WHEN THE BREACH HITS: FROM CYBER SECURITY INCIDENT TO CORPORATE DISPUTES IN THE UAE
In February 2026, the United Arab Emirates (UAE) Cybersecurity Council reported that national authorities were intercepting between 90,000 and 200,000 cyber attacks daily, with more than 70 percent linked to state-sponsored actors. The World Economic Forum found that 91 percent of large enterprises have adjusted their cyber security strategies in response to geopolitical volatility. For businesses in the UAE, including those in the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM), the question is no longer whether a cyber incident will occur, but how rapidly legal exposure materialises once it does.
The UAE’s convergence of multiple legal systems (federal UAE law, DIFC common law and ADGM common law), combined with its position as a major financial hub, creates unique complexity for incident response. Regional geopolitical tensions further heighten the threat environment.
Responding to a cyber incident in this jurisdiction involves important legal and regulatory nuances that practitioners must navigate throughout the entire incident response lifecycle, not merely at the outset. This article examines the trajectory from cyber attack to corporate dispute through three operational phases: immediate response (the first 72 hours), stabilisation and regulatory engagement (the following weeks), and longer-term disputes (months and beyond). Before turning to those phases, it addresses the overarching UAE legal and regulatory considerations that apply throughout.
The UAE legal landscape: considerations across the incident lifecycle
The legal and regulatory themes outlined below persist through regulatory engagement and remain relevant when disputes crystallise.
Oct-Dec 2026 issue
Ashurst Perkins Coie