Cybrilliant Talk to an Expert

Law and audit firm cybersecurity in the UAE: In a professional firm, one stolen login can reach many clients at once.

Attackers use the common routes: a phishing message, a stolen password, a supplier. In a firm that holds confidential matters for many clients, those routes end at privileged files, a legal duty of secrecy and clients who want to know quickly whether their file was touched.

Talk to an ExpertTest one stolen login ↓

One stolen login. How many client matters does it open?

Your clients’ files sit side by side. Switch the walls and see how far one account reaches. This is an illustration, not a measurement.

Matter wallsOff: shared foldersOn: each matter is separate
  • Client AThe stolen login works here
  • Client BReached
  • Client CReached
  • Client DReached
  • Client EReached
  • Client FReached

Every matter is open. The attacker reads six clients’ files from one account.One matter is open. The other five stay closed.

After a personal data breach, by regime

  • 72 hoursADGM: notify the Office of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware (Article 32).
  • As soon as practicableDIFC: the controller notifies the Commissioner as soon as practicable in the circumstances. A processor tells the controller without undue delay (Article 41).
  • On awarenessOnshore: the controller acts at the time it becomes aware of a breach, and a processor tells the controller as soon as it knows (PDPL, Article 9).

What an attacker wants from a firm

  1. A call or a click

    Phishing, a fake payment request, a stolen password.

    13%of breaches began with credential abuse (Verizon DBIR 2026, all industries)
  2. A trusted identity

    Partners, assistants with shared mailboxes, finance approvers, contractors and client guests. Their access spans many matters, and exceptions to policy are common.

  3. A shared workspace

    Matter workspaces, client portals, and suppliers such as e-discovery and translation that hold copies of client files.

  4. Client files

    What leaks is not only the firm’s data. It is whose data, from which matter, and whether a duty of secrecy now applies.

What changes for a professional firm

The same security decision gets a different answer once client confidence and a duty of secrecy are in the picture.

Partners and their assistants, shared mailboxes, finance approvers, and the contractors and client guests who reach many matters.

Standard advice: Domain and cloud administrators.

What a firm asks us first

Map client files by matter, workspace and supplier, so a breach question can be answered quickly.

48%

Of breaches involved a third party (Verizon DBIR 2026, all industries)

Which law applies depends on where the firm sits

Onshore firms follow the federal PDPL. Firms inside DIFC and ADGM follow those zones’ own laws. Duties of professional secrecy for lawyers and auditors sit on top.

Secrecy is a legal duty

Accountants and auditors may not disclose client secrets (Federal Decree-Law 41 of 2023, Article 18), and firms must keep controls that protect client data (Article 16). Lawyers owe a confidentiality duty with no time limit (Cabinet Resolution 9 of 2025, Article 8).

The zone sets the regime

The PDPL does not apply to companies in free zones that have their own data protection law (Article 2(2)(g)). DIFC firms follow DIFC Law No. 5 of 2020. ADGM firms follow the Data Protection Regulations 2021.

Suppliers hold client data too

Under the PDPL a controller must choose a processor that gives sufficient guarantees (Article 7), and the processor must report a breach to the controller as soon as it knows (Article 9). DIFC Law Article 41 sets a similar processor duty.

Rules and frameworks behind this page

UAE PDPL, Federal Decree-Law 45 of 2021

The onshore data protection law. It sets controller and processor duties and breach reporting (Articles 7 to 9), and excludes free-zone companies with their own law.

Read the source

Source: UAE Legislation, Federal Decree-Law 45 of 2021, Federal Decree-Law 41 of 2023 and Cabinet Resolution 9 of 2025; DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021. This is analysis, not legal advice.

UAE rules, by who you are

Which UAE rule reaches a law, audit, advisory or professional services firm

Professional firms are bound by confidentiality duties, the data law of their entity, and what clients put in contracts. Being in Dubai does not bring a firm under DESC.

  • Binding law
  • Regulator rule
  • Standard or policy
  • Contract term

Law firms, audit and accounting practices

Federal

Binding lawProfessional licensing, confidentiality and record-keeping rules. PDPL where it applies. The ADGM regime for ADGM entities.

Protect privileged and client files, financial records, identity systems and document sharing. Work out whether you are mainland, ADGM or under another regime. No universal yearly penetration test was found for all firms.

Confirm: Confidentiality duties call for secure handling. They do not by themselves set a test cycle.

Corporate service providers and outsourced professional firms

Federal

Contract termLicence-specific rules, AML and client-data requirements, contracts, and the PDPL where it applies.

Duties can include restricted access, secure retention, incident notice and audit evidence under law or client contract. Confirm your licence and the data you hold.

Dubai mainland law, accounting and consulting firms

Dubai

Regulator ruleProfessional licensing rules, the PDPL where it applies, and contracts.

No general DESC ISR mandate applies only because a private firm sits in Dubai. Protect client records, confidential data, billing systems and remote access under law and contract.

Suppliers to Dubai Government Entities and regulated clients

Dubai

Contract termContract security terms, DESC ISR flow-down where the contract or scope requires it, and the client’s outsourcing rules.

Serving a government client does not make you a Dubai Government Entity. Contracts can still impose controls, audit rights, incident duties, security due diligence and continuity evidence.

This is analysis, not legal advice. Data-protection law is not one regime in the UAE: the federal PDPL, ADGM and DIFC each have their own. A security duty does not by itself create a yearly penetration test. Confirm which regime and standard apply to each entity and data set with your counsel.

Where we would start with a firm

Protect What MattersTighten access for partners, assistants, finance approvers, contractors and client guests, and put an expiry on every guest.Identity & Access Security, Data Security, Cloud SecurityManage Cyber Risk & ExposureBuild the client-by-client map of where files sit, suppliers included, so the first breach question has an answer.Crown Jewel Identification, Cyber Risk Assessments, Identity Security Posture Management (ISPM)Secure & ComplySet one control baseline mapped to client requirements and ISO/IEC 27001, with evidence collected once.Control Design & Implementation, Audit Readiness, Third-Party & Supply-Chain Risk

If you also operate in the US, the UK, India or Australia

UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.

Standards that follow your data, not your sector

Card, privacy, resilience and assurance standards reach a firm through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.

  • Voluntary certification
  • Buyer requirement
  • Law
  • Card brand rule
  • Voluntary certification

    ISO/IEC 27001

    Information security management systems

    Clients often ask advisers to show it.

    The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.

    Source: ISO, ISO/IEC 27001
  • Buyer requirement

    SOC 2

    AICPA System and Organization Controls 2

    Asked when you host or process client data.

    An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.

    Source: AICPA, SOC suite of services
  • Law

    GDPR

    EU General Data Protection Regulation

    You advise people in the EU, or have an EU establishment.

    A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).

    Source: EUR-Lex, Regulation (EU) 2016/679
  • Card brand rule

    PCI DSS

    Payment Card Industry Data Security Standard

    Client card data, or card payments for your own fees.

    Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.

    Source: PCI Security Standards Council
  • Law

    NIS2

    EU Network and Information Security Directive 2

    Managed service and managed security service providers in the EU.

    Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.

    Source: European Commission, NIS2 Directive
  • Law

    DORA

    EU Digital Operational Resilience Act

    You provide ICT services to EU financial entities.

    Applies from 17 January 2025. Major ICT incidents go to the authority in stages: initial, intermediate and final report.

    Source: EUR-Lex, Regulation (EU) 2022/2554
  • Law

    HIPAA

    US Health Insurance Portability and Accountability Act, Security Rule

    You handle health data for a US covered entity as a business associate.

    A rewrite was proposed on 6 January 2025. As of June 2026 it is not final, and the current Security Rule stays in force.

    Source: US HHS, HIPAA Security Rule

What to read before you talk to us

Industry BriefIndustry Brief: Professional Services Cyber Risk PrioritiesWhere firm risk concentrates: identity, client-data custody, payment fraud and suppliers.
ArticleUAE Cybersecurity Regulatory Landscape: A Practical Executive ViewWhich UAE regimes apply, including the free-zone ones, and how they layer.
Threat IntelligenceBusiness Email Compromise: Beyond PhishingWhy a convincing instruction from a known person is the core of payment fraud.
ArticleThird-Party Risk Beyond the QuestionnaireWhat to ask suppliers beyond the questionnaire.
Practitioner Field NotePlaybook: Assessing a Critical SupplierA method for judging a supplier that holds copies of client files.
Practitioner Field NotePlaybook: Building an Audit Evidence PackHow to build an evidence pack once and reuse it for every client audit.

Sources and method. This page is analysis, not legal advice.