UAE Recording Laws: All-Party Consent Rules and Penalties (2026)

The United Arab Emirates requires all-party consent to record any private conversation. Under Article 44 of Federal Decree-Law No. 34 of 2021, unauthorized recording carries a minimum six months imprisonment and fines between AED 150,000 and AED 500,000; consent must come from every participant before recording begins.

Overview: Is the UAE an All-Party Consent Jurisdiction?

The United Arab Emirates is a strict all-party consent jurisdiction. Every private conversation in the country is protected by a consent requirement, meaning that no one may record, transmit, or disclose a private exchange without the knowledge and agreement of all participants. This rule flows from Article 31 of the UAE Constitution, which guarantees the freedom and confidentiality of communications by post, telegraph, or other means of communication. Three interlocking federal statutes give that constitutional guarantee its teeth: the Cybercrimes Law, the Crimes and Penalties Law, and the Personal Data Protection Law.

This is not a suggestion or a civil guideline. It is criminal law, backed by mandatory prison sentences and six-figure fines. The UAE courts regularly prosecute privacy violations, and law enforcement treats unauthorized recording as a serious criminal matter.

The legal framework has expanded steadily since 2021. In addition to the longstanding Penal Code provisions, the Cybercrimes Law (Federal Decree-Law No. 34 of 2021) introduced technology-specific penalties and addressed new categories of harm including deepfakes. The Personal Data Protection Law (PDPL) layered on data processing obligations, and the ADGM and DIFC free zones operate their own parallel regimes. For residents, business owners, and visitors alike, the rules are the same: get consent first.

Federal Decree-Law No. 34 of 2021 (Article 44): The Cybercrimes Law

The primary statute governing unauthorized recording in the UAE is Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes. Article 44 of this law directly addresses privacy violations carried out through electronic means.

Constitutional Foundation: Article 31

Before examining Article 44, it is worth noting where it comes from. The UAE Constitution's Article 31 enshrines the freedom and confidentiality of communications, making privacy protection a constitutional obligation on the state and not merely a policy preference. The Cybercrimes Law, the Crimes and Penalties Law, and the PDPL all derive their legitimacy from this constitutional mandate.

What Article 44 Prohibits

Article 44 makes it a criminal offense to use any information network, electronic information system, or information technology to infringe upon the privacy of any person without their consent and outside circumstances permitted by law. The prohibited conduct specifically includes:

• Eavesdropping on conversations or communications
• Recording private conversations, whether by phone or any other medium
• Transmitting or forwarding recorded conversations to third parties
• Disclosing or publishing audio or visual material of a private nature

The scope is broad. "Information technology means" covers smartphones, laptops, VoIP platforms, messaging applications, and any other digital tool capable of capturing audio or video.

Criminal Intent Requirement

UAE courts have clarified that two elements must be established for criminal liability under Article 44: first, that the offender intended to invade the third party's privacy; and second, that the recording was made without the other person's permission. Good-faith documentation of unlawful conduct, such as a person recording an imminent crime to report it to authorities, may negate criminal intent. This does not create a general exception; it requires genuine good-faith purpose and is assessed case by case.

Penalties Under Article 44

Base violations carry a minimum of six months imprisonment and a fine between AED 150,000 (approximately USD 40,800) and AED 500,000 (approximately USD 136,000). Courts may impose the imprisonment, the fine, or both.

The aggravated form of the offense applies when the offender alters, manipulates, or edits a recording, image, or video to defame or harm someone. The aggravated penalty is a minimum of one year imprisonment and a fine between AED 250,000 and AED 500,000. Targeting a public servant or public official due to the performance of their duties is also treated as an aggravating factor.

How It Applies to Digital Platforms

Article 44 explicitly covers recordings made through any information network. That means the law applies equally to:

• Standard phone calls on mobile or landline
• Voice calls over internet platforms (Zoom, Microsoft Teams, Google Meet)
• Voice messages sent through messaging apps
• Video recordings of private interactions captured on any device

The law draws no distinction between recording a conversation you participate in versus recording someone else's conversation. Both are prohibited without consent.

Article 43: Online Defamation Using Recordings

Article 43 is distinct from Article 44 but often arises alongside it. Article 43 criminalizes damaging another person's reputation or provoking disrespect through information systems. Where a recording is shared online to humiliate, embarrass, or harm the reputation of the person recorded, the publisher may face liability under both Article 44 (for the unauthorized recording) and Article 43 (for the reputational harm caused by disclosure). Penalties under Article 43 include imprisonment up to two years and fines between AED 250,000 and AED 500,000. In aggravated circumstances, provisional imprisonment can reach 10 years.

Article 42: Extortion and Threats Using Recordings

Article 42 addresses a particularly serious category: using a recording as a weapon to extort or coerce someone. Where a person threatens to release a private recording unless the victim performs an act or refrains from one, Article 42 applies. Penalties start at detention up to two years and a fine between AED 250,000 and AED 500,000. If the threat involves harm to honour or reputation and is accompanied by an express or implied demand, the penalty rises to provisional imprisonment up to 10 years. Sextortion scenarios, where intimate recordings are used to extract money or compliance, fall squarely within Article 42.

Crimes and Penalties Law: Articles 431, 432, and 433

Beyond the Cybercrimes Law, the UAE's general criminal code provides additional penalties for recording violations. Federal Decree-Law No. 31 of 2021, the Crimes and Penalties Law, contains provisions that predate the Cybercrimes Law and remain fully enforceable.

Article 431: Privacy and Family Life

Article 431 creates a standalone criminal offense for anyone who interferes with an individual's right to privacy and family life through any of the following acts:

• Eavesdropping on, recording, or transmitting conversations conducted privately, by phone, or through any other device
• Taking or transmitting photographs or video of a person in a private setting without their consent or legal authorization

The penalties under Article 431 include imprisonment and a fine. Courts also have the authority to order confiscation of the devices used in the offense and the deletion of any recordings obtained illegally.

Article 432: Professional Confidentiality

Article 432 is a distinct provision targeting professionals who have access to private information by virtue of their occupation: doctors, lawyers, accountants, therapists, and similar roles. Disclosing a client or patient's secrets, including any recordings made in a professional context, is a criminal offense under Article 432. This provision reinforces the broader consent framework by protecting information shared under an implied duty of confidentiality.

Article 433: Communication Privacy

Article 433 addresses a related but distinct offense: the unauthorized opening of letters, telegrams, or other private communications, and eavesdropping on telephone calls. This provision reinforces the principle that all forms of private communication, whether written, spoken, or electronic, are protected from unauthorized interception.

Penalties under Article 433 include fines and potential imprisonment.

Overlap Between the Statutes

A single act of unauthorized recording can trigger prosecution under both the Cybercrimes Law (Article 44) and the Crimes and Penalties Law (Article 431). Prosecutors have discretion to charge under one or both statutes depending on the circumstances. In practice, Article 44 tends to be the primary charge for technology-based recording, while Article 431 applies more broadly to any recording method, including physical surveillance devices.

Sharia Principles and Privacy

The UAE's legal system draws on Sharia principles alongside civil-law statute, and Islamic jurisprudence treats privacy as a fundamental value. Classical Islamic legal scholarship considers unauthorized intrusion into private communications impermissible, and this cultural and religious norm reinforces the strict approach reflected in UAE statutory law. While the criminal statutes are civil-law instruments, practitioners note that the Sharia foundation explains why UAE legislators set one of the world's highest fine floors for recording violations, and why courts approach such cases with limited tolerance for technical defenses.

Voyeurism and Hidden Camera Offenses

UAE law does not use the term "voyeurism" as a distinct statutory category, but unauthorized recording of intimate or private images is addressed through multiple overlapping provisions. Article 431 of the Crimes and Penalties Law criminalizes photographing or filming a person in a private setting without consent, which covers hidden cameras placed in bedrooms, bathrooms, changing rooms, or similar locations. Where the recording is made or transmitted through electronic means, Article 44 of the Cybercrimes Law applies as well.

If the offender alters, edits, or manipulates the intimate recording to defame, humiliate, or extort the victim, the aggravated penalties under Article 44 apply (minimum one year imprisonment, AED 250,000-500,000 fine), and where extortion is involved, Article 42 can impose up to 10 years provisional imprisonment.

Courts routinely order confiscation of recording equipment and destruction of the recordings in these cases.

The Personal Data Protection Law (PDPL)

Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, represents the UAE's first comprehensive federal data privacy statute. While it does not specifically mention "recording," it applies to any processing of personal data, which explicitly includes voice recordings, audio files, and any data that can identify an individual.

Key Requirements for Recording Under the PDPL

The PDPL mandates that personal data processing must have a lawful basis. For most recording scenarios, the only viable basis is consent. The law sets a high bar for what qualifies:

• Freely given: The person cannot be coerced or pressured into agreeing
• Informed: The person must know exactly what is being recorded, by whom, and for what purpose
• Explicit: Consent must be demonstrated through a clear affirmative action, not silence or pre-checked boxes
• Specific: The consent must relate to a specific processing activity, not a blanket authorization
• Revocable: The person retains the right to withdraw consent at any time

Organizations that record calls or meetings must also comply with data subject rights, including the right to access recorded data, request its deletion, and object to its continued processing.

Enforcement and Regulatory Status

The PDPL is enforced by the UAE Data Office, established under Federal Decree-Law No. 44 of 2021. The core obligations of the PDPL have been in force since the law's enactment, but executive regulations that would clarify detailed implementation procedures had not yet been published as of May 2026. The Data Office is still solidifying its enforcement infrastructure. Businesses cannot wait for executive regulations before complying; the PDPL's obligations apply regardless of whether the full regulatory apparatus is in place.

ADGM and DIFC: Parallel Free-Zone Data Protection Regimes

Two financial free zones within the UAE operate their own independent data protection frameworks, separate from the federal PDPL and enforceable by their own regulators. Businesses and individuals operating inside these zones are subject to both the federal criminal statutes (which apply territory-wide) and the applicable free-zone data protection law.

ADGM Data Protection Regulations 2021

The Abu Dhabi Global Market Data Protection Regulations 2021 (ADGM DPR) govern personal data processing within the ADGM financial free zone, located on Al Maryah Island in Abu Dhabi. The DPR is aligned closely with the EU General Data Protection Regulation (GDPR) and was updated in February 2021.

Under the ADGM DPR, consent for processing personal data, including voice recordings, must be freely given, specific, informed, and unambiguous. The person must signal agreement through a statement or a clear affirmative action; silence, inactivity, or a pre-ticked box is not sufficient.

The ADGM Office of Data Protection (ODP) enforces the DPR independently of the federal UAE Data Office. Businesses registered in ADGM that record client calls, employee conversations, or meetings must comply with the ADGM DPR requirements for consent, retention, access rights, and cross-border transfers. Guidance documents are available directly from the ADGM ODP.

DIFC Data Protection Law No. 5 of 2020

The Dubai International Financial Centre Data Protection Law (DIFC Law No. 5 of 2020) came into force on July 1, 2020, and is enforced by the DIFC Commissioner of Data Protection. The DIFC DP Law requires that consent be freely given through a clear affirmative act. Notably, consent is not considered freely given if performance of a contract or service is made conditional on providing it.

For any business operating within the DIFC that records client calls, board meetings, or employee interactions, the DIFC DP Law imposes obligations on top of the federal criminal prohibitions: documented consent, retention limits, data subject rights, and a process for responding to access or deletion requests.

Practical Implication

A financial services firm based in DIFC that records client calls for compliance purposes must obtain affirmative, specific consent under both the DIFC DP Law and the federal PDPL framework. Federal criminal liability under Articles 44 and 431 applies regardless of whether the firm operates inside or outside the free zones.

Phone Calls vs. In-Person Conversations

Phone and VoIP Recordings

The UAE applies identical consent requirements to all telephone and VoIP recordings. Federal law does not distinguish between a traditional phone call and a conversation held over an internet-based platform.

One important practical note: the Telecommunications and Digital Government Regulatory Authority (TDRA) regulates VoIP services in the UAE. Many popular VoIP applications, including WhatsApp calls and FaceTime, are restricted by UAE telecom providers. Businesses must use TDRA-licensed VoIP services for voice communications, and any recording of those communications still requires all-party consent.

In-Person Conversations

Recording a face-to-face conversation without consent is equally illegal. Article 431 of the Crimes and Penalties Law makes no distinction based on the method of recording. Whether someone uses a smartphone, a hidden microphone, or a dedicated recording device, the legal standard is the same: all parties must consent.

This includes conversations in offices, restaurants, homes, and vehicles. There is no exception for conversations that take place in semi-public settings. If the participants have a reasonable expectation of privacy, the recording is protected.

Public Spaces: No Blanket Exception

Unlike many Western jurisdictions, the UAE does not provide a broad exception for recordings made in public spaces. While visible CCTV cameras in commercial areas and public streets are regulated and generally accepted, individuals cannot freely record other people in public without their consent.

Article 44 of the Cybercrimes Law and Article 431 of the Crimes and Penalties Law both apply to recordings made in any setting where a person has not consented. Photographing or filming someone in a public area may still constitute a privacy violation if the recording captures private interactions or is used to infringe on their dignity.

Dubai specifically requires commercial and residential buildings to install security surveillance under local regulations, and appropriate signage must be displayed wherever CCTV is deployed. Outside of Dubai, CCTV use in the broader UAE is less specifically regulated but remains subject to the federal privacy laws.

Recording Police Officers and Public Officials

Recording police officers or other public officials in the UAE is subject to the same all-party consent framework and is not treated as a special category of protected speech. Publishing or sharing a recording of a public official without consent may trigger Article 44 and, where the content damages their reputation, Article 43.

One narrow exception has been recognized in practice: recordings made during a police traffic stop may be permissible if the recording is made solely to document the stop for evidentiary purposes and is submitted directly to competent authorities. The recording may not be shared publicly or posted on social media. Any other use transforms the recording into a prohibited disclosure.

The law treats targeting a public servant or public official as an aggravating factor under Article 44, meaning penalties can exceed the base range when the recorded person is performing official duties at the time.

Watch out: A tourist filming a police officer on their phone and then posting the video to Instagram faces criminal exposure under both Article 44 (unauthorized recording) and Article 43 (potential reputational harm via public disclosure), regardless of how the interaction went. Shares can compound the liability.

Workplace Recording and Employee Monitoring

Employer Obligations

UAE law does not contain a standalone workplace monitoring statute. However, the general privacy laws apply fully to the employer-employee relationship. Employers who wish to monitor phone calls, emails, or workplace activities must:

• Establish a clear, written monitoring policy
• Disclose the policy to employees before monitoring begins
• Include monitoring provisions in employment contracts or company handbooks
• Limit monitoring to work-related purposes and company-owned systems
• Avoid monitoring private areas such as restrooms, prayer rooms, and break areas used for personal time

The Ministry of Human Resources and Emiratization (MOHRE) has not issued specific guidelines on employee monitoring, but the federal privacy laws and the PDPL set the boundaries. Employers in the DIFC or ADGM free zones must also satisfy the applicable free-zone data protection law's requirements for employee monitoring, which include documented lawful bases, retention limits, and data subject rights.

CCTV in the Workplace

Employers may install visible CCTV cameras in common work areas, provided that employees are notified and signage is posted. Covert cameras in workplaces are prohibited under the privacy provisions of both the Cybercrimes Law and the Crimes and Penalties Law.

Recorded footage must be handled as personal data under the PDPL, meaning it must be stored securely, retained only as long as necessary, and not used for purposes beyond those disclosed to employees.

Monitoring Company Email and Devices

Employers have broader rights to monitor company-owned email accounts and devices, since these are company property. However, monitoring must be strictly related to work purposes and may not extend to accessing personal or family communications, even if conducted on company equipment.

Deepfake and AI-Generated Content

The rapid growth of AI-generated audio and video has introduced new categories of recording-related harm under UAE law, and prosecutors have applied existing statutes to cover them.

Article 40: Deepfakes as Cyber Fraud

Article 40 of the Cybercrimes Law classifies the creation and distribution of deepfakes as cyber fraud. A deepfake is a synthetic audio or video in which a person's likeness, voice, or image is artificially generated or manipulated without their consent. Penalties under Article 40 are significantly heavier than the base Article 44 range: a minimum of one year imprisonment and fines between AED 250,000 and AED 1,000,000 per offence.

The UAE Data Office and law enforcement authorities issued warnings in late 2025 reminding the public that AI voice cloning, fake video calls, and synthetic media used to impersonate others are prosecuted under the Cybercrimes Law.

Article 44 Aggravated Form

Where a genuine recording (not fully AI-generated) is altered, edited, or manipulated to change what a person appears to say or do, the aggravated form of Article 44 applies: minimum one year imprisonment, fines AED 250,000-500,000. This covers, for example, splicing together audio clips to create a false composite statement.

Corporate Liability

Article 58 of the Cybercrimes Law extends criminal liability beyond individual employees. Persons who are de facto in charge of management of a company can face personal liability when the offence is committed in the company's name and for its benefit. The legal entity itself is jointly liable for court-ordered fines. Businesses deploying AI voice synthesis or automated recording systems must ensure those systems cannot operate without obtaining valid all-party consent.

Cross-Border Recording

UAE law applies on a territorial basis: any recording offense occurring within the UAE, or involving a UAE-based party, falls within UAE criminal jurisdiction regardless of the nationality of the offender or the other party.

Tourists and Visitors

Foreign nationals visiting or residing temporarily in the UAE are fully subject to UAE recording law during their stay. A visitor who records a conversation with a local resident without consent may face arrest, prosecution, and deportation in addition to criminal fines and imprisonment. UAE authorities have prosecuted foreign nationals for recording offenses. The fact that the recording would be legal in the visitor's home country provides no defense under UAE law.

Remote Recording Across Borders

When a phone call or video call crosses the UAE border, the UAE-based party is subject to UAE law regardless of where the other participant is located. A person in the UAE recording a call with someone abroad must obtain that person's consent to satisfy UAE law. The foreign participant's home-country law may impose additional requirements.

UAE courts have not authoritatively resolved conflicts between UAE all-party consent and the one-party consent rules of other countries, and cross-border enforcement actions are rare. In practice, the risk of UAE prosecution for a recording made entirely outside the UAE is low, but visitors carrying recordings made abroad should be aware that sharing those recordings while in the UAE could trigger disclosure liability.

Journalists and Media

Foreign media organizations wishing to conduct reporting in the UAE must obtain a media accreditation licence from the competent authority. Even accredited journalists are subject to the recording consent rules; there is no press-freedom exception to Article 44. Recording interviews, press conferences, or encounters in public spaces requires prior consent of all participants.

Amicable Settlement and Criminal Waivers

One distinctive feature of UAE criminal law is the availability of amicable settlement for certain privacy offenses. Under the Criminal Procedures Law (Federal Decree-Law No. 38 of 2022), the prosecution may allow the accused and the victim to settle criminal matters outside of court.

Privacy violations, including unauthorized recording, are among the offenses eligible for amicable settlement. Articles 42, 43, 44, and 45 of the Cybercrimes Law are all specifically listed among the provisions eligible for settlement. If the victim agrees to drop the complaint, the criminal case can be dismissed at any stage of the proceedings.

This does not eliminate the underlying criminal nature of the act. It simply means that the victim has the option to resolve the matter privately rather than pursuing prosecution. Settlement terms typically include financial compensation and an agreement to delete the recordings.

Businesses should not rely on the possibility of settlement as a risk management strategy. The prosecutor retains discretion over whether to offer settlement, and the victim is under no obligation to agree.

Penalties: Complete Reference Table

Courts may also order confiscation of recording equipment and the destruction of illegally obtained recordings.

Business Compliance Checklist

Organizations operating in the UAE should implement the following measures to comply with recording laws:

Call Recording

• Deploy an automated consent disclaimer at the beginning of every recorded call
• Require verbal confirmation from the caller before recording begins (silence does not constitute consent)
• Log and securely store consent records with timestamps for audit purposes
• Use only TDRA-licensed telecommunications and VoIP providers

Meeting and Video Recording

• Announce recording at the start of every meeting and obtain affirmative consent from all participants
• For virtual meetings, use platform features that notify participants when recording is active
• Provide an option for participants to leave the meeting if they do not consent to recording

Data Handling

• Classify recorded calls and meetings as personal data under the PDPL
• Establish retention policies that limit how long recordings are kept
• Implement access controls so that recordings are available only to authorized personnel
• Respond to data subject requests for access to or deletion of their recorded data within the timelines required by law

Employee Monitoring

• Draft a monitoring policy that specifies what is monitored, by what means, and for what purpose
• Include the policy in onboarding materials and employment contracts
• Post visible signage in areas covered by CCTV
• Never install covert recording devices in the workplace

ADGM and DIFC-Specific Steps

• Identify which data protection regime applies (federal PDPL, ADGM DPR, or DIFC DP Law) based on where your business is licensed
• Register with the applicable regulator if required
• Ensure consent mechanisms satisfy the applicable regime's standard (ADGM and DIFC use GDPR-aligned thresholds)

Court Admissibility of Recordings

Recordings obtained without the consent of all parties are generally inadmissible as evidence in UAE courts. The legal reasoning is straightforward: evidence gathered through an illegal act cannot be used to support a legal claim.

This has practical consequences for both civil and criminal litigation. A person who records a conversation to gather evidence of wrongdoing may find that the recording is excluded from court proceedings. Worse, they may face criminal charges for making the recording in the first place.

There is limited judicial discretion. In rare cases involving serious criminal matters, a judge may consider the circumstances under which a recording was made. However, this is the exception, not the rule, and no one should record a conversation without consent based on the assumption that a court will later admit it.

Law enforcement agencies may obtain authorization to conduct lawful interception of communications, but this requires a court order and is limited to specific criminal investigations.

Disclaimer

This article presents general legal information about recording laws in the United Arab Emirates, including federal law and the ADGM and DIFC free-zone regimes. It is not legal advice and does not address your specific circumstances. UAE law is complex, evolving, and enforced with significant penalties. The information in this article reflects the law as of May 2026. Executive regulations under the PDPL had not been published as of that date; some procedural details may change once those regulations are issued. Consult a lawyer licensed in the UAE for advice on your specific situation before recording any conversation or implementing a call recording program.

Frequently Asked Questions

Can I record a phone call in the UAE if I am one of the participants?

No. The UAE requires all-party consent for any recording of a private conversation. Being a participant in the call does not give you the right to record it without the other person's knowledge and agreement. Recording without consent violates Article 44 of Federal Decree-Law No. 34 of 2021 and can result in a minimum of six months in prison and fines starting at AED 150,000.

What happens if I secretly record someone in the UAE?

You could face criminal prosecution under multiple statutes. Under the Cybercrimes Law (Article 44), penalties include at least six months imprisonment and fines between AED 150,000 and AED 500,000. Under the Crimes and Penalties Law (Article 431), additional imprisonment and fines may apply. Courts can also order the confiscation of your recording equipment and the deletion of any recordings.

Are recordings without consent admissible as evidence in UAE courts?

Generally, no. UAE courts typically reject evidence obtained through illegal means, including unauthorized recordings. The person who made the recording may also face criminal charges for the act of recording itself. In limited circumstances involving serious criminal matters, a judge may exercise discretion, but this is rare and should not be relied upon.

Can my employer record my phone calls at work in the UAE?

Only with prior notice and consent. Employers must disclose monitoring practices in writing, typically through employment contracts or company policies, before any recording begins. Monitoring must be limited to work-related communications on company systems. Employers may not record personal calls or monitor private areas. Violations of employee privacy carry the same criminal penalties as any other unauthorized recording.

Does the UAE Personal Data Protection Law (PDPL) affect call recording?

Yes. The PDPL classifies voice recordings as personal data. Any organization that records calls must obtain explicit, informed, and specific consent from all parties. The recorded data must be stored securely, retained only as long as necessary, and made available to data subjects who request access or deletion. Note that executive regulations implementing the PDPL had not yet been published as of May 2026, but the core obligations of the law apply regardless.

Is it legal to record a police officer in the UAE?

Generally no. Recording police without consent is subject to the same all-party consent rules as any other recording. A narrow exception applies during traffic stops: a person directly involved may document the stop for evidentiary purposes if the recording is submitted directly to competent authorities and never shared publicly. Posting any recording of a police officer online can result in prosecution under both Article 44 and Article 43 of the Cybercrimes Law.

Do UAE recording laws apply to tourists and foreign visitors?

Yes. UAE law applies on a territorial basis. Foreign nationals are fully subject to UAE recording law during their stay, regardless of what their home country's law permits. A tourist who records a conversation without the other person's consent can face arrest, prosecution, fines, and deportation. The fact that the recording would be legal at home is not a defense under UAE law.

Are deepfakes illegal in the UAE?

Yes. Article 40 of Federal Decree-Law No. 34 of 2021 classifies deepfakes as cyber fraud, carrying a minimum of one year imprisonment and fines between AED 250,000 and AED 1,000,000. Using AI to clone a voice or create a synthetic video of someone without their consent also triggers the aggravated form of Article 44. Corporate entities are jointly liable for fines when their employees commit these offenses in the company's name.

Do ADGM or DIFC businesses face different recording obligations than mainland UAE companies?

Yes and no. Federal criminal law (the Cybercrimes Law and Crimes and Penalties Law) applies territory-wide, including inside ADGM and DIFC. But ADGM businesses must also comply with the ADGM Data Protection Regulations 2021, and DIFC businesses must comply with DIFC Law No. 5 of 2020, both of which impose GDPR-aligned consent, retention, and data subject rights obligations on top of the federal criminal framework. These free-zone regulators (the ADGM ODP and the DIFC Commissioner of Data Protection) enforce these rules independently.