for non‑citizens after serving the sentence, depending on the applicable provisions.
- For cyber‑related disclosures, penalties are harsher if the data is governmental data, banking data, health data, or other categories defined as especially sensitive under the Cybercrime Law, the data protection legislation or sector‑specific regulations.
From the civil and commercial perspective, parties whose secrets have been disclosed may:
- File a civil lawsuit seeking compensation for direct and indirect damages, including loss of profits, loss of business opportunities, reputational damage, costs of mitigation and, where applicable, moral damages.
- Seek urgent interim measures from the courts, such as orders to cease disclosure, to prevent further use of the information, to remove content from websites or social media, to preserve evidence, or to seize devices for forensic analysis, where the legal conditions for such measures are met.
- Invoke contractual penalties, indemnities, liquidated damages provisions, or specific performance clauses contained in non‑disclosure agreements, employment contracts, partnership agreements, franchise agreements, agency contracts or service contracts.
For residents and businesses wishing to avoid the risks associated with disclosing secrets under United Arab Emirates law, certain practical measures are advisable:
- For employers and companies in the United Arab Emirates
- Identify clearly what information constitutes confidential information, personal data or trade secrets in the organisation and label and handle it appropriately in accordance with internal policies.
- Ensure that employment contracts, consultancy agreements, agency contracts and service contracts contain well‑drafted confidentiality, non‑disclosure and non‑competition clauses that comply with Federal Decree Law No. 33 of 2021, Federal Decree Law No. 45 of 2021 and related regulations.
- Adopt internal policies and codes of conduct that explain, in clear and precise terms, the meaning of entrusted with secrets and the consequences of disclosing secrets, with defined disciplinary procedures for breaches and clear reporting lines.
- Provide regular training to employees and contractors on confidentiality, data protection and cybercrime risks, tailored to the specific industry and to the functions that involve higher exposure to confidential or sensitive information.
- Implement technical safeguards such as controlled access, role‑based permissions, log monitoring, data loss prevention tools and secure communication channels, especially for sensitive client, government or strategic projects.
- When a breach is suspected, promptly instruct a qualified law firm to advise on criminal complaints, civil actions, labour measures, data protection notifications where applicable, and remedial steps such as internal investigations and communication with affected parties.
- For employees and individuals in the United Arab Emirates
- Read carefully all confidentiality, non‑disclosure and non‑competition clauses before signing a contract. Ask for clarification where needed and, where appropriate, obtain advice from a law firm before committing.
- Avoid transferring work documents to personal devices, personal emails or external applications unless clearly authorised in writing and genuinely necessary for the performance of duties, and in all cases comply with the employer’s information security and data protection policies.
- Refrain from discussing internal matters of the workplace, clients or public bodies on social media or with persons who have no need to know, regardless of privacy settings or perceived informality of the communication.
- When leaving a job, return all devices, documents and data belonging to the employer and do not retain copies, except where expressly authorised by the employer in a documented manner and in compliance with applicable laws.
- If an individual believes that disclosing certain information may be legally required or ethically necessary, for example to report a crime or a serious regulatory breach, it is essential to seek professional legal advice before taking any action, in order to reconcile reporting obligations with confidentiality duties.
The legal environment in the United Arab Emirates is dynamic and regularly updated to address new economic, technological and regulatory realities. However, the core principle remains constant: any person who is entrusted with secrets must protect them. Disclosing secrets without lawful justification can lead to serious consequences under the Crimes and Penalties Law, the Labour Law, the Cybercrime Law, the data protection legislation and related federal and sector‑specific regulations.
For that reason, whether an individual is an employer, employee, professional adviser, public servant, entrepreneur or investor living in the United Arab Emirates, it is prudent to treat all non‑public information with care, to implement robust confidentiality and data protection practices and to consult experienced law firms whenever questions arise about rights and obligations relating to entrusted secrets and disclosing secrets under United Arab Emirates law.
For any queries or services regarding legal matters in the UAE, you can contact us at (+971) 4 3298711, or send us an email at proconsult@uaeahead.com, or reach out to us via our Contact Form Page and our dedicated legal team will be happy to assist you. Also visit our website https://uaeahead.com
Article by ProConsult Advocates & Legal Consultants, the Leading Dubai Law Firm providing full legal services & legal representation in UAE courts.
