Online Crisis Management in Dubai: The First 48 Hours and After

Online crises tend to take a few recognisable forms, and each has a different first move:

That window is a working one, not a legal deadline. UAE law sets no fixed statutory clock for platforms: orders to correct, remove or disable content come from the competent authorities, the Attorney General or a court, within the period stated in the order. What the first two days decide is the shape of the story, because posts, screenshots and copies multiply while a company is still deciding what to say.

A holding statement is short and factual. It says what the company knows, what it is doing and when the next update is due. It does not guess at causes, assign blame or describe anyone's private life. A later statement can add facts; a statement that has to be withdrawn becomes part of the crisis.

Article 43 of Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes punishes whoever uses an information network to insult another or to attribute to them a quality that would make them subject to punishment or contempt, with imprisonment and/or a fine of AED 250,000 to AED 500,000. It applies to a company's reply as much as to the post that provoked it. Answer what a critic said, with facts; do not characterise the critic.

Truth is not a general shield. Article 428 of the Penal Code, Federal Decree-Law No. 31 of 2021, allows proof of the facts only for job-related allegations about a public servant, within five years of the incident, and Article 431 punishes publishing private or family life secrets even if they are true. Article 44 of the Cybercrime Decree-Law punishes, among other acts, photographing or publishing images of the injured, the dead or accident victims without consent, with imprisonment of at least 6 months and/or a fine of AED 150,000 to AED 500,000. After any incident, tell staff in plain words not to photograph or share images of anyone hurt.

Article 52 punishes spreading false news or data, false or misleading rumours or reports, or reports contrary to official announcements, that would incite public opinion, disturb public peace or harm the public interest, the national economy, public order or public health, with imprisonment of at least one year and a fine of not less than AED 100,000. It is about harm to the public, not a private reputation claim, but it is a reason to keep every statement to verified facts and in step with what the authorities have announced.

Staff posts are the company's problem too. Under the Civil Transactions Law, Federal Decree-Law No. 25 of 2025, a principal is liable for the harm resulting from a harmful act its subordinate commits in the performance of their duty or because of it. A member of staff who answers a critic from the company's account, or posts about an incident while on duty, can bring that rule into play.

If the competent authorities order your own website or account to remove content, comply within the period stated in the order. Under Article 53 of the Cybercrime Decree-Law, failing to remove illegal content within the period specified in the orders, or refusing an order without acceptable excuse, carries a fine of AED 300,000 to AED 1,000,000. A grievance against an order must be made within 3 working days of learning of it (Article 63), and a pending grievance does not excuse non-compliance (Article 64).

As reported by Gulf Today, the Al Ain Court of First Instance ordered a man to pay a company AED 20,000, against AED 60,000 claimed, for a comment on a Google website accusing it of forgery and of deceiving customers, after he had first been convicted in a criminal case. As reported by Gulf News, the Al Ain Court for Civil, Commercial and Administrative Claims awarded AED 100,000, against AED 200,000 claimed, over a defamatory Snapchat video, and ordered an apology and a clear denial of the allegations on the same Snapchat account; a criminal court had earlier fined three defendants AED 10,000 each, confiscated the phone and ordered the video deleted. In both reports the award was below the amount claimed, and each followed a criminal conviction.

The civil basis is the Civil Transactions Law, Federal Decree-Law No. 25 of 2025, in force since 1 June 2026. Every act causing harm to another obliges its perpetrator to compensate (Article 246), an infringement on another's reputation or financial status is moral harm (Article 254(1)), and the court may order the performance of a specific matter related to the harmful act by way of compensation (Article 256(2)). A claim is inadmissible after three years from when the injured party learned of the damage and the person responsible, with a cap of fifteen years from the harmful act (Article 258). For a post made before 1 June 2026, ask your lawyer which civil law governs it. The guide to defamation compensation in the UAE sets out the reports and the articles.

Under Article 68 of the Cybercrime Decree-Law, the accused may invoke an amicable settlement with the victim before the judgment becomes final. For a company, a settlement can be the most useful outcome: the content comes down, a correction or apology goes up, and the terms, including which URLs are covered, are agreed in writing with your UAE lawyer. The guide to filing a defamation case in Dubai covers the complaint itself.

UAE media rules draw the line clearly. Article 20(2) of the Media Law, Federal Decree-Law No. 55 of 2023, requires every advertiser to include in all advertising materials something that explicitly and clearly indicates that it is advertising material. Article 33(6) of Cabinet Resolution No. 68 of 2024 requires advertisements to be clearly identified, distinct and separate from other editorial and media content. A paid article dressed as news sits on the wrong side of those rules, and when it is found it becomes a second story about the company.

If you want to buy space to state your position, buy it as labelled advertising. If you want coverage, give journalists facts, documents and access, and accept that they decide what to write. If staff or influencers are asked to post in the company's support, treat it as advertising: an advertiser who endorses a product or service must disclose any financial return from a commercial relationship (Article 33(7)), and the National Media Authority issues permits to individuals who provide advertising or media content on social media. Article 33(2) bars disparagement of competitors in advertisements, so a crisis is no time to compare yourself with a rival.

Fake reviews, bot accounts and anonymous accounts break the platforms' rules, and a fake account falsely attributed to a real person or company is an offence under Article 11 of the Cybercrime Decree-Law. Attacking a critic can engage Article 43. None of these methods is part of RepuLex's work, and a provider that offers them during a crisis is offering you a second crisis.

Platforms decide under their own rules, and their impersonation, privacy, harassment and manipulated-media reports are the quickest route for the clearest cases. Google decides requests under its legal-removal and personal-information policies; removal from Google Search does not remove the page from the web, and the site owner has to take it down. A publisher decides on corrections to its own article. The guide to removing a news article about you covers publishers and Google's forms.

Inside the UAE there is a further layer. Writs of correction and removal, and orders to disable access, come from the competent authorities, defined as the federal or local authorities concerned with electronic and cyber security, and the Attorney General may order blocking (Articles 1 and 66(2) of the Cybercrime Decree-Law). No private person or agency can issue one. Under the TDRA's Internet Access Management Regulatory Policy, a user's request to block content goes to the internet service provider, not to the TDRA. A block disables access in the UAE only; the content stays online elsewhere.

What breaks no rule stays, and is answered with facts, a correction where one is due and, where the company got something wrong, an apology. The guide to negative Google reviews and UAE law covers reviews from both sides.

Creating a fake website, account or email and falsely attributing it to any natural or legal person carries imprisonment and/or a fine of AED 50,000 to AED 200,000 under Article 11(1), and using it in a matter offensive to the person affected carries imprisonment of at least 2 years (Article 11(2)). A fake account in a company's name is covered, because the article reaches legal persons. The guide to fake accounts and impersonation sets out the reports.

Using an information system or IT equipment to modify or process any record, photo or scene with the intention of defaming or insulting another person carries imprisonment of at least one year and/or a fine of AED 250,000 to AED 500,000 (Article 44, final paragraph). This is the provision that reaches morphed or manipulated images.

Using an information network or IT equipment to extort or threaten someone, to force them to act or refrain from acting, carries imprisonment of not more than 2 years and/or a fine of AED 250,000 to AED 500,000 (Article 42(1)); a threat to commit a crime or dishonourable acts, with an explicit or implicit demand, carries temporary imprisonment of not more than 10 years (Article 42(2)). Do not pay, keep the evidence, stop replying and go to the police.

In Dubai, the Dubai Police e-crime service takes complaints through the Dubai Police app, its website and Smart Police Stations, free of charge, and its call centre is 901. In Abu Dhabi, the Aman service of Abu Dhabi Police is on 8002626. In an emergency, call 999. Anything involving a person under 18 goes to the police, and RepuLex does not take it on as a reputation matter. The guide to online blackmail in the UAE and the guide to reporting cyber crime in the UAE list every channel.

Keep a current list of the company's official accounts, pages and domains, and of who holds administrator access to each. That list is what lets you show, quickly, that a fake account is fake. Turn on two-factor authentication everywhere and remove former staff from administrator roles.

Write a short staff rule for incidents: do not post about it, do not photograph or share images of anyone hurt, do not answer critics from personal accounts, and pass every media enquiry to the named spokesperson. Explain why. Posts by staff acting in their duties can make the company liable, and some posts, such as images of the injured or someone's private details, can be offences in their own right.

Publish your verified facts before you need them: an accurate company profile on your own website, the names of your spokespeople, your official accounts and a press contact. In a crisis, journalists and AI assistants look for a source, and it helps if the right one already exists. The same thinking runs through AI reputation management in the UAE.

Monitoring is the early warning. Mentions of the company, its brands and its executives, flagged as they appear, give you time to act before a post spreads.

Removals of clear cases, such as impersonation or doctored media, are often the first results. Corrections from publishers follow at the publisher's pace. Across its removal work, RepuLex's record is a 7-day average to confirmed removal, but in a crisis each item has its own decision-maker, and none of them works to a clock that RepuLex sets.

Legal time runs separately. Take advice within three months of learning of the post and who made it: under Article 11 of the Criminal Procedures Law, Federal Decree-Law No. 38 of 2022, a complaint for insult and slander is not admitted after three months from when the victim becomes aware of the crime and its perpetrator. We have found no primary text settling whether that limit also governs the online offence in Article 43, so treat three months as the working deadline. A civil claim has its own three-year limit under Article 258 of the Civil Transactions Law.

The record keeps moving after the crisis ends. Copies resurface, search results and AI answers lag behind corrections, and a later news story can bring the episode back. Monitoring for some months afterwards is part of the work.

Your UAE lawyer's fees for a complaint, a settlement or a claim are separate. No fee to anyone buys a platform's decision, a publisher's correction or a court's order, and a provider that prices a crisis as a promised outcome is pricing something it does not control.

That covers the dated, hashed evidence record; platform complaints and policy reports to Google, Meta (Facebook and Instagram), X, YouTube, TikTok, Telegram, Reddit and review sites; Google's legal-removal and personal-information routes; correction requests to publishers; the removal audit once the acute phase has passed; and monitoring. It does not file complaints, sue or appear in the UAE.

For the wider service, see online reputation management in the UAE and reputation work for clients in Dubai. Where the crisis centres on one person, executive reputation management in Dubai covers the longer work on the name, and the guide to social media laws in the UAE sets out what may and may not be posted.