Civil Law and UAE Data Retention Obligations in Litigation

1. Introduction

Data retention in litigation means preserving documents, electronic records, communications, metadata and other information that may be relevant to an actual or reasonably anticipated dispute.

In the UAE, litigation-related data retention does not arise from one single universal "legal hold" statute. Instead, it results from the interaction of:

• UAE civil and procedural law;
• the Civil Procedure Code;
• the Personal Data Protection Law (PDPL);
• the Electronic Transactions and Trust Services Law;
• sector-specific retention obligations;
• contractual duties;
• court orders;
• rules of specialist jurisdictions such as the DIFC and ADGM.

A particularly important federal rule is Article 6 of Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services. Where legislation requires a document, record or information to be stored, electronic storage can satisfy the requirement if the electronic record accurately represents the original information, remains usable and referenceable, and preserves information enabling identification of the originator, destination and relevant sending/receipt dates and times.

For litigation, the central principle is:

Once litigation is reasonably anticipated, relevant information should be identified and preserved so that ordinary deletion or alteration does not destroy potentially material evidence.

2. Meaning of Data Retention

Data retention has two different dimensions.

A. Regulatory/business retention

An organisation retains information because legislation, regulation, accounting requirements, employment rules, financial-sector requirements or another legal obligation requires it.

B. Litigation preservation

An organisation preserves information because it may become relevant to:

• existing litigation;
• threatened litigation;
• arbitration;
• investigation;
• regulatory proceedings;
• enforcement proceedings.

These concepts should not be confused.

A company may have a normal policy saying:

"Emails older than 12 months are automatically deleted."

That policy may be lawful during ordinary business operations. But if a dispute has arisen and those emails are potentially relevant, continuing automatic deletion can create serious evidentiary problems.

3. Federal Electronic-Records Framework

Article 6 of Federal Decree-Law No. 46 of 2021 is particularly important.

Where another law requires retention of a document, record or information, electronic retention is sufficient if:

1. the record is retained in its original form or another form that accurately represents the original;
2. the information remains capable of later use and reference;
3. information identifying the originator, destination, date and time of transmission/receipt is retained where applicable.

The law also permits a person to use another service provider to fulfil these storage requirements, provided the statutory conditions are satisfied.

Practical implication

A UAE business should not simply ask:

"Do we still have the PDF?"

It should ask:

"Can we demonstrate that the electronic record accurately represents the original and establish its provenance and chronology?"

4. PDPL and Data Retention

The Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data introduces an important counterweight.

An organisation cannot assume that:

"Litigation is possible, therefore we can retain every item of personal data indefinitely."

Instead, retention must be considered against:

• the purpose for which information was collected;
• applicable legal obligations;
• legitimate processing requirements;
• data minimisation;
• security;
• confidentiality;
• the rights of the data subject.

Therefore, litigation preservation should be targeted and proportionate.

Example

A company has 20,000 customer records.

A dispute concerns one transaction involving one customer.

A sensible preservation exercise may identify:

• that customer's account;
• relevant employees;
• relevant transaction records;
• relevant communications;
• relevant system logs;
• relevant contracts.

It does not automatically follow that every unrelated customer's entire file should be retained indefinitely.

5. Litigation Hold

A litigation hold is an internal instruction suspending ordinary deletion or destruction of potentially relevant information.

A proper litigation hold should identify:

• the dispute;
• relevant custodians;
• relevant dates;
• relevant systems;
• relevant devices;
• relevant document categories;
• preservation obligations;
• responsible personnel;
• deletion processes that must be suspended.

Example

An employee normally uses:

• Microsoft 365;
• WhatsApp;
• laptop;
• mobile phone;
• Teams;
• SharePoint;
• cloud storage.

If the dispute concerns that employee's communications, preservation should not necessarily stop with the corporate email account.

Potentially relevant sources could include:

Email + Teams + WhatsApp + laptop + cloud files + phone + server logs + backups

6. Current DIFC Position

The DIFC provides particularly detailed rules concerning electronic documents.

Current DIFC RDC Part 28 defines "document" broadly and expressly includes:

• emails;
• electronic communications;
• word-processed documents;
• databases;
• server information;
• backup systems;
• deleted electronic documents;
• metadata.

It also requires parties to address preservation of electronic documents and document-retention policies at an early stage.

This makes DIFC jurisprudence especially useful when analysing UAE electronic-retention issues.

7. Six Major Case Laws

Case 1 — Industrial Group Ltd v Bradley Dexter

The Industrial Group Ltd v Bradley Dexter [2018] DIFC CFI 044/2017

This is one of the clearest UAE judicial authorities concerning electronic preservation.

The DIFC Court ordered production of extensive electronic material, including:

• emails;
• text messages;
• business records;
• electronic documents;
• servers;
• backup systems;
• electronic devices and media.

The Court also contemplated the use of independent IT forensic experts to inspect relevant electronic systems.

Principle

Litigation preservation may extend beyond easily accessible files.

Potentially relevant evidence may exist in:

computers + servers + backups + devices + electronic media

Practical significance

A company facing threatened litigation should therefore avoid assuming that preservation means merely saving a few documents selected by its legal team.

8. Case 2 — Shiraz Mahmood v Standard Chartered Bank

Shiraz Mahmood v Standard Chartered Bank (DIFC Branch) [2021] DIFC CFI 044

This litigation generated extensive document-production proceedings.

The Court dealt with requests concerning electronic communications and later required searches involving particular categories of electronic material.

In a 2023 document-production order, the Court emphasised the need for parties to cooperate regarding:

• electronic-document searches;
• preservation;
• computer systems;
• electronic devices;
• storage systems;
• document-retention policies;
• anticipated search costs.

The Court ordered specific searches and subsequent production statements explaining the searches performed.

Principle

Data retention is not simply a technical IT issue.

It is a litigation-management obligation involving:

• lawyers;
• clients;
• IT departments;
• compliance personnel;
• forensic specialists.

9. Case 3 — Barclays Bank PLC v Bavaguthu Raghuram Shetty

Barclays Bank PLC v Bavaguthu Raghuram Shetty [2020] DIFC CFI 061

This case involved competing versions of an electronic ISDA Agreement and allegations concerning electronic manipulation and signatures.

The Court considered technical evidence regarding:

• scanning;
• electronic insertion;
• signature appearance;
• document versions;
• authenticity;
• execution.

The judgment demonstrates why preservation of the original electronic material and its surrounding technical information can be critical.

Principle

A retained document should ideally allow the court to determine:

• where it came from;
• when it was created;
• whether it was subsequently altered;
• who executed it;
• whether its electronic characteristics are consistent with the asserted history.

Litigation lesson

A screenshot or printed copy may not be sufficient where authenticity is disputed.

10. Case 4 — Taaleem PJSC v National Bonds Corporation PJSC & Deyaar Development PJSC

Taaleem PJSC v National Bonds Corporation PJSC & Deyaar Development PJSC [2010] DIFC CFI 014

The Court considered the reliability of searches for documents and the significance of electronic-document searches.

The judgment recognised that where a party states that documents cannot be located, the court needs to understand:

• what search was conducted;
• the scope of the search;
• whether the search was reasonable;
• whether the absence of documents can reliably indicate that they no longer exist.

The Court specifically referred to electronic searches and factors such as retrieval difficulty, expense and the significance of documents likely to be found.

Principle

"Document not found" does not automatically mean:

"Document never existed."

The adequacy of the search matters.

11. Case 5 — AES Middle East Insurance Broker LLC v GSB Capital Ltd

AES Middle East Insurance Broker LLC & Others v GSB Capital Ltd [2023] DIFC CFI 060

This is an important modern electronic-disclosure case.

The litigation involved a very large electronic dataset. The defendant used an external eDiscovery specialist and searched:

• Microsoft 365;
• Outlook;
• OneDrive;
• SharePoint;
• Microsoft Teams;
• individual electronic devices.

The dataset exceeded two million documents, with additional image searching and manual review of potentially relevant material.

The Court also issued a preservation order preventing the destruction, deletion, alteration or transfer of relevant electronic records and metadata.

Principle

Modern litigation preservation must account for the reality of large-scale electronically stored information (ESI).

Practical lesson

A sophisticated preservation system may require:

• forensic collection;
• eDiscovery platforms;
• custodian identification;
• search terms;
• date ranges;
• metadata preservation;
• document-family preservation;
• audit trails.

12. Case 6 — Global Advocacy and Legal Counsel v Industrial Group

Global Advocacy and Legal Counsel v The Industrial Group [2019] DIFC CFI 037

This litigation arose from a dispute involving confidential business information and the earlier Industrial Group proceedings.

The case illustrates the importance of obtaining and preserving documentary evidence when a business suspects that confidential information has been transferred to a competitor.

The underlying circumstances included allegations concerning an employee moving to a competitor and the possibility that confidential business information had been taken.

Principle

Where a business has reasonable grounds to suspect misuse of confidential information, early preservation can be important to prevent the evidentiary trail from disappearing.

13. Case 7 — Kitopi Catering Services LLC v Mons Hospitality FZE

Kitopi Catering Services LLC v Mons Hospitality FZE [2025] DIFC CFI 081/2024

This more recent DIFC litigation demonstrates the breadth of the modern concept of an electronic document.

The relevant requests contemplated:

• email;
• attachments;
• SMS;
• WhatsApp;
• Signal;
• Microsoft Teams;
• voicemail;
• spreadsheets;
• reports;
• photographs;
• sound recordings;
• logs;
• images;
• data compilations;
• financial records.

The Court's current Part 28 framework expressly encompasses electronic documents, deleted documents and metadata.

Principle

A modern litigation-retention policy should not be limited to traditional email and PDFs.

14. Case 8 — Curtis, Mallet-Prevost, Colt & Mosle LLP v Theron Entertainment

Curtis, Mallet-Prevost, Colt & Mosle LLP & MAG Financial Services LLC v Theron Entertainment LLC [2019] DIFC

The case-management orders expressly required standard production of searchable electronic documents and established procedures for requests, objections, disclosure orders and document-production statements.

Principle

Electronic disclosure requires an organised procedural process rather than ad hoc document collection.

15. What Data Must Be Preserved?

A litigation hold should consider at least the following categories.

16. Metadata Preservation

Metadata can be extremely important.

It may show:

• creation date;
• modification date;
• author;
• file location;
• version history;
• transmission history;
• document relationships.

For example:

A company produces a Word document claiming it was created in January.

Metadata may reveal:

Created: January
Modified: June
Author: different user

That does not automatically prove wrongdoing, but it can generate an evidentiary issue requiring explanation.

The DIFC rules expressly include metadata within the definition of electronic documents.

17. Deleted Documents

One of the most important modern principles is:

Deletion does not necessarily eliminate the legal relevance of a document.

Current DIFC Part 28 expressly covers electronic documents stored on servers and backup systems and documents that have been deleted.

Therefore, where litigation is anticipated, an organisation should consider whether ordinary deletion mechanisms need to be suspended.

18. Automatic Deletion Policies

Automatic deletion is not inherently unlawful.

For example:

Emails are automatically deleted after 24 months.

That may be a legitimate retention policy.

The problem arises where:

1. litigation is reasonably anticipated;
2. relevant information has been identified;
3. the organisation knows ordinary deletion will destroy it;
4. the organisation nevertheless allows automatic deletion to continue.

The legal issue then becomes much more serious.

19. Litigation Hold Procedure

A practical UAE litigation-hold process should contain the following stages.

Stage 1 — Trigger

Identify the triggering event:

• demand letter;
• termination;
• regulatory notice;
• arbitration notice;
• threatened lawsuit;
• cyber incident;
• fraud allegation.

Stage 2 — Identify custodians

Determine who may possess relevant information.

Stage 3 — Identify systems

Map:

email → laptop → phone → cloud → databases → backups → messaging

Stage 4 — Suspend destruction

Suspend relevant automated deletion.

Stage 5 — Preserve originals

Preserve information in a manner that maintains integrity.

Stage 6 — Record methodology

Document:

• what was preserved;
• when;
• by whom;
• from which system;
• using what method.

Stage 7 — Review proportionality

Do not retain unrelated personal information indefinitely merely because litigation exists.

Stage 8 — Produce relevant evidence

Use agreed or court-directed search parameters.

20. Data Retention and Privacy Conflict

One of the most difficult issues is:

How can an organisation preserve evidence while respecting data-protection principles?

The answer is generally purpose-specific preservation.

Example

A company is sued by Employee A.

The company discovers that the dispute concerns alleged discriminatory emails sent between January and June.

It may be appropriate to preserve:

• relevant emails;
• HR records;
• relevant Teams messages;
• relevant personnel files;
• relevant policies.

It does not automatically follow that the company should retain every employee's entire private communications indefinitely.

21. Proportionality

A sensible retention system considers:

Relevance

Is the information reasonably connected to the dispute?

Necessity

Is preservation necessary to protect legal rights?

Scope

How many custodians and systems are involved?

Time

What period is relevant?

Sensitivity

Does the material contain:

• health information;
• financial information;
• employee information;
• privileged communications?

Cost

Is forensic collection proportionate to the dispute?

22. Confidentiality and Privilege

Litigation data may contain:

• attorney-client communications;
• legal advice;
• confidential commercial information;
• personal information;
• banking information;
• trade secrets.

Preservation does not necessarily mean unrestricted disclosure.

The court may impose:

• confidentiality orders;
• restricted access;
• confidentiality clubs;
• redactions;
• inspection limitations.

The healthcare litigation in Health Bay Investment in Healthcare Enterprises & Development LLC v Dr Kamal Akkach [2020/2021] DIFC CFI 087 is useful in illustrating judicial protection of sensitive information during litigation.

23. Cross-Border Data Retention

Multinational businesses face additional problems.

Suppose:

UAE company → UAE cloud → European server → Indian service provider

A UAE litigation hold may require preservation of relevant data even if the technical storage occurs outside the UAE.

The company must then consider:

• applicable UAE law;
• PDPL requirements;
• foreign privacy law;
• contractual restrictions;
• cloud-provider policies;
• cross-border transfer requirements;
• court orders.

This makes early legal and technical coordination important.

24. Data Retention in Arbitration

The same principles can arise in arbitration.

Relevant information may include:

• contracts;
• correspondence;
• project records;
• WhatsApp communications;
• accounting information;
• technical reports;
• expert material;
• digital signatures;
• blockchain records.

Where an arbitration agreement exists, parties should preserve potentially relevant evidence before the tribunal is fully constituted.

This is especially important in construction, shareholder, banking, crypto and technology disputes.

25. Data Retention and Cybersecurity Incidents

A cyberattack creates an immediate preservation problem.

The company should preserve:

• firewall logs;
• authentication logs;
• endpoint records;
• access records;
• database logs;
• cloud audit logs;
• malware samples;
• forensic images;
• incident-response reports;
• communications concerning the incident.

Important distinction

Do not allow an incident-response process to accidentally destroy the evidence needed for later litigation.

For example, wiping a compromised laptop may restore operational security but potentially destroy evidence.

A forensic image should ordinarily be considered before destructive remediation where legally and operationally appropriate.

26. Data Retention and Blockchain

Blockchain creates a different evidentiary environment.

Relevant information may include:

• transaction hash;
• wallet address;
• block number;
• timestamp;
• exchange records;
• custody records;
• private-key evidence;
• device information;
• communications establishing control.

Gate MENA DMCC v Tabarak Investment Capital Ltd [2023] DIFC CA 002 is particularly useful for understanding the role of technical and expert evidence concerning digital assets.

Blockchain records may demonstrate that a transaction occurred, but they do not automatically establish:

• who controlled the wallet;
• who authorised the transaction;
• who owned the underlying asset;
• whether an individual had legal authority to act.

Thus:

Blockchain preservation ≠ complete proof of legal ownership.

27. Data Retention and AI

Modern litigation can involve:

• AI-generated documents;
• AI-assisted emails;
• prompts;
• model outputs;
• automated decision logs;
• training datasets;
• audit trails.

Where an AI system is material to the dispute, preservation may need to consider:

Prompt → Input data → Model/version → Output → Human review → Final decision

If only the final AI-generated document is retained, important evidence about how it was produced may disappear.

28. Consequences of Poor Retention

Poor data preservation can lead to:

1. Evidentiary difficulties

The party may be unable to prove its version of events.

2. Adverse procedural consequences

The court may scrutinise why relevant evidence cannot be produced.

3. Costs consequences

Unreasonable disclosure conduct can increase litigation costs.

4. Credibility issues

Inconsistent explanations concerning missing records may affect how evidence is assessed.

5. Regulatory exposure

Where the destroyed information concerns regulated personal data or statutory records, separate regulatory consequences may arise.

6. Substantive consequences

If important evidence is lost, the party's ability to establish its claim or defence may be materially weakened.

29. Reasonable Search Does Not Mean Unlimited Search

Current DIFC Part 28 is particularly instructive.

The reasonableness of an electronic search can involve:

• number of documents;
• complexity of litigation;
• ease of retrieval;
• retrieval expense;
• location of information;
• likelihood of finding relevant evidence;
• cost of production;
• risk of altering evidence;
• importance of the material.

The rules expressly contemplate efficient searches rather than requiring every electronic record to be manually reviewed.

Therefore:

Litigation preservation should be comprehensive enough to protect evidence, but proportionate enough to remain legally and economically manageable.

30. Practical UAE Litigation Retention Checklist

Before litigation:

• Maintain a documented retention policy.
• Identify statutory retention periods.
• Map important data systems.
• Identify cloud providers.
• Control employee-device usage.
• Maintain reliable backups.
• Maintain audit logs.

When litigation becomes reasonably foreseeable:

• Issue litigation hold.
• Identify custodians.
• Suspend relevant automatic deletion.
• Preserve email.
• Preserve messaging applications.
• Preserve cloud data.
• Preserve metadata.
• Preserve databases.
• Preserve relevant backups.
• Document the preservation process.

During litigation:

• Agree search parameters.
• Use proportionate searches.
• Maintain chain of custody.
• Protect privileged information.
• Protect personal information.
• Maintain confidentiality.
• Record document-production methodology.

After litigation:

• Determine whether retention is still legally required.
• Release unnecessary litigation holds.
• Return to ordinary retention policies where lawful.
• Securely dispose of information that no longer needs to be retained.

31. Case-Law Summary

32. Conclusion

UAE data-retention obligations in litigation are best understood through the interaction of electronic-record law, civil procedure, data protection, evidence and judicial case management.

The practical legal rule is:

When litigation is reasonably foreseeable, potentially relevant electronic information should be identified, preserved and protected from ordinary destruction, while retention should remain legally justified, secure and proportionate.

For onshore UAE litigation, the starting point is federal legislation, the Civil Procedure framework, the Electronic Transactions and Trust Services Law, the PDPL and any applicable sector-specific legislation.

For DIFC proceedings, the position is much more detailed. Current DIFC Part 28 expressly addresses electronic documents, deleted documents, metadata, servers, backups, retention policies, search methodology and reasonable searches.

The central litigation chain is therefore:

Legal dispute anticipated → litigation hold → identify custodians → identify systems → suspend relevant deletion → preserve original data and metadata → forensic integrity → proportionate search → production → confidentiality/privacy protection.

The most important authorities for this subject are Industrial Group v Dexter, Shiraz Mahmood v Standard Chartered, Barclays v Shetty, Taaleem v National Bonds/Deyaar, AES v GSB Capital, Global Advocacy v Industrial Group, and Kitopi v Mons Hospitality. These cases collectively show that UAE litigation increasingly treats electronic evidence preservation as a structured legal obligation rather than merely an IT-management issue.