August 2026 ยท Criminal Law ยท 11 min read ยท Ahmad Abdulla Ahli Advocates & Legal Consultants
Using a Virtual Private Network โ or VPN โ in the UAE is the subject of considerable misunderstanding. You may have heard that VPNs are completely banned, or that anyone caught using one can automatically receive a fine of up to AED 2 million. Neither statement accurately describes the law.
Yes, VPN technology can be used lawfully in the UAE โ there is no general rule making every use of a VPN illegal. TDRA stated in its official guidance that there are no regulations preventing companies, institutions and banks from using VPN technology to access their internal networks through the internet, while also emphasising that users may be held accountable where the technology is misused. The correct question is not "Am I using a VPN?" but "What am I using the VPN to do?"
The principal provision is Article 10 of Federal Decree-Law No. 34 of 2021 concerning Countering Rumours and Cybercrimes, which deals with circumventing an information network with the intention of committing a crime. Under the provision, a person who circumvents the protocol address of an information network by using another person's address, or by another means, with the intent to commit a crime or prevent its detection, may face temporary imprisonment and a fine of between AED 500,000 and AED 2,000,000, or either of those penalties.
Article 10 does not simply say "anyone who uses a VPN shall be fined AED 2 million." The offence requires more than the mere presence of VPN software on a device โ it concerns network-address circumvention associated with the purpose of committing a crime or preventing its discovery. Article 72 of the Cybercrime Law also makes clear that its penalties do not prejudice the application of any more severe penalty available under another applicable law.
This requires particular caution. TDRA maintains Prohibited Content Categories as part of the UAE's internet-access framework, and UAE internet service providers are required to block content falling within applicable prohibited categories. One category is specifically titled "Bypassing blocked content" and includes internet content that enables or helps users gain access to prohibited content, including proxy servers and VPN services whose principal purpose is allowing access to prohibited internet content. TDRA's current guidance states that hosting VPN connections or services for UAE-based users that allow the bypassing of ISP filtering is strictly not allowed and may result in the service being blocked.
A VPN should not be regarded as a lawful workaround for UAE content restrictions. If content or a service has been blocked or prohibited under the applicable framework, using technical measures specifically to defeat that restriction can create significant legal and regulatory risk.
Yes. Legitimate corporate VPN use is the clearest example of permitted VPN technology identified by TDRA. Companies commonly rely on encrypted connections to allow employees to access internal networks, corporate systems and databases remotely, and TDRA expressly recognises the use of VPN technology by companies, institutions and banks for this purpose. An employee using an employer-provided VPN to connect securely to an authorised company network is fundamentally different from a person using technical tools to conceal criminal conduct.
TDRA's published guidance does not identify a general consumer "whitelist" of VPN brands. The regulatory focus is on the use and function of the technology rather than the provider's brand name โ the more important questions are what you are accessing, why you are concealing or changing your network location, whether you are circumventing a UAE restriction, and whether the underlying activity is lawful.
VPN technology is not subject to a blanket ban in the UAE, and the UAE permits legitimate uses, including secure access by companies, institutions and banks to internal networks. But the legality of a particular use depends on purpose and conduct. If network-address circumvention is used with the intention of committing a crime or preventing its detection, Article 10 provides for serious penalties. Separately, TDRA's internet-access framework addresses VPN and proxy services used principally to enable access to prohibited content. Using privacy technology is one thing; using technology to circumvent UAE restrictions or hide a crime is another โ that distinction is where the legal risk lies. Our firm advises on cybercrime, technology and regulatory matters under UAE law โ read more about our Criminal Law practice.