[Home](/)/[Resources](/resources)/UAE Cybercrime Law and IoT Hardware UAECybersecurity guide # UAE Cybercrime Law and IoT Hardware: Security Compliance for Connected Devices The UAE's cybercrime framework, Cybersecurity Council guidance, and TDRA type approval requirements create a layered compliance landscape for connected electronics manufacturers. Beyond the mandatory radio-frequency type approval, UAE government and enterprise customers increasingly expect IoT security baselines aligned to ETSI EN 303 645, and the UAE PDPL adds a data privacy layer for any device that collects user data. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuae-cybercrime-iot-hardware) At a glance Cybercrime law Federal Decree-Law 34 (2021) Radio approval TDRA type approval (mandatory) IoT security ETSI EN 303 645 (reference) Privacy UAE PDPL (2021) ## UAE cybersecurity and IoT hardware compliance ### UAE Federal Decree-Law No. 34 of 2021 on Cybercrime Federal Decree-Law No. 34 of 2021, which replaced the 2012 Cybercrime Law, is the UAE's primary cybercrime legislation. It criminalises unauthorised access to computer systems, interception of data, denial-of-service attacks, data fraud, and the use of technology to commit crimes including money laundering, terrorism, and intellectual property infringement. For IoT hardware manufacturers, the law's relevance is indirect but significant: devices with security vulnerabilities that are exploited for cybercrimes, or devices that facilitate prohibited data access, can expose manufacturers to regulatory scrutiny in the UAE even if they did not intend to enable criminal conduct. ### UAE cybersecurity strategy and IoT security baseline The UAE Cybersecurity Council (established under Cabinet Resolution No. 57 of 2020) and the Telecommunications and Digital Government Regulatory Authority (TDRA) have published guidance and frameworks for IoT security. The UAE Information Assurance Standards (IAS) and the UAE Cybersecurity Framework set cybersecurity baseline expectations. For connected hardware sold in the UAE, alignment with internationally recognised IoT security standards (ETSI EN 303 645, NIST SP 800-213) and the avoidance of known-bad security practices (default passwords, unnecessary open ports, absence of update mechanisms) is expected and increasingly scrutinised in procurement. ### TDRA type approval for radio-frequency devices Connected electronics that use radio frequency spectrum (WiFi, Bluetooth, Zigbee, LoRa, 4G/5G cellular modules) require type approval from the Telecommunications and Digital Government Regulatory Authority (TDRA) before they can be sold or imported into the UAE. TDRA type approval verifies that the device operates within the UAE's permitted frequency bands and power limits and meets applicable technical standards. Type approval is separate from ESMA product safety registration but is equally mandatory for connected devices — customs authorities check TDRA approval numbers at importation. ### Data localisation and privacy considerations for connected devices Connected hardware that collects and processes personal data from UAE users is subject to UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL). The PDPL imposes consent, transparency, purpose limitation, and data security requirements on data controllers processing personal data in the UAE or of UAE residents. For IoT hardware that collects usage data, location data, or biometric data, manufacturers need a UAE-aligned privacy compliance position: lawful basis for collection, data security measures aligned with UAE standards, and in some cases data localisation or cross-border transfer agreements for data sent to overseas cloud infrastructure. ## Compliance steps for IoT hardware in the UAE 01 Obtain TDRA type approval for any connected electronics products (WiFi, Bluetooth, cellular, or other radio-frequency capable devices) before importing or selling in the UAE — submit technical documentation and test reports from TDRA-accepted laboratories to the TDRA product registration portal. 02 Review your device's cybersecurity baseline against ETSI EN 303 645 (or equivalent NIST/UAE IAS standards): ensure no default passwords, verify all software components are patchable, test for common vulnerabilities, and document your security capabilities as part of your technical file. 03 Assess your IoT device's data collection practices against the UAE PDPL: if your device collects personal data from UAE users, prepare a privacy notice in accordance with UAE requirements, identify your lawful basis for processing, and assess whether cross-border data transfer restrictions apply to data sent to your cloud infrastructure. 04 Register your connected device with TDRA: confirm the TDRA registration number appears on product labelling (or in documentation for OEM modules) — customs officials verify TDRA numbers for controlled radio devices at the UAE border. 05 Establish a security update and vulnerability response process: the UAE cybersecurity framework expects that connected devices can receive security patches and that manufacturers have a process for identifying and remediating vulnerabilities — document your vulnerability disclosure policy and update delivery mechanism. 06 Review any pre-installed software or apps for UAE cybercrime law compliance: applications that could be used to access other systems without authorisation, intercept communications, or circumvent security controls are prohibited — ensure your device's software stack does not contain tools that could be characterised as dual-use cybercrime tools under Federal Decree-Law No. 34. 07 For devices sold into UAE government or critical infrastructure, additional cybersecurity certifications may be required under UAE government procurement policies — engage with the UAE Cybersecurity Council's sector-specific guidance for your target customer segments. ## Frequently asked questions ### Is the UAE TDRA type approval the same as ESMA product safety registration? No — TDRA type approval and ESMA registration are separate processes administered by different authorities. TDRA type approval covers the radio-frequency technical compliance of connected devices (frequency bands, power limits, spectrum management). ESMA registration covers product safety, electrical safety, and energy efficiency. A WiFi-enabled electronic appliance may need both: TDRA approval for the radio module, and ESMA registration for the overall appliance. Some products require only one — a non-radio consumer electronics product needs ESMA but not TDRA. ### What security standards does the UAE expect for IoT devices? The UAE Cybersecurity Council and TDRA reference international standards including ETSI EN 303 645 (Cyber Security for Consumer Internet of Things), ISO/IEC 27001, and NIST SP 800-213. The UAE Information Assurance Standards (IAS) published by TDRA set out baseline security requirements for information systems and can guide IoT product security design. While mandatory IoT security certification (like the EU's forthcoming Cyber Resilience Act marking) does not yet exist in the UAE, aligning to these standards provides a defensible security compliance position and is increasingly required by UAE government and enterprise customers. ### Does the UAE PDPL apply to data collected by connected hardware? Yes — the UAE PDPL (Federal Decree-Law No. 45 of 2021) applies to personal data processing that occurs in the UAE or relates to UAE residents. IoT devices that collect user location data, usage patterns, biometric data, or device identifiers associated with individuals are processing personal data and must comply with PDPL requirements including: obtaining consent or another lawful basis for processing, providing a privacy notice, implementing appropriate security measures, and in some cases obtaining approval for cross-border data transfers. The UAE Data Office (the PDPL authority) is progressively developing enforcement capacity. ### Are there specific cybersecurity requirements for UAE critical infrastructure suppliers? Yes — the UAE's Critical Information Infrastructure Protection (CIIP) framework, administered by the UAE Cybersecurity Council, imposes enhanced security requirements on operators of critical infrastructure sectors (energy, water, transport, telecom, financial services, health). Electronics hardware suppliers whose products are used in UAE critical infrastructure face procurement requirements that align with CIIP security standards — these typically include security assessment, penetration testing, and ongoing security management obligations. The standards are more demanding than general IoT security guidance and are sector-specific. **Disclaimer:** Educational resource only. UAE cybersecurity regulations and TDRA requirements are updated frequently. Consult a UAE regulatory consultant and qualified cybersecurity adviser for device-specific compliance assessment. 🇦🇪 UAE roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇦🇪 UAE compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/51-uae-moiat-ecas-conformity-consumer-electronics)[Prefer to read? Get the book — $24.99](/books/51-uae-moiat-ecas-conformity-consumer-electronics) Related guides * [UAE Mandatory Energy LabelUAE mandatory energy labelling under ESMA: type approval requirement for regulated appliance categories, GSO harmonised energy standards, A-to-G efficiency class labels, JCPRA registration for importers, and market surveillance by Emirates Authority for Standardisation.](/guides/uae-mandatory-energy-label) * [UAE Federal Competition LawUAE Federal Law 4/2012 (amended 2023) competition law for electronics: 40% market share dominance threshold, AED 300M merger notification trigger, Ministry of Economy enforcement, and what hardware platform companies operating in the UAE need to know.](/guides/uae-federal-competition-law) * [HK Critical Infrastructure CybersecurityHong Kong Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICO) 2024: 8 critical sectors, CI operator obligations, supply chain security under CIRMP, Commissioner of Police enforcement, and what electronics hardware suppliers into HK CI need to know.](/guides/hong-kong-critical-infrastructure-cybersecurity) * [Australia Critical Infrastructure SecurityAustralia SOCI Act 2018 for electronics hardware suppliers: 11 critical sectors, Positive Security Obligations (PSOs), Critical Infrastructure Risk Management Programme supply chain hazard category, Systems of National Significance, and 12-hour serious incident reporting.](/guides/australia-critical-infrastructure-security)