Cyber insurance in the UAE

What must you do after a data breach?

Art 9(1) of Decree-Law 45 of 2021 requires a controller to notify the data office of a breach that would prejudice the privacy, confidentiality and security of data. The period is set by the Executive Regulations. Sources disagree on whether those regulations have been issued.¹

The law leaves out, among others, personal health data and personal banking and credit data that have their own legislation, and free-zone companies with special data protection legislation (Art 2(2)). DIFC and ADGM run their own data protection regimes with their own commissioners.¹² Chambers also reports that the cybercrime law, Decree-Law 34 of 2021, criminalises unauthorised access to and misuse of personal data, with heavier penalties for medical, banking and electronic payment data.²

Ask the Data Office where the regulations stand.

Does UAE law require cyber insurance?

No law requiring it has been identified. Decree-Law 45 of 2021 names no insurance duty.¹ Decree-Law 6 of 2025, Art 82, only says where cover for funds, property and liabilities in the UAE is placed, which is with licensed insurers. It does not name cyber.³

One insurer’s blog names cyber liability insurance as cover to consider for cyberattacks, without describing its terms.⁴ Check whether any client contract or tender asks for cyber cover.

Would a cyber policy respond to a claim for harm?

Under the Civil Code, compensation covers loss and lost profit that are a natural consequence of the harmful act (Art 255). Moral harm includes infringement of reputation (Art 254).⁵ Civil liability sits outside the data protection law.

Ask your insurer whether a cyber policy would respond to such a claim.

Which sectors appear in CPX’s incident data?

In CPX’s 2024 data, government made up 34.9% of incidents, ahead of finance at 21.3% and energy at 14.1%.⁶

7 categories. Highest: Government, 34.9%. Lowest: IT services, 4.8%.

Data and source

Source: CPX with the UAE Cybersecurity Council, State of the UAE Cybersecurity Report 2025, Figure 9. Accessed 4 Nov 2026. CPX sells security services and the incident base is its own.

Sector	Share of incidents
Government	34.9%
Finance	21.3%
Energy	14.1%
Insurance	11.6%
Healthcare	6.7%
Defence	6.6%
IT services	4.8%

CPX sells security services, and these are incidents from its own operations. They do not show frequency per company, loss values or risk to small firms.

Does the Central Bank publish figures for cyber insurance?

The Central Bank report does not show cyber separately.⁷

Evidence table

Source	What it says
Federal legislation portal	Issued 20 September 2021. Effective 2 January 2022. Shown as active.
Chambers 2026 guide, last updated 10 March 2026	Implementing Regulations have yet to be issued. The Data Office has not yet become fully operational.
A social media post	Became effective on 1 January 2026. No primary text supports this date.
Another web page	Refers to a 2027 readiness date. No primary text supports this date.

The small print

• Where the law stands. The federal portal record shows the law as active.⁸ Chambers says the Implementing Regulations had not been issued.² Art 28 called for the Executive Regulations within six months of promulgation. Art 29 gives controllers and processors six months to regularise after those regulations are issued.¹
• Complaints and penalties. Under Art 24, data subjects may complain, and penalties follow proven violations. Art 26 leaves the violations and penalties to a Council of Ministers decision.¹
• Placement rule. Art 82(4) of Decree-Law 6 of 2025 gives exceptions to the placement rule, including cover not available in the State.³
• CPX. The same report counts about 223,800 digital assets in the UAE attack surface. Its threats surfaced in 2024.⁶