Civil Law and UAE Cyber Harassment and Cross-Border Enforcement Issues

1. Introduction

Cyber harassment refers broadly to harmful conduct carried out through digital or electronic means, such as:

repeated threatening messages;

online stalking;

abusive WhatsApp or social-media communications;

publication of humiliating or defamatory material;

unauthorised disclosure of private information;

cyber threats or extortion;

impersonation;

publication of private photographs or recordings;

persistent unwanted electronic communications;

digital campaigns intended to damage a person's reputation; and

conduct occurring partly in the UAE and partly outside it.

In UAE law, cyber harassment can produce both criminal and civil consequences. The criminal aspect may arise under the UAE cybercrime legislation, while the civil aspect can involve compensation, injunctions, removal of material, protection of privacy, contractual claims, confidentiality claims, or other civil remedies.

The cross-border dimension becomes difficult when:

the victim is in the UAE, the harasser is abroad, the platform is located in another country, and the relevant servers/data are held in yet another jurisdiction.

The UAE cybercrime legislation specifically addresses cyber threats, defamation/slander, privacy invasion and related conduct. For example, Article 42 of Federal Decree-Law No. 34 of 2021 addresses cyberextortion and cyber threats; Article 43 addresses electronic defamation and slander; and Article 44 addresses revealing secrets and invasion of privacy through information networks or information technology. (UAE Legislation)

2. Civil Law Dimension of Cyber Harassment

Cyber harassment should not be viewed exclusively as a criminal-law issue.

A victim may potentially have a civil claim based on:

harmful conduct/civil liability;

invasion of privacy;

defamation or reputational harm;

breach of confidentiality;

breach of contract;

unauthorised use or disclosure of personal information;

economic loss;

emotional or non-economic harm where legally recoverable;

unjust enrichment in appropriate circumstances;

injunctive or protective relief.

The current UAE Civil Transactions Law, Federal Decree-Law No. 25 of 2025, has been in force since 1 June 2026. It replaced the former 1985 Civil Transactions Law and contains the current framework for obligations and civil liability.

The cybercrime legislation and civil legislation therefore operate in different but potentially overlapping spheres.

3. Criminal and Civil Claims Are Different

A cyber-harassment incident may create two separate legal tracks.

Criminal track

The State prosecutes conduct such as:

cyber threats;

extortion;

electronic defamation;

privacy violations.

Civil track

The victim may seek:

compensation;

restitution;

an injunction;

removal or cessation of unlawful conduct;

protection of confidential information;

recovery of demonstrable economic loss.

Therefore:

A criminal investigation does not necessarily eliminate the possibility of a separate civil claim.

Likewise, failure to establish a criminal offence does not automatically answer every civil-law question.

4. UAE Cybercrime Provisions Relevant to Harassment

Article 42 — Cyberextortion and Cyber Threats

Article 42 covers using an information network or information technology to threaten or extort another person to force that person to do something or refrain from doing something.

Where the threat concerns committing a crime or dishonourable acts and is accompanied by a demand, the provision contains substantially more serious consequences. (UAE Legislation)

Article 43 — Electronic Defamation and Slander

Article 43 addresses using an information network, information technology or information system to:

insult another person; or

attribute a characteristic that could expose that person to punishment or contempt by others.

The provision therefore becomes relevant to online posts, messages, publications and other digital communications capable of causing reputational harm. (UAE Legislation)

Article 44 — Privacy and Family-Life Protection

Article 44 addresses intentional invasion of the privacy or sanctity of private or family life without consent through specified digital conduct.

This is especially relevant where cyber harassment involves:

private photographs;

recordings;

private communications;

personal information;

surveillance-related material;

disclosure of private content.

(UAE Legislation)

5. Cross-Border Cyber Harassment

A typical cross-border case could look like this:

Victim in Dubai

↓

Harasser in another country

↓

Social-media platform in another country

↓

Cloud/server infrastructure in another country

↓

Publication accessible in UAE

↓

Reputational/private/economic damage in UAE

This creates several separate legal questions:

Which country has jurisdiction?

Which law governs?

Where did the harmful act occur?

Where did the damage occur?

Can UAE courts exercise jurisdiction over the foreign defendant?

How can the defendant be served?

How can evidence be obtained from a foreign platform?

Can a UAE judgment be enforced against foreign assets?

Can a foreign judgment be enforced in UAE?

Can interim relief be obtained before assets disappear?

6. Territoriality Is Not Always Simple

Cyber conduct does not fit comfortably into traditional territorial concepts.

For example:

A person in Country A uploads a defamatory video, hosted through a platform in Country B, about a UAE resident in Dubai.

Possible connecting factors include:

defendant's location;

victim's residence;

location where the publication was accessed;

location where reputation was harmed;

location of economic loss;

contractual relationship;

location of relevant property;

location of digital infrastructure.

The existence of a UAE connection does not automatically mean that UAE courts have unlimited jurisdiction.

7. Jurisdiction and the DIFC Courts

The DIFC Courts have developed particularly extensive jurisprudence concerning cross-border disputes.

Under the DIFC Courts Law No. 2 of 2025, the jurisdictional framework was consolidated and expanded. The new law also expressly addresses interim and precautionary measures relating to proceedings outside the DIFC. (DIFC Courts)

This is important in cyber-harassment cases because the victim may need urgent measures such as:

freezing assets;

preserving evidence;

disclosure;

injunctions;

orders directed toward a person controlling relevant information.

8. Case Law

Case 1 — Naqaash v Nasik

[2024] DIFC SCT 309

This is a useful UAE authority involving digital communications, aggressive messages and alleged hacking.

The dispute arose from an employment relationship. Following workplace disagreements, communications took place through WhatsApp. The employee allegedly sent aggressive messages concerning the employer's children, which the employer regarded as threatening. There was also an allegation concerning access to the employer's personal Gmail account. (DIFC Courts)

The case illustrates how courts can encounter cyber-harassment allegations within an underlying civil or employment dispute.

Principle

Digital harassment allegations may arise as part of a wider civil dispute and must be assessed through the evidence actually establishing the alleged conduct.

9. Case 2 — Olla v Olga

[2025] DIFC SCT 405

This employment case involved WhatsApp evidence concerning defamatory statements and workplace conduct.

The Court of Appeal accepted factual findings relating to a photograph, statements made during an investigation and a WhatsApp conversation concerning the spreading of malicious rumours about another employee. (DIFC Courts)

Principle

Electronic conversations can become important evidence of:

defamatory conduct;

intention;

publication;

workplace misconduct;

dissemination of information.

The case also demonstrates that WhatsApp evidence may have consequences beyond the immediate employment relationship.

10. Case 3 — Jingal v Jane FZ LLC

[2018] DIFC SCT 368

The defendant alleged that online social-media publications were disparaging and sought damages relating to reputational harm.

The claim included allegations concerning:

conspiracy;

unlawful interference;

intentional interference with economic relations;

reputational damage; and

disparaging online social-media posts.

The agreement also contained a contractual provision dealing with damages for unresolved breaches involving disparaging posts. (DIFC Courts)

Principle

Online publications can form part of a broader civil claim where the claimant alleges contractual, economic or reputational consequences.

The case is particularly useful because it demonstrates the intersection between:

Social Media → Contract → Reputation → Economic Loss → Civil Remedies.

11. Case 4 — Ismene v Irayna Hair Beauty Salon

[2018] DIFC SCT 295

The case involved social-media publications concerning the defendant's salon.

The Court ultimately ordered deletion of photographs relating to the salon that had been posted on social media. (DIFC Courts)

Principle

Civil proceedings involving online material can result in non-monetary relief, including orders requiring removal or deletion of digital content.

This is important because damages are not always the only useful remedy in a cyber-harassment dispute.

12. Case 5 — Linux v Lizeth

[2022] DIFC SCT 237

This case concerned WhatsApp communications and an alleged breach of confidentiality.

The claimant relied on the digital communications to establish a breach but the Court found that the evidence did not sufficiently establish the alleged breach and dismissed the damages claim. (DIFC Courts)

Principle

The existence of digital communications is not enough.

A claimant must establish:

what was communicated + by whom + what legal duty was breached + what damage resulted.

This principle is highly relevant to cyber-harassment claims, where screenshots can easily be produced but the legal significance of those communications must still be demonstrated.

13. Case 6 — Naqaash v Nasik and Digital Account Control

The Naqaash litigation is particularly useful because it also involved disputed control of social-media accounts and alleged access to a personal Gmail account. (DIFC Courts)

This highlights an important distinction:

Digital account access

does not automatically establish:

Legal ownership of the account

and neither automatically establishes:

Responsibility for every communication sent through that account.

A cross-border claimant may therefore need evidence connecting:

Account → Device → Credentials → IP/system records → Person → Communication.

14. Case 7 — DNB Bank ASA v Gulf Eyadah Corporation

[2015] DIFC CA 007

This is not a cyber-harassment case, but it is one of the most important UAE cross-border enforcement authorities.

The DIFC Court of Appeal considered recognition and enforcement of an English judgment in the UAE/DIFC.

The Court held that the DIFC Courts could recognise and enforce the foreign judgment and explained the relationship between recognition and local enforcement. Once recognised and enforced, the foreign judgment could operate as a local DIFC judgment for enforcement purposes. (DIFC Courts)

Relevance to cyber harassment

Suppose a cyber-harassment victim obtains a foreign judgment for damages against a defendant who has assets in Dubai.

The victim may need a recognition-and-enforcement pathway rather than commencing the entire substantive dispute again in Dubai.

DNB therefore illustrates the broader enforcement architecture.

15. Case 8 — Lahela v Lameez

[2020] DIFC CA 007

This case is especially important for cross-border service.

The dispute involved recognition and enforcement of an arbitral award against an Iraqi company.

The DIFC Court examined the Riyadh Convention, alternative service and whether conventional diplomatic service mechanisms prevented the court from using another effective means of service.

The Court ultimately accepted alternative service in the circumstances. (DIFC Courts)

Principle

In cross-border litigation, service is a substantive procedural issue, not merely administrative paperwork.

For cyber-harassment claims, this matters where the defendant:

lives abroad;

cannot be personally located;

operates through digital accounts;

refuses conventional service;

has lawyers already involved in related proceedings.

16. Case 9 — Lural v Listran & Lokhan

[2021] DIFC CA 003

This case concerned overlapping UAE jurisdictions and an Abu Dhabi proceeding.

The DIFC Court of Appeal considered jurisdiction over a dispute that had also been the subject of proceedings in another UAE jurisdiction. It held that the DIFC Courts had jurisdiction in relation to the matters identified in the judgment, including issues surrounding an exclusive jurisdiction clause. (DIFC Courts)

Principle

A claimant must identify the correct forum before pursuing a cross-border civil claim.

This becomes particularly important where cyber harassment involves:

UAE mainland defendant;

DIFC entity;

foreign defendant;

contractual jurisdiction clause;

simultaneous proceedings in another country.

17. Case 10 — Trafigura PTE Ltd v Prateek Gupta & Ginni Gupta

[2025] DIFC CA 001

This recent DIFC Court of Appeal decision is particularly significant for cross-border interim protection.

The dispute involved English proceedings and an application in the DIFC for a UAE-wide freezing order.

The Court of Appeal confirmed that the DIFC Courts had jurisdiction to grant appropriate precautionary measures in support of foreign proceedings under the new 2025 DIFC Courts Law. The freezing orders were continued, subject to further consideration by the first-instance court. (DIFC Courts)

Principle

A UAE court may, within its statutory jurisdiction, provide interim protection in support of foreign proceedings.

Cyber-harassment relevance

Consider a defendant who:

conducts harassment from abroad;

has UAE assets;

threatens to dissipate assets;

is facing a foreign civil claim;

may be liable for substantial damages.

Interim UAE relief can become important even though the main dispute is being litigated elsewhere.

18. Case 11 — Techteryx Ltd v Aria Commodities DMCC & Others

[2025] DIFC DEC 001

The Digital Economy Court dealt with sophisticated cross-border digital-asset allegations and granted/considered extensive protective orders involving assets and disclosure.

The case illustrates how the DIFC's specialist Digital Economy Court can deal with disputes involving:

digital assets;

international parties;

financial institutions;

asset tracing;

disclosure;

freezing/proprietary relief.

(DIFC Courts)

Principle

Modern cross-border digital disputes can require immediate asset-preservation and disclosure remedies, not merely a final damages judgment.

19. Case Law Table

The first five are particularly relevant to the substantive digital-conduct/evidence side; the latter cases provide the important cross-border jurisdiction, service and enforcement machinery.

20. Cross-Border Enforcement Problem

Obtaining a judgment is only one stage.

The complete process is:

Cyber Harassment

↓

Evidence Preservation

↓

Identify Defendant

↓

Determine Jurisdiction

↓

Commence Proceedings

↓

Serve Defendant

↓

Obtain Judgment

↓

Recognition

↓

Enforcement

↓

Asset Recovery

A claimant can therefore win the substantive dispute but still face difficulties if the defendant has:

no UAE assets;

assets hidden through companies;

assets in several jurisdictions;

cryptocurrency;

assets held through nominees;

foreign bank accounts.

21. Foreign Defendant With UAE Assets

Suppose:

victim is resident in Dubai;

harasser lives in Country X;

harasser owns a Dubai apartment;

harassment occurred through social media.

A possible strategy is:

establish UAE jurisdiction;

obtain appropriate relief;

seek interim protection where available;

obtain judgment;

identify UAE assets;

enforce against those assets.

The Trafigura decision demonstrates the importance of interim protection where foreign proceedings and UAE assets intersect. (DIFC Courts)

22. UAE Judgment Against Foreign Assets

The reverse problem is also possible.

Suppose:

victim obtains UAE judgment;

defendant has no meaningful UAE assets;

defendant has assets in India, UK, Singapore or another jurisdiction.

The UAE judgment may need to undergo recognition and enforcement proceedings in the country where the assets are located.

That country will apply its own:

jurisdictional rules;

recognition rules;

public-policy rules;

service requirements;

procedural rules;

limitation rules.

Thus:

A UAE judgment does not automatically become enforceable worldwide.

23. Foreign Judgment Against UAE Assets

Conversely, a victim might obtain judgment abroad and discover that the defendant's valuable assets are in the UAE.

The DNB Bank case demonstrates how the DIFC Courts approached recognition and enforcement of an English judgment. (DIFC Courts)

The claimant must consider:

the judgment's finality;

jurisdiction of the foreign court;

proper service;

public policy;

procedural fairness;

applicable treaty arrangements;

applicable UAE/DIFC enforcement rules.

24. Service of a Foreign Cyber-Harassment Defendant

Service becomes particularly difficult when the defendant is abroad.

Possible mechanisms may involve:

treaty-based service;

judicial assistance;

diplomatic channels;

recognised alternative service;

email;

service through lawyers;

other court-authorised methods.

Lahela v Lameez demonstrates that courts can carefully examine whether conventional cross-border service requirements prevent effective alternative service. (DIFC Courts)

The court's concern is generally to ensure that the defendant receives meaningful notice and procedural fairness.

25. Obtaining Evidence From Foreign Platforms

This is one of the hardest practical issues.

Suppose the harassment occurred through:

Instagram;

Facebook;

X;

TikTok;

Telegram;

WhatsApp;

foreign email provider.

The claimant may need:

account-registration data;

IP information;

login records;

message records;

subscriber information;

preservation of deleted data;

metadata.

A UAE court may not simply have direct access to a foreign company's database.

The claimant may need:

court disclosure orders;

third-party disclosure;

letters of request;

mutual legal assistance;

foreign proceedings;

platform-specific legal procedures.

26. Digital Evidence Preservation

Because digital evidence can disappear quickly, preservation should be considered before the main trial.

Important evidence includes:

original messages;

complete conversation;

URLs;

account identifiers;

timestamps;

screenshots;

screen recordings;

email headers;

metadata;

downloaded files;

server records;

witness statements;

forensic images.

A screenshot should ideally not be the only evidence.

The court in Linux v Lizeth illustrates the importance of sufficient evidence rather than merely asserting that digital communication occurred. (DIFC Courts)

27. Cross-Border Cyber Harassment and Privacy

Privacy claims can become complicated where:

Victim = UAE

Defendant = foreign country

Platform = third country

Server = fourth country

Different legal regimes may apply to:

personal data;

disclosure;

privacy;

defamation;

evidence;

intermediary responsibility.

The claimant should therefore distinguish:

Primary wrongdoer

The person who posted/sent the material.

Platform

The provider hosting/transmitting it.

Intermediary

Other persons or entities involved in distribution.

Their legal liabilities may be very different.

28. Cyber Harassment and Defamation

Cyber harassment may involve defamation, but the concepts are not identical.

Harassment

Focuses on repeated or threatening conduct.

Defamation

Focuses on publication of statements capable of harming reputation.

Privacy invasion

Focuses on unauthorised intrusion or disclosure involving private life/information.

Cyberextortion

Focuses on threats used to compel conduct or obtain something.

One online campaign could potentially involve more than one category.

29. Injunctions and Removal Orders

Damages may be inadequate where harassment is continuing.

A claimant may seek appropriate injunctive relief, depending on the applicable court and law, such as:

preventing further publication;

requiring removal;

restraining further communication;

preserving evidence;

preventing dissemination;

protecting confidential information.

Ismene v Irayna Hair Beauty Salon illustrates the possibility of a deletion/removal order concerning social-media material. (DIFC Courts)

30. Freezing Orders

A freezing order is different from a harassment injunction.

Harassment injunction

Stops or restricts harmful conduct.

Freezing order

Restrains dissipation of assets.

For example:

A UAE resident obtains a substantial foreign judgment against a cyber-harasser who is transferring UAE assets to another company.

A freezing order may become relevant to prevent dissipation pending enforcement.

The Trafigura case demonstrates the DIFC Court's modern approach to interim measures supporting foreign proceedings. (DIFC Courts)

31. Jurisdictional Challenges

A foreign defendant may argue:

no UAE connection;

wrong forum;

exclusive foreign jurisdiction clause;

inadequate service;

forum non conveniens;

lack of personal jurisdiction;

proceedings are abusive;

claim should be brought elsewhere.

Lural v Listran demonstrates the significance of jurisdictional analysis where proceedings in different UAE jurisdictions overlap. (DIFC Courts)

Ganesan Muthiah v Abdul Rahman Mohammad [2026] DIFC CA 007 is another recent illustration: the Conflict of Jurisdiction Tribunal determined that the Dubai Courts had jurisdiction, resulting in the DIFC proceedings being discontinued. (DIFC Courts)

32. Abuse of Cross-Border Proceedings

A claimant should not assume that bringing proceedings in multiple jurisdictions automatically strengthens the case.

Multiple proceedings can produce:

inconsistent judgments;

increased costs;

jurisdictional conflict;

anti-suit applications;

enforcement complications;

abuse-of-process arguments.

The correct strategy is normally to identify the jurisdiction having the strongest legitimate connection with:

defendant;

victim;

harmful conduct;

evidence;

assets;

applicable law.

33. Public Policy

Recognition and enforcement can also encounter public-policy objections.

For example, a UAE court may consider whether the foreign proceeding:

respected due process;

properly served the defendant;

resulted from a competent court;

is final;

violates fundamental UAE public policy.

The same issue can arise in reverse when a UAE judgment is presented to a foreign court.

34. Practical Cross-Border Cyber-Harassment Framework

A claimant should proceed through the following sequence.

Step 1 — Identify the conduct

Is it:

threat;

harassment;

defamation;

privacy violation;

extortion;

disclosure;

impersonation?

Step 2 — Preserve evidence

Secure:

native messages;

screenshots;

metadata;

URLs;

account details;

devices.

Step 3 — Identify the person

Establish:

Account → Telephone/email → Device → IP information → Individual

where available.

Step 4 — Identify territorial connections

Determine:

victim location;

defendant location;

publication location;

damage location;

server/platform location;

asset location.

Step 5 — Select forum

Consider:

UAE mainland;

DIFC;

foreign jurisdiction.

Step 6 — Obtain urgent relief

Where justified:

preservation;

injunction;

disclosure;

freezing measures.

Step 7 — Obtain judgment

Establish:

wrongful conduct;

causation;

damage;

defendant's responsibility.

Step 8 — Recognition

If judgment originates abroad, seek recognition in the relevant UAE jurisdiction.

Step 9 — Enforcement

Locate:

bank accounts;

real estate;

shares;

vehicles;

digital assets;

receivables.

Step 10 — Foreign enforcement

If assets are outside UAE, initiate recognition/enforcement in the relevant foreign jurisdiction.

35. Important Evidentiary Formula

For cyber-harassment claims:

Identity + Communication + Attribution + Publication/Transmission + Wrongfulness + Causation + Damage

For cross-border enforcement:

Jurisdiction + Service + Judgment + Recognition + Asset Identification + Enforcement

For urgent protection:

Serious Claim + Urgency + Risk of Harm/Dissipation + Appropriate Remedy

36. Major Practical Problems

37. Mainland UAE and DIFC Must Be Distinguished

This is particularly important.

Mainland UAE

The federal cybercrime legislation and federal civil/procedural framework apply, subject to the particular emirate and subject-matter jurisdiction.

DIFC

The DIFC has its own:

courts;

procedural rules;

laws;

jurisdictional framework;

digital-economy mechanisms.

DIFC decisions therefore provide valuable UAE jurisprudence concerning digital and cross-border disputes, but a DIFC judgment should not automatically be described as binding precedent on every mainland UAE court.

38. Six Core Lessons From the Case Law

1. Digital conduct can produce civil consequences

Naqaash v Nasik demonstrates how aggressive digital communications and alleged account intrusion can arise within a civil/employment dispute. (DIFC Courts)

2. Social-media publications can generate reputational disputes

Jingal v Jane FZ LLC illustrates claims involving online disparagement and reputational/economic damage. (DIFC Courts)

3. Removal can be a civil remedy

Ismene v Irayna Hair Beauty Salon demonstrates an order concerning deletion of social-media photographs. (DIFC Courts)

4. Digital evidence must prove the alleged wrong

Linux v Lizeth demonstrates that merely producing WhatsApp evidence is insufficient if the evidence does not establish the alleged breach. (DIFC Courts)

5. Cross-border judgments require an enforcement mechanism

DNB Bank v Gulf Eyadah provides the major UAE/DIFC recognition-and-enforcement authority. (DIFC Courts)

6. Cross-border interim protection is possible within the proper jurisdictional framework

Trafigura v Gupta demonstrates the DIFC Courts' power concerning precautionary measures supporting foreign proceedings under the 2025 framework. (DIFC Courts)

39. Conclusion

UAE cyber-harassment law operates at the intersection of cybercrime law, civil liability, privacy, defamation, evidence, jurisdiction and international enforcement.

The most difficult cases are those where the conduct is geographically fragmented:

Person abroad → digital platform abroad → victim in UAE → harm in UAE → assets in UAE or another country.

The UAE cybercrime legislation expressly addresses cyber threats, electronic defamation and privacy invasion. (UAE Legislation)

For the civil side, the claimant must establish the relevant legal duty, wrongful conduct, causation and legally recoverable harm. The digital evidence must then establish the connection between the defendant and the conduct.

For cross-border enforcement, the claimant must separately solve:

Jurisdiction → Service → Evidence → Judgment → Recognition → Asset Identification → Enforcement.

The major UAE/DIFC authorities demonstrate that these stages are legally distinct. DNB Bank illustrates foreign-judgment enforcement; Lahela illustrates cross-border service; Lural illustrates jurisdictional conflicts; Trafigura illustrates interim protection in support of foreign proceedings; while Naqaash, Olla, Jingal and Ismene demonstrate how digital communications and social-media material can become relevant to substantive civil disputes. (DIFC Courts)

Core legal formula:

Cyber Harassment → Preserve Digital Evidence → Establish Identity → Establish Wrongfulness → Prove Damage → Determine UAE/Foreign Jurisdiction → Obtain Protective Relief → Obtain Judgment → Recognition → Enforcement Against Assets.