Regulation7 September 20263 min read

UAE cyber regulation in 2026: the National Cyber Security Strategy, the new Central Bank law and the PDPL in practice

The UAE is moving from frameworks to accreditation, liability and supply-chain transparency. A guide for organisations operating in or serving the Emirates.

By the Aureon Intelligence analyst team

The United Arab Emirates has one of the most active cybersecurity regulatory agendas in the region, and 2025 and 2026 have brought a shift in tone: from standards that organisations were expected to adopt towards accreditation, direct liability and supply-chain obligations. This article summarises the developments that organisations operating in, or serving clients in, the UAE need to understand.

National Cyber Security Strategy 2025 to 2031

The national strategy sets the direction for the next five years. Two elements have immediate operational consequences:

  • The National Cyber Accreditation Programme (NCAP) is being rolled out during 2026. Cybersecurity work on critical infrastructure is to be restricted to accredited providers. Organisations that operate critical infrastructure should expect to be asked which of their suppliers are accredited, and providers should plan for the accreditation process.
  • A Secure Supply Chain Programme requires transparency about software components, including Software Bill of Materials practices. This aligns the UAE with the direction of the EU Cyber Resilience Act and will affect vendors selling into the Emirates.

The Information Assurance Standards (IAS) remain the baseline control framework for government and critical sectors, with implementation and audit requirements and potential fines for non-compliance in sectors such as energy and utilities.

Federal Decree-Law No. 6 of 2025: the Central Bank's reach widens

In force since September 2025, the new Central Bank law expands supervision to fintechs, payment processors and crypto-asset firms. Article 149 requires robust fraud prevention and detection mechanisms, and the law mandates prompt reporting of breaches, including technology-related fraud, to the Central Bank.

Two features deserve the attention of boards. The law introduces strict liability with administrative penalties, and it contemplates criminal liability for management negligence. In practical terms, financial entities must be able to demonstrate operational resilience with defined recovery objectives, not only preventive controls. That is a DORA-like posture and it rewards the same preparation: incident classification, tested recovery and evidence.

Personal data: PDPL and the DIFC amendment

Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, continues to govern personal data outside the financial free zones. Its data localisation and transfer restrictions for sensitive data matter for international organisations, and health data is treated as grounded within the UAE absent special provisions. Transfer impact assessments and contractual safeguards are the working tools.

The DIFC Data Protection Amendment Law No. 1 of 2025, in force since July 2025, is significant for the many financial and professional services firms in the Dubai International Financial Centre. It creates a private right of action for individuals claiming financial loss and damage, including distress, establishes direct processor liability for compliance failures and requires transfer impact assessments for high-risk processing. The litigation exposure attached to a data breach in the DIFC has therefore increased.

Child digital safety

Federal Decree-Law No. 26 of 2025, effective January 2026, obliges internet service providers and digital platforms to implement content filtering and age verification, with substantial fines for non-compliance. Platforms serving UAE users should review their obligations.

Threat context

The regulatory tightening sits against a backdrop of sustained targeting. Public reporting in August 2026 described the UAE fending off its third sector-targeting cyber campaign of the year, following finance with aviation and energy. The combination of high-value sectors, extensive digitalisation and regional tension keeps the Emirates in the sights of both criminal and state-aligned actors.

What to do

  1. Determine which regimes apply to each entity: federal PDPL, DIFC or ADGM data protection, Central Bank rules, sector regulators and emirate-level frameworks such as Dubai's DESC ISR and Abu Dhabi's ADHICS for healthcare.
  2. Prepare for accreditation questions from critical infrastructure clients, and for supply-chain transparency requests.
  3. Align incident reporting across the Central Bank, the Data Office, sector regulators and, for EU-linked operations, the GDPR and NIS2. One factual record, several reports.
  4. Evidence resilience, not just controls: recovery objectives, tested restoration and documented decisions.
  5. Revisit liability and insurance in light of the DIFC private right of action and the Central Bank's strict liability provisions.

Sources

UAEPDPLCentral BankNCAPDIFCregulation
This article is provided for general information and reflects public sources and the authors' professional opinion at the date of publication. Vulnerability details and recommendations change quickly; validate them against vendor advisories and your own environment before acting.
Keep reading

More insights.

All insights
Threat Landscape2 October 20264 min read

ClickFix inside ChatGPT: Malicious Custom GPTs used to deliver a remote access trojan

Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.

Read article
Threat Landscape2 October 20265 min read

TerminalFix: The ClickFix lure moves to Windows Terminal and ends in a covert tunnel

Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.

Read article
Vulnerability Alerts2 October 20265 min read

Zimbra CVE-2026-73570: What intruders did on compromised mail servers, and what to check on yours

An unauthenticated command injection in the SNMP notification path of Zimbra Collaboration was probed before public disclosure and exploited at scale afterwards. Microsoft's reconstruction shows web shells, a route to root through PAM, credential dumps and a cloud exfiltration attempt. The fix is 10.1.20. The work starts after the patch.

Read article