Best practices for conducting an internal whistleblower investigation in the UAE

Cultural attitudes towards whistleblowing continue to shift in the United Arab Emirates (UAE), as evidenced by the increasing prevalence of whistleblower protections in the country. Consequently, investigations arising from whistleblower complaints are becoming increasingly commonplace.

While the precise format of any investigation will depend on the circumstances and nature of the allegations, this article explores issues to consider and best practices when conducting an internal whistleblower investigation in the UAE.

Policies and procedures

When developing whistleblowing policies and procedures, organizations should specifically consider the legal protections offered to whistleblowers in the relevant jurisdiction or jurisdictions. For example, employees operating within the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) financial freezones in the UAE may benefit from enhanced protections regarding anonymity and protection from disciplinary action, whereas employees of a company located in onshore UAE are only afforded protection against disciplinary action in certain circumstances, for example if allegations are found to be true. Further, whistleblowers can face criminal charges for defamation under s.425-426 of the UAE Penal Code if they are found to have made the report in bad faith.

The fear of retaliation for expatriates in the UAE on sponsored visas is magnified because reporting an employer carries the risk of job insecurity and deportation. Fortunately, the ADGM plans to release new regulations granting greater protection to whistleblowers, reinforcing the non-binding principles which currently apply to entities operating in this free zone.

The proposed regulations, set to be released this year, provide whistleblowers with immunity from civil or contractual liability arising from a whistleblower report, as well as protection against dismissal or unfair treatment connected to the disclosure. Sanctions for non-compliance include a private or public warning, financial penalty, or suspension or withdrawal of the entity’s license to operate in the ADGM.[1]

The ADGM’s proposed regulations mirror the current whistleblowing regime applicable to all organizations in the DIFC.[2]  Notably, employees of entities providing financial services in or out of the DIFC are further insulated against detrimental treatment. The Dubai Financial Services Authority (DFSA) requires regulated entities to implement "appropriate and effective measures" to facilitate (i) whistleblower anonymity, (ii) written records of all allegations, (iii) an internal and escalation process, and (iv) employee awareness of the protections available to whistleblowers.

Additional developments in the financial sector include the Central Bank of the UAE’s launch of an online whistleblowing portal for employees to report misconduct, and monetary awards offered by the Federal Tax Authority to incentivise the reporting of non-compliance.

Conducting the Investigation

Any investigation should be proportionate to the risk posed by the allegations contained in the whistleblower report. Devising a work plan which sets out the scope of the investigation can inform the organization's next steps, while preventing the scope of the investigation from expanding unnecessarily and costs spiraling.

(i) Privilege

Instructing external lawyers to assist with the investigation should be considered at an early stage, not least because doing so increases the chances of being able to rely on privilege. While the concept of legal privilege is not recognised per se in onshore UAE, external legal advisors are bound by a duty of confidentiality thereby preventing them from disclosing communications between them and their client without the client's permission.[3]  In the DIFC and the ADGM, the concept of privilege is recognised as the right of a party to refuse to disclose or produce a document or refuse to answer a question on the ground of some special interest recognised by law. The DIFC specifically provides for the concept of privilege within its rules,[4]  whereas the ADGM adopted English law in a wholesale fashion on its establishment in 2013. It would therefore appear that common law privilege applies in the ADGM with a few noted exceptions.[5]  It is imperative to establish which jurisdictions and laws of privilege are relevant to the investigation to avoid inadvertent waiver of any legal privilege and confidentiality.

(ii) Fact finding

Preservation of potentially relevant documents is an important consideration when commencing an investigation. This may include issuing document preservation notices and/or imaging the devices of relevant custodians. While it may not ultimately prove necessary to review all data collected, taking these steps at the outset of the investigation minimizes the risk of unintentionally erasing documents later identified as key.

Before implementing these measures, jurisdiction and sector-specific advice should be sought on data protection issues. The introduction of the Protection of Personal Data Law in the UAE, which entered into force in 2022, means that care should be taken in relation to personal data, especially by those operating in the healthcare, telecommunication, or banking sectors, and in circumstances where there has been a cross-border transfer of data. The UAE is a country comprising seven emirates, with local, federal, and free zone laws applying depending on the facts. Given the speed of developments and the interplay between relevant onshore and offshore laws and regulations, organizations should be cautious about relying on past advice.

(iii) Interviews

Interviews can be an invaluable fact-gathering tool, and there are some key points to consider at the outset so that they can be as productive as possible.

In the UAE, organizations should be cognizant of language and cultural differences such as prayer times, religious holidays, and the observation of different working weeks across the region. Expatriates make up about 90 percent of the UAE’s population, and understanding the nuances around the cultural sensitivities of the interviewee is paramount. If handled sensitively, interviewees will likely be more cooperative and forthcoming and the investigation more efficient and effective.

To learn more about conducting internal whistleblower investigations in the UAE, please contact any of the authors or your usual DLA Piper relationship attorney.

^{[1]  ADGM Public Consultation (2024) Paper 2, Annex A, Whistleblower Protections Regulations.
[2]  DIFC Law No.7 of 2019, s.64(3).
[3]  UAE Law No,23 of 1991, Article 42; ADGM Rules of Conduct 2016, s.(6).
[4]  DIFC Court Order No.4 of 2019 Part C, s.12(B).
[5]  ADGM Courts, Civil Evidence, Judgments, Enforcement and Judicial Appointments Regulations 2015, s.69.}