Imagine your employer asks you to connect to the company's VPN before opening a confidential file. Later that evening, you read a warning about VPN users facing fines of up to AED 2 million.
Naturally, you pause. Have you been asked to do something unlawful?
For anyone living or doing business here, that distinction deserves more attention than the headline figure. Before worrying about a penalty, it is necessary to understand the conduct the law actually prohibits.
A VPN Is a Tool - Not Permission to Disregard the Law
A virtual private network, or VPN, allows a device to connect through a private network over the internet. One familiar business application is allowing employees outside the office to access their organisation's internal systems.
There is an important difference between protecting an authorised connection and disguising unlawful conduct.
Consider an employee who uses an employer-provided VPN to review company documents from home. Now consider someone who disguises their network address to conceal an online scam. Although both situations may involve similar technology, they should not be treated as legally equivalent. The regulator's explanation focuses on the fraudulent act and the purpose of committing a crime or preventing its discovery. (TDRA)
Which UAE Law Applies?
Older articles on this subject refer to Federal Decree-Law No. 5 of 2012 and its 2016 amendment. The 2012 legislation was subsequently replaced by Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, which took effect on 2 January 2022.
Under the current framework, Article 10 addresses circumventing a network's protocol address through a false address, another person's address or other means, with the intention of committing a crime or preventing its discovery.
| Element | Detail |
|---|---|
| Governing law | Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes |
| Effective date | 2 January 2022 |
| Relevant provision | Article 10 - address circumvention with intent to commit or conceal a crime |
| Prescribed penalty | Temporary imprisonment and/or a fine of AED 500,000 - AED 2,000,000 |
These are penalties for the specified offence - not an automatic charge for installing or activating a VPN application. (UAE Legislation)
That distinction should guide any assessment of an individual situation. A penalty range, read without the elements of the offence, tells only part of the story.
Can Businesses Use VPNs for Legitimate Work?
For an employer, the practical response is to make authorised use clear.
An employee should not have to guess which remote-access service to use, whether a personal application is acceptable or whom to contact when access fails. Those questions are better answered before a deadline or an urgent client request puts someone under pressure.
We recommend a straightforward written policy identifying approved tools, permitted purposes and the person responsible for access decisions. Employees should receive usable instructions, not merely a warning to "comply with all applicable laws."
For sensitive work, the legal and technical teams should review the arrangement together. Ask what information will be accessed, who needs access and how that access will be withdrawn when it is no longer required. These are recommended safeguards, rather than a claim that every business is subject to an identical set of VPN-specific obligations. Our compliance investigations checklist covers the wider documentation trail regulators expect to see.
What About Internet Calls and Blocked Services?
This is where a general statement that "VPNs are legal" can become misleading.
The Telecommunications and Digital Government Regulatory Authority (TDRA) treats internet voice and video calling as regulated telecommunications services. Its guidance explains that such services must fall within an authorised arrangement - for example, provision by a licensed operator, collaboration with one, or TDRA approval, subject to applicable exemptions. (TDRA)
TDRA also warns that an application working in the UAE does not, on its own, establish that its calling service is lawful. It advises users to check with their provider or consult the approved-services information. (TDRA)
For someone simply trying to speak to family overseas, that may feel like an unexpectedly technical distinction. Nevertheless, the practical approach is to choose an authorised service rather than assume that making an application connect resolves the legal question.
Equally, a blocked website or unavailable feature should not be assessed solely by whether a VPN can reach it. Identify the service, the content and the applicable restriction before drawing conclusions.
Does Wanting Privacy Make VPN Use Suspicious?
Wanting confidentiality should not be confused with intending to commit a crime. The regulator's explanation expressly links the relevant prohibition to fraudulent address use and criminal purpose; it does not treat every private connection as wrongdoing. (TDRA)
However, describing an activity as "private" does not settle whether the activity itself is lawful.
For example, the Cybercrimes Law separately addresses conduct such as online extortion, unlawful acquisition of another person's password and unlawful disclosure of confidential information obtained through work. An assessment cannot stop at the explanation that a VPN was used for privacy. The underlying conduct must also be examined.
Already Used a VPN and Now Concerned?
Start with the facts, not the worst possible interpretation of a headline.
Write down and keep:
- What the VPN was used for
- Which service or system was accessed
- Whether an employer or service provider had authorised that access
- Relevant instructions and correspondence
An accurate account is more useful to a legal adviser than a general statement that you "used a VPN."
Where the concern relates to a workplace tool, ask the organisation's IT or compliance team for written clarification. Where there is an allegation, complaint or official communication, obtain advice specific to that matter promptly. Do not delete or alter relevant material in an attempt to make the concern disappear. See our related guide on cybercrime penalties in the UAE for how these investigations typically proceed.
Make an Informed Decision - Not a Fearful One
A useful legal discussion should leave you knowing what to check, not simply worrying about the largest possible fine.
Before using a VPN, be clear about your purpose, your authority to access the relevant system and the status of the service you intend to use. For businesses, give employees a workable, documented route to lawful access. For individuals, seek clarification where the proposed activity or service is uncertain.
This article provides general information and does not replace legal advice. The applicable law, regulatory requirements and circumstances should be reviewed before acting.
About the Author
