Employee Took Client Data After Resignation in UAE: What Can an Employer Do?

Written by: GetMyAccounting Editorial Team | Last updated: October 2026 | 12 min read

This case involves the taking of client data by a UAE employee and explains how employers can preserve evidence and estimate the financial effect of a resignation.

An employee resigns and gives back the laptop, and a few days later you discover that there was an export of a client database or forwarding of client emails to a personal account. Some clients have also started going elsewhere. Before jumping to conclusions, try to find out what happened first.

Quick Answer

Secure the company systems but hold onto the emails or devices that were used in taking the information. Establish the nature of the information taken, whether it is confidential, and which law applies. Find out how the information was used and determine any losses incurred. Seek advice from an experienced UAE employment lawyer.

This article focuses on UAE private-sector employment relationships governed by Federal Decree-Law No. 33 of 2021, as amended. See the UAE Government's employment-law guidance for the broader framework. DIFC and ADGM have independent employment frameworks, and certain categories of workers are subject to different rules. Check the applicable authority before relying on this information.

Client information needs to be examined in context. A published phone number is different from an exported CRM file containing buying behaviour, price negotiations, renewal dates and account details.

Four factors should be taken into account:

• Information: Find out what information included sensitive business information, instead of using the term “company information” for everything.
• Access control: Look into permissions, passwords, confidentiality levels and restrictions on downloads.
• Responsibilities: Review the employment contract, NDA and company policy.
• Aftermath: Differentiate between retention and misuse.

A client following a former employee does not always indicate misconduct. The company needs to find out whether it had confidential information or a restriction on that particular issue.

What Is Said about Confidentiality under Article 16?

Article 16(4) obliges employees to keep secret the information that has come into their possession because of their job and to return any possessions in their custody once the services cease.

Article 16(5) addresses personally retaining original papers or hard or soft copies of documents relating to work secrets without the employer's permission. The provision therefore requires attention to the documents' contents and any authorisation; not every file on a personal device can be treated identically.

These duties are set out in Federal Decree-Law No. 33 of 2021 and its amendments, published by MOHRE.

Under What Circumstances Does Article 44(5) Become Relevant?

Where employment continues and the disclosure of certain industrial or intellectual-property secrets leads to a loss for the employer, an opportunity lost or personal gain for the employee, Article 44(5) may become relevant.

Termination without notice must also have the relevant written report completed. This is not a dismissal procedure where the person is no longer employed.

The first 24 hours are a time for practical action, but not for making a filing that is required by law without first understanding the facts.

1. Secure access: Stop unnecessary access to email, CRM and cloud systems, terminate sessions and change passwords.
2. Preserve without destroying: Preserve mailboxes, devices and documents without destroying or formatting content.
3. Export logs: Export access, download and email-forwarding logs with the dates and accounts involved.
4. Identify data: Identify files, customers, dates of transfer and destinations.
5. Collect returned devices: Collect returned devices and obtain written confirmation.
6. Send a reminder: Send a written reminder about confidentiality and return requirements and seek advice about possible legal action.
7. Collect agreements: Collect the employment agreement, NDA, IT policy and non-compete clause.
8. Create a loss folder: Collect information about lost customer income, agreements, invoices and cancellations.
9. Obtain an opinion before escalation: Obtain advice before making accusations or contacting the new employer.
10. Keep a dated incident timeline: Record the events. Confidentiality and return steps relate to Article 16(4) and 16(5); any non-compete clause should be reviewed against Article 10 and Executive Regulation Article 12.

Preserve records connecting the data, relevant accounts and employee duties. Logs may need technical interpretation; account activity alone does not establish who acted or why.

Log the export early before it is overwritten. Retain original logs and note who logged them, when, and from which system. Access company records through authorisation and engage professionals if necessary.

A drop in revenue is a trigger to investigate, but not to calculate damages. The finance department needs documentation that helps explain why and how much revenue dropped.

What Records Does Finance Need to Gather?

Create a folder for each client whose business was lost after the employee left, including:

• Agreements signed, order forms and renewal agreements.
• Invoices, credit memos and payments.
• Revenue before and after the employee left.
• Other relevant costs and profit margin.

Businesses needing help organising these schedules can consider bookkeeping and accounting support, with calculations linked to supporting documents.

How Should Before-and-After Revenue Be Compared?

Compare similar periods, accounting for seasonality, contract expiry, pricing changes, service complaints and reduced demand. Record alternative explanations alongside evidence linking the change to the alleged conduct.

Why Is Lost Revenue Different from Recoverable Loss?

There is no consideration of transportation costs within the revenue. A loss of AED 20,000 in sales per month will not lead to equal compensation. Examine margins, contractual agreements and the relationship between the breach and loss.

A non-compete restriction must be more than a signature on a contract. Whether it applies depends on the employee's position, the restriction and the reasons why employment ended.

When dealing with a case where an employee used client information in the UAE, treat confidentiality separately from the restriction.

What Should Be Checked under Article 10?

Under Article 10, restrictions may be imposed if the employment involves working with clients or work secrets. The time limit, place and type of work must be specified to the extent necessary to protect the employer's legitimate interests. The duration cannot exceed two years after contract expiry.

The invalidity clause under Article 10 relates to termination of the contract in violation of the law by the employer.

What Is Added by Executive Regulation Article 12?

Under Article 12, the employer must prove the existence of damage if a dispute concerning a non-compete clause reaches the courts.

Article 12 also provides exceptions, including termination due to the employer's actions, an agreement to refrain from the restriction, termination during the probation period and certain professions.

For the compensation-based exception, consent of the previous employer and compensation must be provided by the employee or new employer. The compensation cannot exceed three months' salary under the last contract.

These conditions appear in Cabinet Resolution No. 1 of 2022 - Implementing Regulation.

Is the Issue Whether the Employee Joined a Competitor a Breach?

Working for a competitor and using confidential information are two different issues. A lawyer needs to consider the new job, the restriction, evidence and available remedies. Neither issue is automatically established merely because the employee joined a competitor.

The right course of action depends on the nature of the duties and alleged breach, as well as the jurisdiction.

Could the MOHRE Process Be Relevant?

For a case involving rights under the federal Labour Law, the MOHRE labour-dispute process could be relevant. Identify which licence issued the company and the nature of the claim; not every data incident follows the same route.

Could a Civil Suit Be Relevant?

A lawyer should consider potential legal courses of action, such as a breach-of-contract or other civil claim. The documentation will include the duties, alleged breach, financials and proof that the alleged breach caused the losses.

Could Other Laws Apply?

Criminal, cybercrime or data-protection laws may also be relevant. A qualified lawyer should assess the specific conduct and any reporting or protective steps.

Could Data-Protection Rules Also Apply?

If the copied client information includes personal data, separate data-protection obligations may need to be considered. Federal Decree-Law No. 45 of 2021 provides rules for protecting personal data and reporting certain personal-data breaches. Applicability depends on the business, type of data and relevant jurisdiction, so assess the incident before deciding whether notification or other regulatory action is required.

Official source: UAE Government - Data Protection Laws

Different claims can have different deadlines. Identify the legal basis and relevant dates early.

The two-year maximum non-compete period is separate from the one-year period for Article 10 claims. Time periods in procedural steps may be much shorter too. Do not confuse a general limitation period with a reason to delay securing evidence and taking advice.

The offboarding process should link HR, IT, management and finance functions.

• Document client transfer and outstanding commitments.
• Secure device retrieval and confirmation of returned company property.
• Check user permissions, sessions and passwords.
• Document the confidentiality reminder and any authorised retention.
• Secure necessary records in accordance with company record-retention procedures.
• Document good export permissions and role-based access before departures.

Document final salary, leave and end-of-service gratuity records along with offboarding records. Do not let data allegations result in an ad hoc settlement calculation. Get legal advice first.

Example Scenario: An Export of Clients' Data Before Resigning

A salesperson exports protected data about customers' history and prices before leaving the job. Two clients reduce the number of orders after that.

The company keeps CRM data and emails, examines permissions and the NDA, and analyses contracts, invoices and profit margins. One client planned to reduce orders anyway, while information about another shows that unpublished prices could be used in a rival proposal.

The company consults a lawyer with the gathered data.

Which Kind of Client Information Is More Likely to Be Considered Confidential?

Restricted client information that includes purchase history, agreed prices, renewal dates and account notes is more likely to raise confidentiality issues than publicly available contact information. Consider access restrictions, permissions, the employment contract, NDA and company policy.

Is It Possible for an Employer to Preserve Email and Device Evidence After an Employee Leaves?

The employer should preserve relevant email accounts, company-owned devices and log information using authorised access. Preserve the original export and document who preserved it, when and from which system. Seek professional forensic assistance if needed, and do not wipe or format devices until then.

What If the Client Information Contains Personal Information?

Other data-protection considerations may apply. The answer depends on the business, type of information and jurisdiction. Evaluate the incident before deciding whether notification is necessary.

Does a Non-Compete Stop a Former Employee from Joining Any Competitor?

A non-compete does not automatically prevent every move to a competitor. Its applicability depends on the employee's role, specified time, place and restricted work, and relevant exceptions. Joining a competitor and misusing confidential information are separate issues.

Can MOHRE Be Relevant to a Non-Compete Dispute?

MOHRE's labour-dispute process may be relevant where the dispute concerns rights under the federal Labour Law. Check the company's licensing authority, nature of the claim and applicable jurisdiction with a qualified UAE employment lawyer.

How Can Damage Be Proven in UAE Employee-Took-Client-Data Cases?

Create a separate file for each client containing contracts, invoices, revenue figures, expenditures, profits and cancellation communications. Include other factors responsible for decreased business and evidence connecting the decrease with the alleged misconduct.

The key takeaway from this employee-took-client-data UAE guide is to preserve evidence, organise financial records and obtain advice before escalation.

A useful response combines secure systems, reliable evidence and financial records that explain what changed. GetMyAccounting's Payroll & WPS services can support payroll calculations, settlement workings and organised supporting records within an agreed accounting scope. Disputes and legal remedies should be assessed by a qualified UAE employment lawyer.

Disclaimer: This article is general information on UAE employment compliance, not legal advice. For a specific dispute, consult a qualified UAE employment lawyer.