What this guide covers
WhatsApp is the default channel for personal and business communication across the UAE — which is exactly why a single message, screenshot or recording can create real legal exposure. The rules sit across three federal laws, and the most common mistakes are made by people who assume a private chat is a private space.
The three laws that govern WhatsApp use
There is no single "WhatsApp law". Its use is governed by the interaction of three federal instruments: the Cybercrimes Law (Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes), which criminalises online insults, defamation, invasion of privacy and false information; the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which governs how businesses may process personal data, including through messaging; and the Law of Evidence (Federal Decree-Law No. 35 of 2022), which determines when a WhatsApp message can be relied on in court. Telecommunications access — voice and video calling — is separately regulated by the TDRA.
The practical consequence is that the same message can raise a criminal, a data-protection and an evidential question at once. Treating WhatsApp as informal because it feels informal is the recurring error.
When a message becomes a crime
Under the Cybercrimes Law, conduct that is unremarkable offline can be an offence when done through an electronic channel. The categories that generate the most complaints are:
Insult and defamation
Insulting or defaming a person by electronic means is an offence — and it does not matter that the message was sent in a "private" WhatsApp group. Forwarding or re-sharing content authored by someone else can itself attract liability. A heated exchange in a family or work group is a frequent source of criminal complaints.
Invasion of privacy
Capturing, recording or publishing a person's private conversations, photographs or information without consent is treated as an invasion of privacy. Critically, truth is not a defence: sharing a genuine screenshot of someone's private chat, or a real photograph, without their consent can still be an offence. The wrong is the absence of consent, not the accuracy of the content.
False information, rumours and extortion
Circulating false news or rumours, and using messages to threaten or blackmail a person, are separately criminalised. Blackmail conducted over WhatsApp — including "sextortion" — is prosecuted seriously, and victims should preserve the messages and report rather than pay.
Penalties across these categories can combine imprisonment and substantial fines, and for non-citizens a conviction can carry immigration consequences.
Recording calls and sharing private chats
Two everyday habits carry disproportionate risk. First, recording a call or conversation without the consent of those taking part engages the privacy provisions of the Cybercrimes Law — the recording itself, not just its publication, can be the problem. Second, forwarding a private chat or image to a third party, or into another group, without the sender's consent can amount to unlawful disclosure. People routinely do both to "gather evidence" for a dispute and inadvertently commit an offence in the process.
Voice and video calls, VoIP and VPNs
Internet-based voice and video calling in the UAE is regulated by the Telecommunications and Digital Government Regulatory Authority (TDRA), and access has historically been limited to licensed applications rather than open across every app. That position has been easing, but the safe course is to rely on TDRA-licensed services and to confirm the current status before depending on a particular app for business calls.
Using a VPN to circumvent restrictions is a separate risk. A VPN is not unlawful in itself, but using one to commit or conceal an offence is expressly aggravated under UAE law. "I used a VPN to make the call" is not a defence and can worsen exposure.
WhatsApp as evidence in UAE courts
WhatsApp messages are frequently decisive in UAE disputes — in debt claims, employment matters, commercial breaches and family cases. The Law of Evidence (Federal Decree-Law No. 35 of 2022) recognises electronic records, and courts admit WhatsApp exchanges subject to their authenticity and integrity. Two points matter in practice: a message obtained or extracted unlawfully invites challenge, and a bare screenshot is weaker than a properly preserved record with metadata. Where a WhatsApp thread will support a claim, it should be preserved carefully and, where the value justifies it, authenticated — not simply screenshotted the night before a hearing.
Business messaging and the PDPL
For companies, WhatsApp is a data-processing tool. Sending marketing or transactional messages that use customers' phone numbers and personal data engages the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which generally requires a lawful basis — commonly consent for direct marketing — together with transparency about how the data is used. Unsolicited commercial messaging without consent, or continuing to message after a request to stop, creates regulatory and reputational exposure. Businesses should also keep personal and corporate communications separable, because a company WhatsApp account can become disclosable in a dispute.
Practical checklist
- Assume a WhatsApp message is not private — a "private" group offers no protection from an insult or defamation complaint
- Do not record a call or conversation without the consent of the participants
- Do not forward someone's private chat, photo or screenshot to others without consent, even if the content is true
- If you are being blackmailed over WhatsApp, preserve the messages and report — do not pay
- Use TDRA-licensed apps for voice and video calls; do not use a VPN to circumvent restrictions
- Preserve, rather than merely screenshot, any WhatsApp thread you may need as evidence
- For business messaging, obtain consent and comply with the PDPL before sending marketing on WhatsApp
What we'd typically advise
Most WhatsApp cases we see fall into two groups: a client who has been targeted — defamed, recorded, blackmailed or exposed — and a client who has inadvertently crossed a line while trying to defend themselves. For the first, the priority is to preserve the evidence properly, assess whether a criminal complaint or a civil claim is the better route, and act before the content spreads further. For the second, the priority is to contain exposure early, because a well-intentioned "I was only gathering proof" is not a defence to unlawful recording or disclosure. In both, the same discipline applies: preserve first, publish nothing, and take advice before you send the next message.
Frequently asked questions
Is it illegal to record a WhatsApp call without consent in the UAE?
Recording or capturing a private conversation without the consent of the participants can be an offence under the UAE Cybercrimes Law (Federal Decree-Law No. 34 of 2021), which protects privacy of communications. Truth is not a defence — the issue is the lack of consent to record or share, not whether the content is accurate.
Can a WhatsApp message be used as evidence in a UAE court?
Yes. Electronic records and messages are recognised as evidence under the Federal Law of Evidence (Federal Decree-Law No. 35 of 2022), and electronic evidence is used in criminal matters. Authenticity, integrity and lawful capture of the message affect the weight a court gives it.
Can I be prosecuted for insulting someone in a WhatsApp group?
Yes. Insulting or defaming a person by electronic means — including in a private group — can be an offence under the Cybercrimes Law. Forwarding or re-sharing defamatory content can also attract liability.
Are WhatsApp voice and video calls legal in the UAE?
Internet voice and video calling is regulated by the TDRA, and access has historically been limited to licensed applications. The position has been easing, but use TDRA-licensed services and avoid using a VPN to circumvent restrictions, which carries its own legal risk.
Can a business send marketing messages on WhatsApp in the UAE?
Business messaging that processes personal data must comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), which generally requires a lawful basis such as consent for direct marketing. Unsolicited commercial messages without consent create regulatory and reputational exposure.
Related guides
Published 15 July 2026 by Shuhail Ahamed. General information only — not legal advice. Contact us for matter-specific advice.