In the present world, where data is money, confidentiality is an important part of every company. Client information, trade secrets, financial records, and other business information are required to be kept strictly confidential. Data loss prevention systems and similar security measures have been established by companies to monitor and protect data and to regulate how employees handle company information in the course of their work.
Even if you send company data to your personal email account, WhatsApp, cloud storage, or any other personal account or device, it could potentially lead to serious consequences, including the possibility of a criminal case being filed against you. Cybercrime legislation in the UAE provides strong protection against the unauthorised use or disclosure of confidential business information.
Under Article 8 of Federal Decree-Law No. (34) of 2021 on Countering Rumors and Cybercrimes, specific provisions deal with the infringement of data of financial, commercial, or economic establishments.
The Article states that a person may be committing an offence if, without permission and by using information technology, they obtain, possess, modify, destroy, reveal, leak, cancel, delete, alter, copy, disseminate, or re-disseminate confidential data or information belonging to a financial, commercial, or economic establishment. In simple terms, the provision protects confidential business information from being unlawfully accessed, copied, transferred, disclosed, altered, or misused through computers, phones, networks, or other information technology. For example, if a person unlawfully obtains a company’s confidential customer database and copies or shares it with another person, the provision may apply. The offence carries a minimum punishment of five years’ imprisonment and a fine of not less than AED 500,000 and not more than AED 3,000,000.
There have also been cases in which individuals have faced imprisonment, substantial fines, and deportation in connection with cybercrime offences. The consequences can therefore extend beyond the workplace and may have serious personal and professional implications.
Conclusion
Employees should exercise caution when handling company data, even where there is no intention to misuse the information. Do not transfer, copy, forward, download, or store company data on personal email accounts, WhatsApp, personal cloud storage, mobile phones, USB drives, or other personal devices unless you are expressly authorised to do so. The fact that the information was transferred without an intention to cause harm does not necessarily eliminate the legal risks involved.
Before moving any company information outside the systems authorised by your employer, make sure that you have the necessary permission and follow the company’s data protection and information security policies. A seemingly simple act of forwarding or transferring company data can potentially result in disciplinary action, loss of employment, substantial fines, and criminal proceedings.