Is VPN Legal in the UAE? Article 10, Company Use and Calling Apps

No Emirati statute bans running a VPN. What the cybercrime decree-law punishes is masking an IP address with the intent to commit a crime or to keep one hidden. Companies, banks and institutions have the regulator's blessing for corporate tunnels, and calling apps answer to a separate licensing regime that no tunnel changes. This is a summary of the texts, not legal advice.

Article 10 of Decree-Law 34/2021, Word by Word

The decree-law on countering rumors and cybercrimes was issued on 20 September 2021, published in the Official Gazette on 26 September, and took effect on 2 January 2022, repealing the 2012 cybercrime law. Article 10 targets any person who circumvents the protocol address of an information network, whether by using another person's address or by any other means, with the intent to commit a crime or to prevent its detection. Both elements must be present; a tunnel without criminal intent falls outside the clause.

The sanction is temporary imprisonment and a fine of not less than AED 500,000 and not more than AED 2,000,000, or either of the two: half a million is a floor, and a judge may impose prison alone or the fine alone. After conviction the court can also forfeit the devices and programs used, and it may order electronic monitoring or a ban on using any information network, breach of which brings imprisonment of not more than one year or a fine of not more than AED 5,000. The full text is on the official legislation portal.

How the Clause Grew From 2012 to 2022

The "two million dirham fine for a VPN" headline traces back to 2016 coverage, which cited the top of the range and dropped the intent requirement.

What TDRA Allows Companies, Banks and Institutions

When alarmed firms asked in July 2016, the regulator replied that no regulation prevents companies, institutions and banks from using VPN technology to reach their internal networks over the internet. The 2017 blocking policy binds licensees, not users: etisalat by e& and du must block categories that help reach prohibited content, including proxy servers and VPN services whose main purpose is such access. An exemption needs TDRA's prior approval, requested in writing with the reason and the users of the exempted line.

Calling Apps: Why the Tunnel Does Not Make the Call Lawful

Voice and video over the internet count as a regulated telecom service under Federal Decree-Law No. 3 of 2003. An app is lawful when a licensee provides it, partners with it, or TDRA approves it. The regulator's FAQ says a person using anything else "may be committing a criminal offence" and that operators will most probably block such traffic. The TDRA internet guidelines list Teams, Zoom, Google Meet for meetings, Webex, Slack, BOTIM and others; WhatsApp, FaceTime and Viber are absent, and Freedom House's 2024 report found their calls still blocked. The report also says routing banned calling apps through a VPN is punishable, but a tunnel alone licenses nothing.

Penalties in the Two Laws

This is a selection relevant to tunnel users, not the full list of sanctions.

Residents, Tourists and Remote Workers

A corporate laptop on hotel Wi-Fi is the exact case TDRA described as allowed; banking and tax portals back home involve no prohibited-content category. For calls, use an app on the regulator's approved list. Install the VPN app before the flight, because operators can block VPN provider websites. A service's claim of working in the Emirates is the provider's word, not legal clearance; the VPNRadarLab travel page covers choosing one.

FAQ

Is a VPN for WhatsApp calls legal in the UAE?

The calls are the problem: Freedom House's 2024 report found WhatsApp voice calls still blocked, and the app is not on TDRA's allowed list.

Does Article 10 apply to tourists?

The article covers "any person"; a passport changes nothing in the wording.

Has anyone been punished only for using a VPN?

The Freedom House reports describe prosecutions over posts and speech; none where a tunnel on its own led to punishment.

Is streaming a home-country service through a VPN a crime?

No statute names it. A 2016 note by Al Tamimi & Company concluded that using a VPN for legitimate purposes is not a crime in itself, and the firm expected enforcement to focus on harmful content. That is the firm's view, not a ruling.

UAE VPN Law in One Paragraph

A tunnel is lawful on its own; Article 10 grips only the crime behind it. Corporate VPN use has the regulator's explicit cover, and whether a call is lawful depends on the calling app being approved, not on the tunnel.