Social Media Policy (UAE)
SOCIAL MEDIA POLICY
[Company Name]
[Policy Version] | Effective: [Effective Date]
This Social Media Policy governs the use of social media platforms by employees of [Company Name], both in their official capacity and in personal use where the Company's name, reputation, or confidential information may be involved. The policy is issued under Federal Decree-Law No. 33 of 2021 on Regulation of Labour Relations, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime, and Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
1. PURPOSE AND SCOPE
1.1 Purpose: Social media platforms — including LinkedIn, Instagram, X (formerly Twitter), Facebook, TikTok, Snapchat, YouTube, and messaging applications such as WhatsApp — are powerful communication tools that carry significant legal, reputational, and regulatory risk in the UAE. This policy protects [Company Name], its employees, and its clients from that risk while allowing employees to use social media responsibly and legally.
1.2 Scope: This policy applies to all employees of [Company Name] at all times, whether using Company-issued or personal devices, during working hours or outside them, when content involves the Company, its employees, its clients, or any subject matter that is regulated under UAE law. The policy covers both official Company social media accounts managed by [Official Accounts Owner] and personal social media accounts where the employee is identifiable as an employee of [Company Name].
2. OFFICIAL COMPANY SOCIAL MEDIA ACCOUNTS
2.1 Management and Authorisation: Official Company social media accounts are managed by [Official Accounts Owner]. Only employees expressly authorised in writing by [Official Accounts Owner] may create, access, post to, or administer an official Company account. Account credentials must be stored in the Company's approved password management system and must not be shared outside the authorised team.
2.2 Content Standards: All content published on official Company accounts must be accurate, professional, and compliant with UAE law. Content must not: mislead consumers contrary to Federal Decree-Law No. 36 of 2023 on Consumer Protection; make unsubstantiated claims about Company products or services; disclose confidential information or personal data regulated under Federal Decree-Law No. 45 of 2021; or constitute advertising regulated under Federal Decree-Law No. 15 of 2020 on Consumer Protection without prior legal review.
2.3 Crisis and Negative Comments: Negative comments, complaints, or media enquiries directed at official accounts must be escalated to [Media Spokesperson] immediately and must not be responded to without authorisation. Employees must not engage in public arguments on behalf of the Company, make commitments to customers, or make statements about legal, regulatory, or financial matters through official channels without appropriate approval.
2.4 Account Ownership: All official Company social media accounts, including their usernames, followers, and content, are the property of [Company Name]. On exit, employees with access to official accounts must transfer credentials and access immediately and must not retain personal access to any Company account after their last working day.
3. PERSONAL SOCIAL MEDIA USE
3.1 Employer Identification: [Personal Posting Rule]. Where an employee's personal profile identifies their employer, their posts may be perceived by the public as reflecting the Company's views. Employees in this position must observe the prohibited content standards in Section 4 at all times on personal accounts.
3.2 Confidentiality: Employees must never post, share, or comment on confidential Company information, including financial data, client identities, business strategies, contract terms, personnel matters, or any other non-public information. The confidentiality obligations in the employee's employment contract apply to social media posts in the same way as to any other form of communication. Breach of confidentiality via social media may constitute gross misconduct under Article 44 of Federal Decree-Law No. 33 of 2021.
3.3 Colleagues and Clients: Employees must not post content that could be considered harassment, bullying, or defamation of a colleague, client, or business partner. Discrimination based on nationality, gender, religion, or other protected characteristics in social media posts may constitute a criminal offence under UAE law and will be treated as gross misconduct.
3.4 No Speaking for the Company: Unless expressly authorised by [Official Accounts Owner] or [Media Spokesperson], employees must not make statements on personal accounts that purport to represent the Company's views, announce Company decisions, or comment on matters of Company policy or legal proceedings.
4. PROHIBITED CONTENT UNDER UAE LAW
The following categories of content are prohibited on all social media platforms — official and personal — and may constitute criminal offences under UAE law: (a) Content that insults, defames, or publishes false information about any individual, business, or government entity — criminalised under Articles 20–26 of Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime, with penalties of imprisonment and fines from AED 150,000; (b) Content that incites religious hatred, sectarianism, or discrimination on the basis of religion, race, nationality, or gender — prohibited under Federal Decree-Law No. 31 of 2021 on Issuance of the Crimes and Penalties Law; (c) Content that insults or disrespects the UAE, its government, leadership, or national symbols — criminalised under Federal Decree-Law No. 34 of 2021; (d) Content that threatens national security or public order; (e) Publication of personal data about any individual without their consent, in breach of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; (f) Publication of photographs or videos of colleagues, clients, or Company premises without consent, which may breach both the PDPL and Federal Decree-Law No. 34 of 2021; (g) Promotion of competing businesses or personal commercial activities using Company resources or during working hours without prior written consent.
5. COMPLIANCE AND DISCIPLINARY CONSEQUENCES
5.1 Disciplinary Action: Breaches of this policy are misconduct addressed through the progressive disciplinary tariff under Article 60 of Federal Decree-Law No. 33 of 2021. Serious breaches — including publication of defamatory content, breach of confidentiality, incitement, or any conduct that violates Federal Decree-Law No. 34 of 2021 — will be treated as gross misconduct under Article 44, potentially resulting in summary dismissal without notice. The Company will assess each case on its specific facts and consequences.
5.2 Criminal Liability: Employees who breach the prohibitions in Section 4 on personal devices and accounts bear personal criminal liability under UAE law, including Federal Decree-Law No. 34 of 2021. The Company will not indemnify employees for personal criminal liability arising from social media misconduct. In cases where the conduct also harms the Company, the Company may file a separate civil or criminal complaint.
5.3 Reporting: Employees who become aware of a breach of this policy by a colleague, whether on official or personal accounts, should report it to [HR Email]. Reports will be treated confidentially to the extent possible.
5.4 Questions: Questions about whether a specific post, campaign, or comment is permitted under this policy should be directed to [Official Accounts Owner] or [HR Email] before the content is published. When in doubt, do not post.
ACKNOWLEDGMENT
By signing below, I confirm that I have received, read, and understood the [Company Name] Social Media Policy ([Policy Version]) and agree to comply with its provisions in both my official and personal use of social media platforms.
Employee Name: ___________________________ Employee ID: _______________
Signature: _______________________________ Date: _______________
Authorised by [Company Name]: _______________ Date: _______________
Employer (Authorised Signatory)
________________
Signature
Employee
________________
Signature
What Is a Social Media Policy (UAE)?
A Social Media Policy in the United Arab Emirates is a formal employer document that governs employee use of social media platforms — including LinkedIn, Instagram, X (formerly Twitter), Facebook, TikTok, YouTube, Snapchat, and messaging applications such as WhatsApp and Telegram — in both official and personal capacities where the employer's name, reputation, clients, or confidential information are involved. The policy is grounded in three major UAE legal frameworks: Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime (the UAE Cybercrime Law), Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), and Federal Decree-Law No. 33 of 2021 on Regulation of Labour Relations (the UAE Labour Law).
The UAE operates one of the most strictly enforced digital-content regulatory frameworks in the Middle East. Federal Decree-Law No. 34 of 2021 replaced earlier cybercrime legislation with a comprehensive statute covering online defamation, publication of false information, harassment, incitement to sectarianism, insult to state institutions, and data privacy violations. Articles 20–26 specifically criminalise online defamation and the publication of content causing public alarm, with penalties ranging from fines of AED 150,000 to imprisonment for serious offences. The Cybercrime Law applies to all electronic communications within the UAE and to content published outside the UAE but accessible in the UAE — which includes virtually all international social media platforms.
For employers, the Social Media Policy serves three distinct functions. First, it protects the Company's reputation and confidential information by telling employees what they may not post about the Company, its clients, its employees, and its operations. Second, it provides legal notice to employees of the criminal and disciplinary consequences of prohibited conduct, satisfying the Article 60 requirement of a written and communicated disciplinary system under Federal Decree-Law No. 33 of 2021. Third, it clarifies the ownership and governance of official Company social media accounts, preventing disputes when an employee who managed those accounts leaves the organisation.
The PDPL dimension of a UAE Social Media Policy is significant. Federal Decree-Law No. 45 of 2021 prohibits the publication of personal data — photographs, names, contact details, or any information that identifies a natural person — without the subject's consent. An employee who photographs colleagues at a Company event and posts the photos on Instagram without consent may violate the PDPL. An employee who names a client in a post without permission similarly creates PDPL liability for the employer. The Social Media Policy must address these scenarios explicitly.
For DIFC employees, the DIFC Employment Law No. 2 of 2019 (as amended) provides the disciplinary framework, and the DIFC Courts have jurisdiction over disputes. For ADGM employees, the ADGM Employment Regulations 2019 and ADGM Courts apply. However, Federal Decree-Law No. 34 of 2021 and Federal Decree-Law No. 45 of 2021 are federal statutes that apply throughout the UAE, including within free zones, so the Social Media Policy's prohibited-content provisions apply equally to all employees regardless of their employment jurisdiction.
The forms-legal.com UAE Social Media Policy template covers all required elements: purpose and scope, official account governance, personal use rules, employer-identification obligations, confidentiality, prohibited content categories with UAE statutory references, disciplinary consequences under Article 60 and Article 44 of the Labour Law, and a signed acknowledgment block.
When Do You Need a Social Media Policy (UAE)?
A UAE Social Media Policy is needed in the following specific circumstances.
At onboarding, before any employee accesses official Company social media accounts or begins interacting with clients or the public in any digital capacity. Without a signed policy, the employer cannot take proportionate disciplinary action for social media misconduct. The UAE's criminal exposure under Federal Decree-Law No. 34 of 2021 means that even a single defamatory post by a negligent employee can create liability for the Company as account operator and the employee personally.
When assigning an employee to manage official social media accounts, a clear policy is needed to define the content-approval process, the account-ownership rules, and the credential-management requirements. Without these controls, the Company is one disgruntled ex-employee away from a reputational crisis caused by unauthorised posts or locked account access.
After a social media incident — a defamatory post, an accidental confidentiality disclosure, or a post that receives negative public attention — the employer needs a signed policy to support the disciplinary process under Article 60 of Federal Decree-Law No. 33 of 2021 and, if needed, to take swift action under Article 44 for gross misconduct. Without a signed policy, the employer's ability to dismiss based on social media conduct alone is significantly weakened in MOHRE mediation.
When employees are encouraged to use LinkedIn or other platforms for business development, the employer needs a Social Media Policy to define what they may and may not say on behalf of the Company in their professional capacity. Employee advocacy without policy guidance creates the same legal exposure as official account posts.
When the Company is subject to MOHRE establishment inspections or legal proceedings, the existence of a written, communicated Social Media Policy demonstrates that the employer takes legal compliance, data protection, and employee conduct seriously — a fact that MOHRE mediators and Federal Labour Court judges take into account when assessing the employer's overall management standards.
What to Include in Your Social Media Policy (UAE)
A UAE Social Media Policy compliant with Federal Decree-Law No. 34 of 2021, Federal Decree-Law No. 45 of 2021, and Federal Decree-Law No. 33 of 2021 must include the following elements. The forms-legal.com UAE Social Media Policy template covers each one.
Purpose and scope must identify the Company, name the specific platforms covered (including messaging apps), define all categories of user covered, and state that the policy applies both during and outside working hours for conduct that affects the Company's interests.
Official account governance must identify the account owner, specify who is authorised to post, describe the content-approval workflow, and state clearly that all official accounts are Company property. The credential-management and access-revocation process on employee exit must be explicit.
Personal posting rules must state whether employees may identify their employer in personal profiles and, if so, what obligations they assume by doing so. The policy must distinguish between employees speaking in a personal capacity and employees speaking as a Company representative.
Confidentiality obligations must prohibit disclosure of any non-public Company information, client data, financial results, or personnel matters through social media. The prohibition must apply to all electronic channels, including private group messages that may be forwarded.
Prohibited content categories must list each category of prohibited content with the specific UAE statutory provision that makes it illegal: defamation under Article 20 of Federal Decree-Law No. 34 of 2021, PDPL violations under Federal Decree-Law No. 45 of 2021, incitement under Federal Decree-Law No. 31 of 2021 on Issuance of the Crimes and Penalties Law. Named statutory references communicate the seriousness of the consequences and strengthen the employer's disciplinary position.
Disciplinary consequences must reference Article 60 of the Labour Law for the progressive tariff and Article 44 for gross misconduct. The policy must state that criminal conduct will not be indemnified by the Company and will be reported to the relevant UAE authority.
Reporting mechanism must name the person and contact address to whom suspected breaches should be reported, and confirm that good-faith reports will be treated confidentially.
Acknowledgment block must include employee name, ID, signature, and date, plus an authorised Company countersignature.
How to Fill Out Your Social Media Policy (UAE)
Completing the UAE Social Media Policy template requires the employer to make deliberate choices that reflect its brand presence, employee profile, and industry risk.
Begin with Company Information. Enter the legal company name, the effective date, and the version number. Use a version system so that updated editions can be distinguished from prior versions in any disciplinary proceeding.
In the Official Accounts section, enter the full name and title of the person or department responsible for managing Company social media accounts. If the Marketing Department is responsible, name the Marketing Manager. If the CEO handles it personally, say so. The more specific the designation, the clearer the internal accountability.
Choose the personal posting rule that fits your organisation. Most UAE employers with a public brand profile prefer the first option — allowing employees to identify their employer provided they comply with the policy's prohibited-content standards — because prohibiting all employer identification is impractical for a professional workforce that uses LinkedIn for career building. The second option (written approval required) suits employers in sensitive industries such as financial services, healthcare, or government contracting, where employee statements could create regulatory exposure.
Enter the media spokesperson name. This person will be contacted by employees who receive media enquiries or negative comments on official accounts. The spokesperson should be a senior leader who is trained in UAE media law and aware of the criminal consequences of defamatory public statements.
Enter the HR contact email. This is where employees should direct compliance questions and breach reports. Ensure the address is monitored by someone who can respond promptly.
Distribute the completed policy to all employees at onboarding. For employees who manage official accounts, provide additional training on the content-approval workflow and the credential-management system. Collect signed acknowledgments and store them in each employee's personnel file alongside the employment contract.
Review and update the policy annually and whenever a platform's terms of service change significantly, a new platform is adopted for Company use, or a legal development in UAE digital law affects the policy's content. The UAE Cybercrime Law framework has evolved rapidly since 2016 and further amendments are possible.
Legal Requirements for Social Media Policy (UAE)
Social Media Policy (UAE) — Legal Requirements.
Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime is the primary digital-content statute. Articles 20–26 criminalise online defamation, publication of false information, harassment, and incitement to sectarianism or discrimination, with penalties from AED 150,000 fines to multiple years of imprisonment. The Cybercrime Law applies to all electronic publications, including social media posts, WhatsApp messages, and private group communications.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) prohibits the publication of personal data — including photographs, names, and contact details — without the subject's consent. Violations are subject to administrative penalties of up to AED 5 million imposed by the UAE Data Office.
Federal Decree-Law No. 31 of 2021 on Issuance of the Crimes and Penalties Law criminalises incitement to hatred, discrimination on the basis of religion, race, or nationality, and insult to state institutions.
Federal Decree-Law No. 33 of 2021 (UAE Labour Law) provides the employment-law foundation. Article 60 requires a written disciplinary system for any sanction. Article 44 permits summary dismissal for gross misconduct including acts that cause serious harm to the employer, breach of confidentiality, and disclosure of trade secrets. Article 5 prohibits discrimination.
Federal Decree-Law No. 36 of 2023 on Consumer Protection prohibits misleading advertising and false marketing claims published through any channel, including social media.
Federal Law No. 38 of 2021 on Intellectual Property Rights applies to any copyrighted content (music, images, text) used in social media posts without a valid licence.
For DIFC employees: DIFC Employment Law No. 2 of 2019 and DIFC Courts. For ADGM employees: ADGM Employment Regulations 2019 and ADGM Courts. Federal cybercrime and PDPL statutes apply UAE-wide including in free zones.
Common Mistakes to Avoid in Your Social Media Policy (UAE)
UAE Social Media Policy — Common Mistakes That Create Reputational and Legal Exposure.
1. Not addressing messaging apps. UAE enforcement under Federal Decree-Law No. 34 of 2021 covers WhatsApp and Telegram group messages as well as public posts. A Social Media Policy that only mentions 'social media platforms' without naming messaging applications leaves a gap that employees will exploit and that cannot be relied upon in disciplinary proceedings.
2. No content-approval workflow for official accounts. Many UAE businesses allow employees to post to official accounts without any approval process. A single unauthorised post — a typo that becomes defamatory, a photo that violates the PDPL, a comment that misrepresents a client relationship — can create significant legal and reputational damage. A simple one-step approval by the account owner before publication is essential.
3. Failing to address the personal-employer-identification scenario. Employees who list their employer on LinkedIn are perceived by the public as representing the Company whenever they post. A Social Media Policy that does not address this creates ambiguity about whether the employee's personal posts implicate the Company. Stating the position clearly — whether personal posts with employer identification are permitted, with what conditions — eliminates that ambiguity.
4. Not including UAE statutory references. A Social Media Policy that prohibits 'defamatory content' without mentioning Federal Decree-Law No. 34 of 2021 and its specific criminal penalties fails to communicate the seriousness of the prohibition. Named statutory references with penalty ranges make the policy a more effective deterrent.
5. No account-exit procedure. Employees who leave with access to Company social media accounts — or who remain as administrators after their employment ends — represent a significant risk. The policy must include a clear exit procedure and the employer's IT systems must enforce it technically by revoking admin access on the last working day.
6. Ignoring PDPL in social media content. Posting photographs of customers, posting client testimonials with names, or tagging colleagues in posts without their consent may breach Federal Decree-Law No. 45 of 2021. The Social Media Policy must address employee content featuring personal data and require consent before any personal data about a third party is published.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Social Media Policy (UAE) (United Arab Emirates) [Legal document template]. Forms Legal. https://forms-legal.com/uae/employment/hr-forms/social-media-policy-uae
"Social Media Policy (UAE) (United Arab Emirates)." Forms Legal, 2026, https://forms-legal.com/uae/employment/hr-forms/social-media-policy-uae.
@misc{formslegal-social-media-policy-uae,
author = {{Forms Legal}},
title = {Social Media Policy (UAE) (United Arab Emirates)},
year = {2026},
howpublished = {\url{https://forms-legal.com/uae/employment/hr-forms/social-media-policy-uae}},
note = {Free legal document template. Based on Federal Decree-Law No. 34 of 2021 (UAE Cybercrime Law) & Federal Decree-Law No. 33 of 2021 (UAE Labour Law)}
}Frequently Asked Questions
The UAE has some of the most specific digital-content restrictions in the region, codified primarily in Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime. Under Articles 20–26 of that law, the following categories of content are criminalised: publishing false information or rumours that cause panic or harm to state security; defaming or insulting any person online; harassing individuals through electronic means; publishing content that insults religious figures, national symbols, or state institutions; and inciting sectarianism, discrimination, or public disorder.
The penalties are substantial. Online defamation under Article 20 carries a fine of not less than AED 150,000 and potential imprisonment. Publishing content that threatens state security under Article 24 carries imprisonment of no less than two years and a fine of not less than AED 500,000. These are personal criminal liabilities — the individual who publishes the content bears the risk, not their employer — though the employer may face regulatory scrutiny if the conduct occurred on Company devices or systems.
For employers, the practical implication is that a Social Media Policy must explicitly list the prohibited categories and reference the relevant UAE statutory provisions. An employee who is disciplined for a social media post that they did not know was illegal in the UAE cannot be fairly dismissed without having been on prior notice of the prohibition. The signed Social Media Policy is that notice. Beyond the Cybercrime Law, UAE defamation claims can also be pursued civilly under the UAE Civil Code (Federal Law No. 5 of 1985), and data-protection violations through social media are subject to Federal Decree-Law No. 45 of 2021 administered by the UAE Data Office.
Yes, in certain circumstances. Federal Decree-Law No. 33 of 2021 on Regulation of Labour Relations (the UAE Labour Law) permits disciplinary action and even summary dismissal under Article 44 for employee conduct that causes serious harm to the employer, regardless of whether the conduct occurred during working hours. If an employee's personal social media post discloses confidential Company information, defames a client, or damages the Company's reputation in a way that has real commercial consequences, the employer has a legitimate basis to take disciplinary action.
The key is proportionality and documentation. The employer must show that: the conduct caused or was likely to cause genuine harm to the Company or its clients; the employee was on prior notice that such conduct was prohibited (through the signed Social Media Policy); and the disciplinary response was proportionate to the harm caused. Minor personal posts that have no connection to the employer and cause no harm do not justify disciplinary action, even if the employer finds them distasteful.
For posts that constitute criminal conduct under Federal Decree-Law No. 34 of 2021 — for example, content that insults state institutions or defames an individual — the employer may have an additional basis for summary dismissal under Article 44 on the grounds that the employee's conduct places the Company in an untenable position or demonstrates a fundamental breach of the trust required in the employment relationship. Each case must be assessed on its specific facts, and employers should take legal advice before dismissing an employee solely for personal social media conduct.
Official Company social media accounts — including their usernames, followers, content history, and analytics — are the property of the employer, not the individual employee who managed them. This principle is supported by the UAE Civil Code (Federal Law No. 5 of 1985) as a matter of intellectual property and employer ownership of work product created in the course of employment, and by Federal Law No. 38 of 2021 on Intellectual Property Rights.
However, ownership disputes do arise in practice, particularly when an employee set up the account before being formally employed, when the account was originally personal and later 'converted' to a Company account, or when the account's usernames are associated with the employee's name or personal brand. To avoid these disputes, the Social Media Policy should clearly state that all official accounts, regardless of how or when they were created, are Company property, and that on termination the employee must transfer access immediately and confirm in writing that they have no remaining access.
From a practical standpoint, Company social media accounts should be registered under the Company email address (not the employee's personal email), use shared credentials stored in a Company-controlled password manager, and have multi-factor authentication linked to a Company-controlled mobile number or email. Employees who are granted administrator access should do so through their personal profiles adding the Company account as a managed entity (as LinkedIn Pages and Facebook Business Manager work), rather than through shared login credentials, so that access can be revoked by removing the employee's administrator role without needing to change account passwords. The Social Media Policy's account-return section and its acknowledgment are the employment-law foundation for enforcing these IT arrangements.
Employers can ask or encourage employees to post on LinkedIn for marketing, recruitment, or business-development purposes, but requiring employees to post on personal accounts as a condition of employment is legally nuanced in the UAE context. An employee's personal social media account is their personal platform, and compelled speech on a personal platform could engage the employee's rights under the UAE Civil Code and, for DIFC employees, the DIFC Employment Law No. 2 of 2019.
The more defensible approach is to invite participation — through an employee advocacy programme with clear content guidelines, training on what is appropriate, and recognition for active participants — rather than mandating it as a performance metric. If employee advocacy is genuinely required as part of a role's responsibilities (for example, a business-development role where LinkedIn outreach is a core job function), this should be stated in the employment contract and aligned with a separate written social media advocacy guide, not imposed through the Social Media Policy after onboarding.
From the perspective of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, employer monitoring of employee LinkedIn activity — even if the account has a Company profile — involves processing personal data and must be disclosed. Any arrangement where the employer accesses or reviews an employee's personal LinkedIn account must be supported by a PDPL-compliant processing notice and, ideally, the employee's written consent. The Social Media Policy should address this scenario specifically if the Company runs an employee-advocacy programme.
A former employee who continues to post Company confidential information on social media after their employment ends may be in breach of the post-employment confidentiality obligations in their employment contract, and may also be committing a criminal offence under UAE law depending on the nature of the information. The employer has several remedies available.
Civil remedies under the UAE Civil Code (Federal Law No. 5 of 1985) and the employment contract include seeking an injunction from the Federal Courts or Dubai Courts to compel the removal of specific posts and to prohibit further disclosure. The employer can also claim damages for any financial loss caused by the disclosure, including lost business, reputational harm, and costs incurred in remedying the breach.
If the information constitutes a trade secret, disclosure may be a criminal offence under Federal Decree-Law No. 31 of 2021 on Issuance of the Crimes and Penalties Law (Articles 399–402) or under Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime. The employer can file a criminal complaint with the UAE police or the public prosecutor, which can result in investigation, arrest, and prosecution of the former employee.
If the disclosure involves personal data of customers or colleagues, the UAE Data Office may also have jurisdiction to investigate and impose penalties on the former employee as an individual data processor. The employer should document all published posts (screenshots with timestamps and URLs), preserve evidence of the harm caused, and seek legal advice from a UAE-licensed lawyer before deciding whether to pursue civil action, a criminal complaint, or both. The Social Media Policy's confidentiality and post-employment obligations section provides the contractual foundation for the civil claim.
Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime applies to content published through any electronic means, including WhatsApp, Telegram, and other messaging applications. The law does not distinguish between public social media posts and private group messages: defamatory content, false information, or incitement posted in a WhatsApp group of colleagues can give rise to criminal liability in the same way as a public post.
In the employment context, this creates a specific risk around internal workplace communication. Employees who make derogatory comments about colleagues, managers, or clients in a WhatsApp group — even a private group with a small number of participants — may commit a defamation offence under Article 20 of Federal Decree-Law No. 34 of 2021 if the content is shared or if the person defamed becomes aware of it and files a complaint. The fact that the group was 'private' is not a complete defence.
From the employer's perspective, WhatsApp communications on Company devices or in groups created for work purposes (client groups, project groups) are Company communications and are subject to the IT Acceptable Use Policy as well as the Social Media Policy. Personal WhatsApp groups on personal devices are outside the employer's direct control but remain subject to the employee's personal criminal liability. The Social Media Policy should note that these messaging platforms are covered by the same prohibited-content standards as public social media, and that employees bear personal criminal liability for content they publish or distribute through any electronic channel under UAE law. Including this notice in the signed Social Media Policy protects the employer from being seen as condoning employee conduct that violates the Cybercrime Law.
If an employee posts defamatory content on an official Company social media account — one managed by the employer, identified with the Company brand — the employer faces primary liability as the publisher of that content under UAE law. Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrime holds the operator of an electronic platform responsible for content published through that platform, not just the individual who typed the message. The affected party can file a complaint against both the company (as account operator) and the individual employee.
Civil liability under the UAE Civil Code (Federal Law No. 5 of 1985) follows a similar principle. A company is vicariously liable for the acts of its employees performed in the course of their employment. An employee who posts defamatory content while acting in their capacity as the Company's social media manager is acting within the scope of employment, and the Company may be held jointly liable for any damages awarded.
The practical implication is that the Social Media Policy must implement a content-approval workflow for official accounts: no post should go live without review by an authorised person, and sensitive content should require sign-off from [Media Contact Name] or legal counsel. Access to official accounts must be restricted to a small number of trained, authorised employees. The Policy's acknowledgment block gives the employer a contractual basis to seek indemnification from the employee for any loss caused by an unauthorised or policy-violating post, but this contractual remedy does not eliminate the employer's primary liability to third parties. Quick removal of defamatory content and proactive engagement with the affected party are the most effective ways to mitigate harm after a posting incident occurs.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Employee Handbook (UAE)
A comprehensive Employee Handbook for UAE private-sector employers, structured under Federal Decree-Law No. 33 of 2021 and Cabinet Resolution No. 1 of 2022. Covers employment basics, pay, WPS, leave, conduct, discipline, grievances, and exit procedures.
IT Acceptable Use Policy (UAE)
A comprehensive IT Acceptable Use Policy for UAE employers, covering permitted and prohibited uses of Company IT assets, PDPL data-protection obligations under Federal Decree-Law No. 45 of 2021, UAE Cybercrime Law compliance, monitoring disclosures, and disciplinary consequences.
Employee Code of Conduct (UAE)
A comprehensive Employee Code of Conduct for UAE private-sector employers, aligned with Federal Decree-Law No. 33 of 2021 and Cabinet Resolution No. 1 of 2022. Covers professional standards, integrity, data protection, and the disciplinary procedure.
Non-Disclosure Agreement (UAE)
A mutual confidentiality agreement binding both parties to protect proprietary information under the UAE Civil Code (Federal Law No. 5 of 1985) and the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Suitable for joint ventures, M&A due diligence, and technology licensing in the United Arab Emirates.
Data Processing Agreement (UAE)
A data processing agreement for the UAE governing how a data processor handles personal data on behalf of a data controller, fully compliant with the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) administered by the UAE Data Office.