Is reputation management legal in the UAE?

Yes. Reputation management is lawful in the UAE, and parts of it are written into statute. Federal Decree-Law No. 34 of 2021 makes online defamation a crime and gives authorities power to order illegal content corrected or blocked. The limits are real though: that power does not reach ordinary defamation, and the same law that protects a client binds the firm acting for them.

What does UAE law actually criminalise?

Insulting someone online, or attributing something to them that would expose them to punishment or contempt. That is Article 43 of Federal Decree-Law No. 34 of 2021, and it is a criminal matter rather than a civil one.

The article reads, in the government's own English translation:

Whoever uses an information network, ITE, or an information system and insults another or attributes a quality to him that would make that person subject to punishment or contempt by third parties shall be punished with imprisonment and/ or a fine of not less than (AED 250,000) two hundred fifty thousand dirhams or more than (AED 500,000) five hundred thousand dirhams.

Two things in that text are routinely reported wrongly. It sets a fine floor of AED 250,000, not a ceiling, and it states no maximum prison term — several widely cited summaries add "up to two years", which does not appear in the article.

Article 43 then makes it an aggravating circumstance where the target is "a public official or a person entrusted with a public service during or because of performance of his work". For anyone holding office, the law already treats an attack on them as the more serious case.

Can a UAE authority order content removed?

Yes, but not for defamation. This is the part most summaries get wrong, and it changes what is realistic to promise a client.

Article 62 gives competent authorities the power to issue writs to "Correct, Interrupt, Disable and Block Access", either on their own initiative or at the Prosecutor-General's request. It is a genuine administrative takedown power. But read the clause it opens with: the power exists "In respect of the crimes stipulated in Article (71) of this Decree-Law."

Article 71 lists those crimes: Articles 3, 5, 7, 11(3), 12(3), 13, 19, 20 to 28, 47(II), 52, 53 and 55. They are the offences the law classifies as crimes against the security of the State.

Article 43 is not among them. Neither is Article 44, on privacy. So an ordinary defamation complaint does not unlock the blocking route, whatever the marketing pages imply. The same scoping limits the Attorney General's power under Article 66, which reaches Article 71 crimes or a threat to national security or the national economy.

What remains for defamation is the criminal complaint and the court process, and separately a civil claim in tort for damages. Slower, narrower, and the honest answer.

What makes a platform comply with an order?

Money, and a lot of it. Article 53 fines a website or account that holds illegal content and does not remove it, or refuses an order without acceptable excuse, between AED 300,000 and AED 1,000,000.

That penalty is why an order carries weight where a request does not. It is also why the first question about any piece of content is which legal basis actually reaches it, rather than how strongly the letter is worded.

Is there a right to be forgotten in the UAE?

Not in the European sense. Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, gives a right to correction and erasure at Article 15 — but the article itself lists cases where no such right exists, and makes it subject to legislation in force and to the public interest.

It also does not reach everything. The DIFC and ADGM operate their own data protection regimes, and government data sits outside it. Commentators who call this a right to be forgotten are importing GDPR shorthand that overstates what the text gives.

In practice that means a UAE erasure request is a conditional argument to be made, not a right to be asserted.

What may a reputation firm not lawfully do?

The same law that gives a client a remedy binds the firm acting for them. Publishing false material to displace true material is the same Article 43 offence, committed by the firm rather than against the client.

Article 11 covers fake accounts, emails and websites. Article 54 covers creating or modifying automated accounts to spread false data inside the UAE. Article 55 covers taking a benefit in return for spreading illegal content or false data.

So the boundary is not a matter of taste. A firm that answers a bad review with invented good ones, or an attack with fabricated accounts, has moved from the remedy to the offence, and has handed the other side a case.

Which route reaches which problem?

Most real matters use more than one of these at once, and the first piece of work is deciding which of them a given URL is actually open to.

How to check any of this yourself

Read the statute. It is published in full, in English and Arabic, at the UAE's own legislation portal: Federal Decree-Law on Countering Rumors and Cybercrimes. Every article quoted on this page is there under its own number.

The version checked for this page was listed as last updated on 4 April 2024, carrying one amendment, with its state recorded as Active. That matters, because Federal Law No. 5 of 2024 amended the Decree-Law and a summary written before it may be out of date.

One caveat the portal states itself, and which this page inherits:

Every effort has been made to produce an accurate and complete English version of this website/ legislation. However, for the purpose of their interpretation and application, reference must be made to the original Arabic text. In case of conflict, the Arabic text will prevail.

This page is a practitioner's reading of a public statute, not legal advice, and a specific matter needs a UAE-licensed lawyer.