Key data privacy and intellectual property issues in the UAE

Publication | November 2011


As the volume of data processed by companies increases exponentially and businesses become ever more aware of the value of intellectual property rights, the legal obligations and protection offered for these intangible assets are an important concern when establishing operations in a new jurisdiction.

Data privacy

Data privacy laws focus on the collection, storage, use, disclosure and processing of personal data. In most legal systems, “personal data” (or the equivalent local term) refers to information relating to an identified or identifiable individual.

Federal laws

The United Arab Emirates (UAE) does not have any specific federal laws on data privacy, but various pieces of legislation may have an impact on businesses that engage in data processing activities. These include the following:

  • The UAE Constitution of 1971, which guarantees the right to secrecy of communications.
  • Federal Law No. 5 of 1985 regarding Civil Transactions, which provides that a person is liable for acts causing harm generally. This could include harm caused by unauthorised use or publication of the personal or private information of another.
  • Federal Law No. 9 of 1987, as amended (Penal Code), which is the primary source of criminal law in the UAE. In articles 378 and 379, it sets out statutory offences and punishments for publication of private matters or the unauthorised disclosure of private information (although private information is not clearly defined).

There are also rules regarding the handling and storage of specific types of data, such as employee information (which must be maintained under the UAE Federal Labour Law) and personal credit information.

Consequently, businesses must be aware of the combination of potentially applicable laws (including regulations specific to their sector) in order to ensure that data is being processed in a lawful manner.

Where a UAE entity imports personal data from another country, it may also be subject to the rules of another jurisdiction governing the export of that data from the originating country. This is a particularly important consideration for intra-group transfers where, for example, under European legislation the exporting group entity would retain primary liability as a data controller.

Free zones

The economic free zone areas of Dubai International Financial Centre (DIFC) and Dubai Healthcare City (DHCC) have their own comprehensive legislative regimes, which apply to companies established in those zones:

  • The processing of personal data by DIFC entities is regulated by DIFC Data Protection Law No.1 of 2007, which aligns closely with the European Data Protection Directive.
  • DHCC Regulation No. 7 of 2008 is the Health Data Protection Regulation for entities operating in DHCC. This is intended to establish certain principles for collecting, using, disclosing and giving access to patient health information. This includes any information about a patient – whether spoken, written or in the form of an electronic record – that identifies the patient and relates to his physical or mental health or condition.

There are also restrictions on transferring personal data or patient health information to recipients located in jurisdictions outside the DIFC or DHCC, respectively. Broadly, these require that – unless the individual to whom the data relates has given his consent – such transfers may take place only if there is an adequate level of protection for the data or information, or if a permit has been obtained from the relevant regulator.

Intellectual property

The UAE is a member of the World Trade Organization and, as such, is obliged to comply with the provisions of the World Intellectual Property Organization (WIPO) Agreement on Trade Related Aspects of Intellectual Property Rights (TRIPS), which sets minimum standards for the protection of intellectual property (IP). However, while a framework of legislation for the main IP rights in the UAE exists (some of which are outlined below) there are no specialist IP courts – and a lack of specialist local advocates. This can make civil litigation a challenge, so enforcement of IP rights is often achieved in other ways, for example (in the case of trade mark infringement), by filing complaints about counterfeiters with the police or customs authorities.


Federal Law No. 7 of 2002 protects various types of literary, artistic, dramatic and musical work. It gives a right to prevent third parties from copying without consent and dealing with infringing works.

Copyright arises automatically upon the creation of an original work in material form, provided it is not in a category that is excluded from protection (for example, legal texts, news reports and works in the public domain). Copyright does not grant the author a monopoly, so he could not prevent a third party from independently creating an identical work.

Unlike many other jurisdictions around the world, in the UAE there is no blanket presumption that copyright in works created by an employee - even if developed in the course of their employment - will be owned by the employer. Companies must therefore take appropriate contractual and procedural steps to safeguard rights in employee-generated works.

Registration is not required to achieve protection, but it is possible to register works by way of an application to the Ministry of Economy and Commerce, with payment of a small fee. While it is not mandatory, registration would facilitate the burden of proof in legal proceedings as the registered works would be public documents.

The protection of written works lasts for the lifetime of the author plus 50 years. Cinematographic works and works of corporate bodies are protected for 50 years from the date of publication. Works of applied arts are protected for 25 years from the publication date and broadcasts are protected for 20 years from the date of first broadcast.

As the UAE is a party to the Berne Convention on the Protection of Literary and Artistic Works, any works created by nationals of other Berne Convention states will be recognised in the UAE.

Trade marks

Federal Law No. 37 of 1992 (as amended by Federal Law No. 8 of 2002) and its implementing regulations govern the protection of trade or service marks, i.e. those signs distinguishing the products or services of one undertaking from those of its competitors. A mark must be distinctive and not identical or confusingly similar to earlier marks.

Trade marks are registered with the UAE Trade Mark Office in one of the classes within the standard international classification of goods and services. It is not possible to register trade marks for goods that are offensive to public policy (such as pork products or alcoholic beverages) and, unlike many countries, the UAE does not permit applications that cover multiple classes – so separate applications have to be filed for marks used across different classes.

The law provides protection for trade marks of “international reputation”. These may not be registered in the UAE without the consent of the original owner.

Trade marks are granted for a ten-year initial term and can be renewed indefinitely for periods of ten years at a time. Marks that are not used for five consecutive years may be at risk of cancellation claims by third parties.
Any trade mark licence must be recorded with the Ministry of Economy. Failure to do so will mean the licence has no effect against third parties.


Patents provide the strongest type of IP protection and the UAE will grant patents to new inventions where the idea is based on scientific principles and is capable of industrial exploitation. Utility certificates may be granted to inventions capable of industrial exploitation that do not necessarily involve an inventive step, and unpublished know-how, industrial designs and industrial models are also protectable under UAE law.

Federal Law No. 17 of 2002 repealed the Patent Law No. 44 of 1992 to bring UAE legislation into line with TRIPS. Since 1998, it has been possible to obtain patent protection in all Gulf Cooperation Council (GCC) member states through the filing of a single application at the GCC Patent Office in Saudi Arabia. The GCC comprises Bahrain, Kuwait, Oman, Saudi Arabia and Qatar as well as the UAE. However, unlike the UAE, the GCC Patent Office is not part of the Patent Cooperation Treaty (PCT) system, so GCC patents cannot be included on a multi-country PCT application.

Examination of patent applications after filing currently takes several years, but the protection for a UAE or GCC patent will run for 20 years from the original filing date. Design patents (which can protect the shape or pattern of an object) are protected in the UAE for ten years from the original filing date.

Any patent licence must be recorded with the Ministry of Economy. Failure to do so will mean the licence has no effect against third parties.



Dino Wilkinson

Dino Wilkinson

Abu Dhabi Bahrain Dubai