Trade secrets in the UAE: How companies can protect confidential business information

Short answer

• UAE law makes trade secrets legally enforceable. Protection extends across the UAE including free zones, backed by both civil compensation and criminal penalties.
• Protection depends on the steps you take. A trade secret qualifies only if its holder kept it under effective security, so the contract pack and access controls carry the legal weight.
• Departing employees and ex-partners are the main leak. Most enforcement files start with a person who had lawful access until last week and used it on the way out.
• Move fast and use the criminal route. A civil claim alone often arrives too late; precautionary attachment and a criminal complaint freeze the evidence before it disappears.

A finance director resigns from a UAE engineering company on a Sunday. By Tuesday the company watches its biggest tender go to a competitor that quoted within five per cent of its sealed bid, with almost the same project plan. The departed employee is the obvious source. The company has employment contracts, an NDA, a confidentiality clause. None of those documents, on their own, makes its pricing model and project plan legally enforceable as a trade secret. What does the company hold, and what can it do.

Trade secrets in the UAE are protected by a real and growing legal framework. The protection is automatic in some respects and earned in others, and the line between the two is where most cases turn. Commercial lawyers in the UAE see a recurring pattern in trade secret files: a company that thought a confidentiality clause was the protection discovers, when the claim is filed, that the law asks a different question. It asks what the company did to keep the information secret in the first place.

What counts as a trade secret in UAE law

UAE law uses the term undisclosed information for what most people call a trade secret, and the test for whether a piece of information qualifies has three parts. The information must be secret in the sense that it is not generally known or readily accessible to people working in the relevant industry. It must have commercial value because it is secret, so the secrecy itself is what makes it useful. And its lawful holder must have taken effective measures to keep it secret.

The first two parts of the test sit on the nature of the information. The third part sits on what the company did with it. This is the practical lesson behind every UAE trade secret case: information does not qualify as a trade secret because someone stamped confidential on a folder. It qualifies because the holder treated it as confidential in a way a court can see.

The categories of information that can qualify are wide. Formulas, manufacturing processes, technical designs, software architecture and source code, customer lists, pricing models, supplier terms, R and D records, financial projections, M and A pipelines and proprietary know-how have all been recognised as undisclosed information when held under the right conditions. The right conditions are the substance of the protection, not an add-on to it.

The legal framework that protects trade secrets in the UAE

The core statute is Federal Law No. 11 of 2021 on the Regulation and Protection of Industrial Property Rights. It treats unauthorised disclosure, use or possession of undisclosed information as an infringement of industrial property rights, and applies across the UAE including free zones. The law's enforcement provisions for patents extend by reference to undisclosed information, which means a misappropriation case can draw on the criminal penalties the patent regime carries, with fines of between AED 100,000 and AED 1,000,000 and possible imprisonment.

The industrial property law does not stand alone. The Penal Code, Federal Decree-Law No. 31 of 2021, criminalises the disclosure of secrets entrusted to a person by virtue of their work, position, profession or skill. Where the leak runs through digital means, an email account, a USB drive, a cloud service, a hacked laptop, the Cybercrime Law, Federal Decree-Law No. 34 of 2021, layers additional offences on top, in particular Article 45 on the disclosure of confidential work information through information technology systems. The Labour Law, Federal Decree-Law No. 33 of 2021, ties the employer's contractual confidentiality and non-compete rights to the broader scheme, and the Civil Code grounds general civil liability for breach of contract or tort independent of any of the special statutes. International firms tracking the regime, including Gowling WLG, have mapped how these instruments interact in practice.

DIFC-licensed entities have an additional regime to themselves. DIFC IP Law No. 4 of 2019 contains specific trade secret provisions and a forum, the DIFC Courts, in which to enforce them. ADGM has its own IP framework. For a UAE business deciding where to sue, the choice of forum matters as much as the choice of statute.

Building the measures that make a trade secret enforceable

The legal protection is real, but it is conditional. A UAE court asked to enforce a trade secret will look at what the holder did to keep the information secret. Companies that win these cases share a common feature: their measures could be itemised and demonstrated, not asserted in the abstract. Companies that lose share a different one: they relied on a single confidentiality clause buried in a template contract.

The measures fall into three layers. The first is contractual. Confidentiality clauses in employment contracts that survive termination, separate NDAs with consultants and contractors, supplier and distributor agreements with explicit confidentiality covenants, and joint venture and shareholder agreements with non-disclosure obligations across the deal's lifecycle. Non-compete and non-solicitation clauses sit alongside these, and our guide on non-compete clauses in the UAE in 2026 sets out where they are enforceable and where they fail. For software and SaaS businesses where the trade secret lives in the code, the contract architecture is covered in our guide on drafting software and SaaS contracts in the UAE.

The second layer is operational. Access controls that limit who in the company can see which information, document classification and marking, IT controls such as encryption and monitored access logs, restrictions on personal devices and external storage, structured exit procedures including return of devices and certificates of return, and clear visitor and contractor protocols. None of these is a trade-secret tool in name. Each is part of what the law calls effective measures, and a court hearing a claim will look for them.

The third layer is governance. Internal policies on the use of confidential information, regular training, a register of the company's trade secrets so the boundaries of what it claims to protect are clear, and a breach-response procedure that does not start being designed once a breach has occurred. The contract pack and the operational controls together create the evidence base. The governance layer is what makes the evidence credible.

Civil and criminal routes when a trade secret leaks

When a company concludes that its trade secret has been misappropriated, the response runs along two tracks at once. The first is civil. Under Federal Law No. 11 of 2021 and the general Civil Code, the holder can claim compensation for the loss caused by the misappropriation, ask the court for preventive measures to stop continuing use of the information, and apply for precautionary attachment of the materials and devices on which the secret sits. The civil track gives the company the money side of the answer, and where the perpetrator has assets in the UAE it can produce a meaningful recovery.

The second is criminal. A complaint to the Public Prosecution under the industrial property law or the Penal Code, with the cybercrime law as a third basis where the leak ran through information technology systems, gives the case a different weight. It puts a state prosecutor behind the file, opens investigative powers the holder does not have, and creates personal exposure for the individual who took the information. In a departing-employee case, the criminal complaint is often the step that produces a return of the materials, because the individual's incentive to settle changes when the file is no longer a civil dispute about money.

The two routes are most effective run in parallel. The civil claim secures the loss. The criminal complaint secures the leverage and the evidence. The mistake to avoid is treating one as a substitute for the other, or waiting until a civil judgment exists before opening the criminal file. By the time the civil case is final, the materials and the device trail can be gone.

The employment overlap, and what to do when the leak crosses borders

Most trade secret cases in the UAE have an employment file underneath them. The person who took the information was an employee until recently, has rights of their own under the Labour Law, and may be defending a wrongful termination claim or contesting a non-compete in parallel with the trade secret action. The legal points run in both directions. The employer's confidentiality and non-compete rights are stronger when the underlying employment was managed properly, with the right contract, the right notice and a documented exit. A trade secret claim brought against the backdrop of an unlawful dismissal is weaker, because the court is asked to enforce one set of obligations against a party with a credible counterclaim about another. Our guide on employment contract drafting in the UAE sets out the contractual side of getting that right.

When the leak crosses borders, the strategy splits. If the departing employee or the receiving company is based abroad, UAE courts still have jurisdiction over a UAE-resident defendant and over conduct that took place in the UAE. A precautionary attachment over the perpetrator's UAE assets, a travel ban application on the individual where the criminal track is open, and recognition of any UAE judgment or interim relief abroad through the routes that apply to other UAE judgments and arbitral awards, all become tools in the file. A trade secret already in a foreign company's hands is harder to recover than one still on a laptop in Dubai, which is why the speed of the response in the first days usually decides the outcome.

The limitation period is one further point to watch. A civil claim for damages on a trade secret breach is governed by the general civil limitation under UAE law, but the practical window to act is far shorter. Evidence disappears, witnesses move on, and the information itself spreads. The cases that are run well are the ones where the breach response was drafted before the breach.

How should UAE companies protect their trade secrets in 2026?

Trade secret protection in the UAE is a real legal regime, not a contractual courtesy. The federal industrial property law treats undisclosed information as an enforceable right and gives the holder civil and criminal routes to defend it, supported by the Penal Code, the Cybercrime Law and the Labour Law on the cases their reach catches. A company that builds the measures the law expects, contracts, controls and governance, has a trade secret a court can recognise. A company that relies on a confidentiality clause and assumes the rest follows discovers, when the leak happens, that it does not.

The most time-sensitive issue is speed at the start. Most trade-secret files turn on what the company does in the first week after the leak surfaces: the preservation of evidence, the precautionary attachment over devices and materials, the criminal complaint, and the immediate freeze on continuing use through interim relief. A company that has built the measures and rehearsed the response loses far less than one that designs both for the first time while a leak is running.

Protection is also a structural decision. The contract pack that protects information must align with the operational controls that demonstrate effective measures, and both must align with how the company handles the information day to day. For UAE businesses building that protection from scratch, defending a leak that has already happened, or preparing to enforce against a departing employee or ex-partner, our corporate and commercial team advises on trade secret strategy, contract architecture, and the civil and criminal routes when a leak occurs.

‍