A Comparative Analysis of Cybercrime Laws in Zambia and Dubai (United Arab Emirates)
In today’s digital age, cyberattack can cripple a nation’s economy, compromise national security or expose the personal information of millions of people within a matter of minutes. This reality demonstrates that cybercrime is no longer merely a technological concern but a significant legal, economic and security challenge affecting governments, business and individuals worldwide, the rapid growth of digital technology has revolutionized communication, commerce and the delivery of public services across the world.
INTRODUCTION
In today’s digital age, cyberattack can cripple a nation’s economy, compromise national security or expose the personal information of millions of people within a matter of minutes. This reality demonstrates that cybercrime is no longer merely a technological concern but a significant legal, economic and security challenge affecting governments, business and individuals worldwide, the rapid growth of digital technology has revolutionized communication, commerce and the delivery of public services across the world. While technology advancement and innovation has created immense opportunities for economic development and innovation, it has also increased the prevalence of cyber threats such as hacking, identity theft, online fraud, cyber extortion, data breaches and unauthorized access to computer systems. These offenses transcend national boundaries, making cybercrime a global legal challenge that requires robust legislative and institutional responses to regulate the use of information and communication technologies, protect digital infrastructure, safeguard personal data and promote cyber security.
Betsy Unchenda, Jason R C Nurse, Maria Bada and Steven Furnell noted in their Journal Article titled ‘Developing a Cyber Security Culture: Current Practices and Future Needs’, that a total of 36 studies attempted to assess cyber security culture, across the review, 17 studies used individual questionnaires or surveys to assess employees within organizations, primarily concentrating on their knowledge of policy. 1 Regarding policy, it is imperative to say laws play a major role in protecting the cyber space and preventing cybercrimes.
The report focuses on the cyber law frameworks of Zambia and Dubai (United Arab Emirates). In Zambia, the study examines the Cyber Security Act. No 3 of 2025 and the Cyber Crimes Act No. 4 of 2025 which collectively establish the legal framework for protecting critical information structure, preventing cyber threats, investigating cyber offenses and protection from criminals in the cyber space. In Dubai, the study analyses Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes and Federal Decree –Law No. 45 of 2021 on the Protection of Personal Data which provide comprehensive regulation of cyber offenses while strengthening personal data protection and digital security.
These statutes have been selected because they are the principle legal instruments governing cybersecurity, cybercrimes and data protection within their respective jurisdictions. They represent to emerging technological challenges and provide an appropriate basis for this comparative legal snapshot report, therefore, the purpose of this comparative study is to examine the similarities and differences between the legal frameworks of Zambia and Dubai, furthermore, to evaluate the effectiveness of their legislative approaches in combating cybercrimes and identify best practices that may contribute to future legal and policy reforms. Ultimately, the study seeks to enhance understanding of how different jurisdictions address cybercrimes while balancing cybersecurity, privacy and the rule of law in an increasingly digital world.
AN OVERVIEW OF THE PRIMARY LEGISLATION
The comparative study examines four principle statutes that govern cybersecurity, cybercrime and personal data protection in Zambia and Dubai (United Arab Emirates). These laws were selected because they constitute the primary legal frameworks through which each jurisdiction regulates cyberspace, combats cybercrime, protects critical digital infrastructure and safeguards personal information.
In Zambia, the Cyber Security Act No. 3 of 2025 2 establishes the national legal and institutional frame work for cybersecurity. The Act is administered by the Zambia Cyber Security Agency established under section 3 of the same Act which intends to strengthen national cyber resilience, protect critical information infrastructure, coordinate responses to cyber incidents and promote cybersecurity across both the public and private sectors. Its provisions apply to government institutions, critical infrastructure, operators and other entities whose activities whose activities may affect the national cybersecurity.
The Cybercrimes Act No. 4 of 2025 was also enacted in 2025 3 , in that Article 18(8) of the Constitution of Zambia 4 states that; “No person shall be convicted of a criminal offence unless that offence is defined and the penalty is prescribed in a written law”, therefore, the Act complements the Cyber Security Act by criminalizing offenses law enforcement agencies, regulate the collection and preservation of electronic evidence and prescribes penalties for offenses such as unauthorized access.Cyber fraud, identity theft, cyber extortion and other related offenses. In Dubai (United Arab Emirates), Federal Decree-Law No. 34 of 2021 on combatting Rumours and Cybercrimes which took effect on 2nd January 2022 provides the principal legal framework for preventing, prosecuting cybercrime and abuse of online technologies.5
The law is enforced by the UAE’s competent law enforcement authorities and the judiciary and applies to offenses involving the misuse of information technology and electric networks. It seeks to protect national security, public order and individuals from cyber related offenses. Complementing this framework is Federal Decree-Law No. 45 of 2021 6 on the Protection of Personal Data which regulates the processing of personal data by both public and private entities, the law establishes principles of lawful data processing, safeguards individual’s privacy rights, impose obligations on data controllers and processors and regulates cross border data transfers. Together, these statutes from the foundation of cyber governance in Zambia and Dubai and provide an appropriate basis for comparative legal analysis.
COMPARATIVE ANALYSIS
Similarities
Despite originating from different legal systems, Zambia and Dubai (United Arab Emirates) have adopted comparable approaches to regulate cybercrime and cybersecurity. Both jurisdictions recognize that cybercrime poses significant risks to national security, economic development and individual rights and have enacted comprehensive legislation to address these challenges.
1. Objectives
The Zambian Cyber Security Act No. 3 of 2025 and Cyber Crimes Act No. 4 of 2025 together with the UAE’s Federal Degree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes and Federal Degree-Law No. 45 of 201 on the Protection of Personal Data pursue similar objectives. These include: preventing and combatting cybercrime, protecting critical information infrastructure, promoting cyber security, safeguarding personal information, facilitating secure electronic transactions and strengthening public confidence digital technologies.
2. Enforcement Models
Both jurisdiction adopt a law-enforcement centered model. They empower competent authorities to investigate cyber offences, obtain electronic evidence, conduct digital investigations, prosecute offenders and cooperate with other national institutions. Each framework also recognizes the importance of cyber incident response and coordination among government agencies.
3. Common Regulatory Bodies
Although the institutional structures differ, both countries establish specialized authorities responsible for responsible for cybersecurity and digital governance. In Zambia, cybersecurity functions are performed by the Cyber Security Agency together with law enforcement and prosecutorial authorities. In Dubai, responsibility is shared among law enforcement agencies, Public Prosecution, the judiciary and competent data protection laws.
4. Shared Intentional Standards
Both legal frameworks reflect internationally recognized principles of cybersecurity and governance. They promote the confidentiality, integrity and availability of information systems, recognize the importance of protecting personal data and privacy, encourage international cooperation in combatting transnational cybercrime and support secure digital commerce. Although their legislative approaches differ, both jurisdiction demonstrate alignment with evolving international standards on cybersecurity and digital regulation.
Differences
While Zambia and Dubai pursue similar policy goal, their legislative frameworks differ significantly in terms of legal scope, definitions, penalties, compliance, rights and institution design.
1. Scope of the Law
Zambia separates cybersecurity and cybercrime into two principle statutes namely; the Cyber Security Act No. 3 of 2025 which focuses on national cybersecurity and critical information infrastructure, while the Cyber Crimes Act No. 4 of 20225 addresses criminal offenses committed through digital technologies or the cyber space as guided under by the preambles of both Acts. By contrast, Dubai adopts a broader regulatory framework in which Federal Decree-Law No. 34 of 2021 comprehensively regulates cybercrime and online misuse while the Federal Decree-Law No. 45 of 2021 specifically governs the processing band protection of personal data.
2. Definitions
The UAE legislation contains detailed definitions relating to electronic data, personal data, digital processing, information systems and data controllers reflecting its emphasis on privacy and digital governance, the Federal Decree-Law No. 34 of 2021comprehensively defines what ‘Child Pornography’ is by including; “producing, displaying, disseminating, possessing or circulating……..” while Section 2 of the Cyber Crimes Act No. 4 of 2025 only defines is as “a material whether real or simulated, that depicts a presentation or a representation Of (a) a child engaged in explicit sexual conduct; (b) an image of a child engaged in sexually explicit conduct; or (c) the sexual parts of a child for sexual purposes”. Therefore, Zambia’s legislation places greater emphasis on cybersecurity, cyber offenses, critical information structure and national security concerns. Jonathan Clough in his Book titled ‘Principles of Cybercrime (2 nd Ed, Cambridge University Press 2015) also discussed that the ability to produce child pornography is greatly enhanced by the fact that digital images may be produced may be produced cheaply without the need for external processing and reproduced with no diminution”. 7
3. Penalties
Both jurisdiction prescribe criminal sanctions; however, Dubai generally imposes stricter penalties for offenses affecting national security, public order and the dissemination of unlawful online content. The UAE legal framework frequently combines substantial fines with imprisonment, on the other hand, Zambia also provides criminal penalties including fines and imprisonment, but its sentencing framework differs according to the nature and seriousness of the offence. Article 4 of the Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes criminalizes causing harm to information systems with a punishment of at least one year and /or a fine of not less than (AED 500, 000) five hundred thousand dirhams or more than (AED 3,000,000) three million dirhams 8 while Section 9 of the Cyber Crimes Act criminalizes Illegal System Interference saying that; “A person commits an offence if that person intentionally and without lawful authority (a) hinders or interferes with a computer or computer system of another person; or (b) renders a computer or computer system incapable of providing normal services to its legitimate users.” 9 It therefore, renders a punishment of fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years, or to both. That’s one of the differences among others in penalties.
4. Compliance Requirements
Dubai’s Personal Data Protection Law imposes extensive compliance obligations on organizations including lawful processing of personal data, transparency, accountability, security safeguards and restrictions on cross border data transfers. Zambia’s Cyber Security Act primarily emphasizes cybersecurity measures, protection of critical information infrastructure, reporting obligations and cooperation with competent authorities while the Cyber Crimes Act focuses principally on criminally liability and investigation rather than comprehensive data governance.
5. Rights Provided
The UAE legal framework expressly recognizes several rights relating to personal data, including rights concerning access, correction and protection of personal information. Zambia’s legislation primary focuses on protecting users from cybercrime and enhancing cybersecurity with individual rights largely safeguarded through constitutional protections and other applicable legislation rather than through an extensive statutory data protection regime within the selected Acts.
6. Regulatory Structure
Zambia adopts a framework centered on specialized cybersecurity institutions such as the Zambia Cyber Security Agency and ZICTA working alongside law enforcement agencies and the courts. Dubai employs a more integrated regulatory structure involving law enforcement agencies, the Public Prosecution, the Judiciary and specialized authorities responsible for supervising data protection and digital compliance. This reflects on the UAE’s broader emphasis on cybersecurity, digital governance and privacy regulation within a rapidly expanding digital economy. This comparative analysis demonstrates that while Zambia and Dubai share the common objective of combatting cybercrime and strengthening cybersecurity, Dubai’s legal framework places comparatively greater emphasis on personal data protection, regulatory compliance and digital governance whereas Zambia’s frame work is more focused on cybersecurity, national security and criminalizing of cyber offenses. This distinction provides a strong basis for evaluating the effectiveness of each jurisdiction’s legislative approach and identifying areas for legal reform.
Strengths and Challenges of the Primary Legislation
A. Strengths of the Zambian Legal Framework
The Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025 represent a significant milestone in Zambia's efforts to strengthen cybersecurity and combat cybercrime. One of their principal strengths is the establishment of a comprehensive legal framework that addresses both cybersecurity and cybercrime through separate but complementary statutes. This approach enables the law to distinguish between preventive cybersecurity measures and the investigation and prosecution of cyber offences. 10 Secondly, the legislation provides legal recognition of a wide range of cyber offences, including unauthorized access to computer systems, cyber fraud, identity theft, cyber extortion and offences against critical information infrastructure. This enhances the capacity of law enforcement agencies to investigate and prosecute emerging forms of cybercrime. Another notable strength is the emphasis on protecting critical information infrastructure and improving national cybersecurity preparedness. The legislation also promotes inter-agency cooperation and provides legal procedures for the collection and preservation of electronic evidence, thereby strengthening criminal investigations involving digital technologies.
B. Challenges and Limitations of the Zambian Legal Framework
Despite these strengths, several challenges remain. Some provisions have attracted criticism for using broad or ambiguous language, particularly where national security and cyber surveillance powers are concerned, potentially creating uncertainty regarding their interpretation and application. M A Bouke Et al in their Journal Article titled; ‘African Union on Cyber Security and Personal Data Protection: Challenges and Future Directions’ they stated that one of challenges to implement the African Union Personal Data Protection (AUDPC) is due to lack of resources that affect Capacity-Building and Awareness, they went further to use charts and that challenges have a magnitude of 4 out 5 indicating that there are significant issues that need to be addressed and this is what affects many countries hindering their ability to carry out their responsibility effectively. 11 Similarly, with the laws or Acts at hand, if the Zambian legal frame work lacks resources there by affecting capacity building and awareness it would affect interpretation implementation of the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025. Implementation also remains a significant challenge, effective enforcement requires highly trained investigators, digital forensic experts, modern technological infrastructure and adequate financial resources, which may not always be readily available. The legislation further faces practical enforcement challenges arising from the transnational nature of cybercrime. Since many cyber offences originate outside Zambia, effective investigation often depends on international cooperation, which can be complex and time- consuming.
C. Strengths of the Dubai (United Arab Emirates) Legal Framework
Dubai's legal framework particularly Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes and Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, is recognised for its comprehensive regulation of both cybercrime and personal data protection. 12 A major strength is the detailed regulation of data privacy, which imposes clear obligations on organizations regarding the lawful collection, processing, storage and transfer of personal data. This strengthens public confidence in digital services and supports electronic commerce. The legislation also prescribes stringent penalties for serious cyber offences, creating a strong deterrent against cybercriminal activity. Furthermore, Dubai benefits from advanced digital infrastructure, specialized enforcement agencies and a high level of institutional coordination, enabling more effective implementation of cyber laws.
D. Challenges and Limitations of the Dubai (United Arab Emirates) Legal Framework
Despite its comprehensive framework, certain provisions of the UAE cybercrime legislation have been criticized for employing broad language relating to online expression, rumours and digital content, which may raise concerns regarding legal certainty and freedom of expression. The strict compliance obligations imposed under the Personal Data Protection Law may also create financial and administrative burdens for businesses, particularly small and medium-sized enterprises that may lack the technical capacity to implement complex data protection measures. Although enforcement mechanisms are generally robust, the rapid evolution of technology means that cyber legislation must be continuously reviewed to address emerging threats such as artificial intelligence-enabled cybercrime, sophisticated ransomware attacks, cryptocurrency- related offences and other evolving forms of digital criminality. In the light of the foregoing, both Zambia and Dubai have established modern legal frameworks aimed at combating cybercrime and strengthening cybersecurity. Zambia's legislation is commendable for creating a dedicated legal framework addressing national cybersecurity and cyber offences in-line with goals of African Union (AU) to incorporate emerging technologies in development plans and ensuring these technologies are used to benefit of African individuals institution and nation states by ensuring data protection and safety online 13 , while Dubai's framework is distinguished by its comprehensive regulation of cybercrime, digital governance and personal data protection. Nevertheless, both jurisdictions continue to face challenges associated with technological advancement, evolving cyber threats, effective implementation and the need for continuous legislative reform to keep pace with developments in cyberspace.
INTERNATIONAL PERSPECTIVE
The comparative analysis demonstrates that the legal framework of Dubai (United Arab Emirates) is more comprehensive than that of Zambia in several respects. While Zambia has made significant progress through the enactment of the Cyber Security Act No. 3 of 2025 and the Cyber Crimes Act No. 4 of 2025, the UAE adopts a broader regulatory approach by integrating cybercrime prevention with a dedicated personal data protection regime under Federal Decree- Law No. 45 of 2021. This dual framework addresses not only cyber offences but also privacy, data governance, organizational compliance and cross-border data transfers. Zambia could adopt several best practices from the UAE framework. These include strengthening personal data protection rights, introducing clearer compliance obligations for organizations that process personal data, enhancing institutional capacity for cyber incident response, promoting stronger public-private partnerships in cybersecurity and establishing more detailed regulatory guidance on emerging technologies such as artificial intelligence and cloud computing.
Both jurisdictions have been influenced by international legal developments. Although neither country is a Party to the Budapest Convention on Cybercrime, both legal frameworks reflect internationally recognised principles relating to cybercrime prevention, digital evidence, cybersecurity and international cooperation. Their legislation is also consistent with standards promoted by the United Nations Convention against Transnational Organized Crime (UNTOC), various United Nations General Assembly resolutions on cybersecurity and guidance developed by the International Telecommunication Union (ITU) on national cybersecurity strategies and cyber resilience. Overall, the legal frameworks of both Zambia and Dubai reflect contemporary global legal trends by recognizing cybercrime as a transnational threat requiring specialized legislation, institutional coordination, international cooperation, protection of critical information infrastructure, and increased protection of personal data within an expanding digital economy.
1. Betsy Unchenda, Jason R C Nurse, Maria Bada and Steven Furnell, ‘Developing a Cyber Security Culture: Current Practices and Future Needs (2021) pg 15
2. https://www.parliament.gov.zm/node/12319
3. https://www.parliament.gov.zm/node/12320
4. Amendment No. 2 of 2016, Chapter 1 of the Laws of Zambia
5. https://u.ae/en/information-and-services/justice=safety-and-thelaw/cyber-safety-and-digital-seurity
6. https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
7. Jonathan Clough,Principles of Cybercrime (2nd Ed,Cambridge University Press 2015) pg 249
8. Article 4 of the Federal Decree-Law No. 34 of 2021
9. Section 9 of the Cyber Crimes Act No. 4 of 2025
10. https://www.zicta.zm/resourses/legislation
11. M A Bouke Et al on ‘frican Union on Cyber Security and Personal Data Protection: Challenges and Future Directions’ (2023) pg 10