The Ethics Standard and Its Silences: WhatsApp for Dubai Law Firms Under Federal Decree-Law 34/2022

The two lines Dubai draws differently

A Dubai law firm's WhatsApp Business number sits on the same device the managing partner uses to schedule the school run. That much is the same as London or Manchester. The regulator's answer to what may cross that channel is not the same. Federal Decree-Law 34/2022 concerning Regulating the Advocacy and Legal Consultancy Professions is the current federal statute on the conduct of the profession, and it puts the profession's rules on a different footing than the English framework a UK-trained reader would expect.

Two features of that footing decide almost every WhatsApp question a firm might ask, and both differ structurally from the equivalent English framework.

The first is that Article 45(1)(h) prohibits a lawyer from "Promoting, or attempting to promote, himself / herself in any manner that goes against the ethics of the profession, by any means of promotion or enticement by intermediaries." That is an evaluative standard — the lawyer applies "the ethics of the profession" to the specific conduct — rather than a rule with a defined perimeter. There is no carve-out for existing or former clients equivalent to SRA para 8.9. The Dubai Legal Affairs Department Circular No. 1 of 2024 (issued 8 March 2024), which addresses solicitation by representatives and intermediaries of legal firms, does not name specific channels, does not create an exception for existing clients, and does not address referral fees. The Circular's silences are load-bearing: they mean the standard applies uniformly regardless of the technical route or the recipient's prior relationship with the firm.

The second is that Article 45(1)(a) extends the lawyer's duty of confidentiality explicitly to "means of modern technology or any other means of communication." The SRA Code paragraph 6.3, which sets the equivalent confidentiality duty in the English framework, states the duty in generic terms — "You keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents" — without naming a channel. Article 45(1)(a) does name channels. That extension has a second-order consequence: it stacks with Federal Decree-Law 20/2018 Article 15, which exempts lawyers from the duty to report suspicious transactions "if the information related to these operations have been obtained subject to professional confidentiality." Confidentiality obligations reach every channel including WhatsApp, and where they attach, they interact directly with the AML reporting duty.

Together these two features change the operational question. In UK a firm asks whether a proposed message falls inside or outside the permitted set; in Dubai a firm asks whether the message and its channel are consistent with the profession's ethics and confidentiality obligations, and whether any regulator would view the arrangement — including the use of intermediaries or third parties — as inconsistent with those standards.

What Article 45(1)(h) actually says (and doesn't)

Article 45(1) is one clause with eight numbered items. Item (h) is the promotional-restriction prohibition; the seven items before it set the surrounding conduct duties. The full list is:

(a) "Disclosing any secret entrusted to him / her, whether orally, in writing or via e-mail, means of modern technology or any other means of communication, or which comes to his / her knowledge ex officio, unless the disclosure of the same would prevent the commission of an offense affecting a person's life or safety or would cause serious damage to a person's property, or unless the disclosure of the same is an obligatory duty under the laws in force in the State."

(b) "Revealing the personal matters that offend or spoil the reputation, honor or dignity of the adverse parties, attorneys or witnesses, unless the same is necessary to defend the interests of his / her client."

(c) "Disclosing any information about the cases assigned to him / her or any secret entrusted to him / her."

(d) "Abusing the right to litigation, including prolongation of the proceedings."

(e) "Deceiving or misleading his / her client in any way."

(f) "Providing any assistance, even in the form of advice, to his / her client's adverse party in respect of the same dispute in question or any dispute thereto related, even after the legal representation for such a client ends."

(g) "Accepting the legal representation in respect of any legal proceeding that had already been handled by him / her or which falls within the scope of his / her area of competence for the jobs covered by the provisions of Article (14) hereof."

(h) "Promoting, or attempting to promote, himself / herself in any manner that goes against the ethics of the profession, by any means of promotion or enticement by intermediaries."

Article 45(2) attaches disciplinary consequences: a violator "shall be subject to the disciplinary measures, without prejudice to any other penalties set forth in this Decree Law and the laws in force in the State." Administrative Resolution 54/2022 Article 4, as cited within Circular No. 1 of 2024, defines a "Misconduct Violation" as "any action that discredits and is inconsistent with the dignity, ethics and customs of the Profession."

DLAD Circular 1/2024 elaborates the intermediary-and-representative side of Article 45(1)(h). Its operative language directs firms to "observe that solicitation should be consistent with the ethics of the profession" and to "refrain from using any means of marketing by representatives, intermediaries and other staff working in these firms that may discredit and be inconsistent with the dignity, ethics and customs of the Profession." The Circular closes with "We are looking forward to your full compliance with the content of this Circular."

Three things the Circular does not do, and each is a positive finding rather than an omission.

It does not name any communication channel — not telephone, SMS, WhatsApp, social media, email, or in-person contact. That means the ethical-standard test applies to every channel identically. A firm cannot argue that WhatsApp is a personal channel and therefore outside the rule — the Circular offers no such distinction.

It does not create an exception for existing or former clients. SRA para 8.9 explicitly permits solicitors to make unsolicited approaches to "current or former clients" — a defined carve-out. Article 45(1)(h) and Circular 1/2024 give no equivalent carve-out. The evaluative test applies to messages to existing clients too, though the ethical assessment of a message to a current client about an existing matter is obviously different from a message to a member of the public one has never represented.

It does not address referral fees, commissions to intermediaries, or the financial arrangements underlying representative-driven solicitation. Article 45(1)(h) itself names "enticement by intermediaries" but does not elaborate what enticement structures are prohibited. That gap means firms working with any third-party lead-generation arrangement should treat their arrangement as inspectable under the ethics standard, without a bright-line safe harbor.

The practical rule for a firm's WhatsApp use follows from this shape. Messaging a current client about their live matter is defensible as consistent with the ethics of the profession — it is service to an ongoing retainer, not solicitation. Messaging a member of the public whose contact details were obtained through an intermediary, a purchased list, or an event registration, however presented, is inspectable under an evaluative standard with no bright-line safe harbor.

Article 45(1)(a) — the channel that "modern technology" already includes

The SRA Code of Conduct addresses lawyer confidentiality at paragraph 6.3: "You keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents." The formulation refers to the affairs of the client without specifying the medium through which those affairs might be shared. Article 45(1)(a) of Federal Decree-Law 34/2022 takes an extra step and puts the channel into the text of the confidentiality duty itself, prohibiting a lawyer from "Disclosing any secret entrusted to him / her, whether orally, in writing or via e-mail, means of modern technology or any other means of communication."

The immediate consequence is that a WhatsApp thread carrying client information is expressly within the confidentiality obligation. There is no interpretive question about whether messaging counts — the text names it, in the widest available formulation. Where the SRA Code's paragraph 6.3 formulation reaches messaging by force of a duty stated in generic terms, Article 45(1)(a) reaches it by force of a duty that names the channel.

A further consequence follows for the physical arrangements of the firm. A staff member holding client information on a personal WhatsApp account, on a personal device that leaves the office with them, presents a direct exposure under Article 45(1)(a). The firm cannot defer that exposure to an assumed general confidentiality principle; the text of the law reaches "any other means of communication," and the personal-phone arrangement is exactly the kind of communication route the phrase encompasses.

The second consequence is the AML interaction. Federal Decree-Law 20/2018 Article 15 imposes the duty on financial institutions and designated non-financial businesses and professions to report suspicious transactions to the UAE Financial Intelligence Unit "without delay, directly." The same article then carves out lawyers: "Lawyers, notaries, other legal professionals and independent legal auditors shall be exempted from this provision if the information related to these operations have been obtained subject to professional confidentiality." Because Article 45(1)(a) makes the professional confidentiality obligation channel-neutral, information obtained via WhatsApp from a client falls within the same exemption calculus as information obtained by any other means. In UK, the LSAG framework and legal professional privilege interact with AML reporting through a different set of concepts; the two systems reach comparable outcomes by different routes.

The practical instruction for a firm: WhatsApp is a confidentiality-covered channel by operation of Article 45(1)(a); it must be treated as such at every step, including at staff onboarding, at fee-earner departure, and at any point of intake where a client sends the firm sensitive information via message.

AML reporting with a confidentiality carve-out — Federal Decree-Law 20/2018 Article 15

Article 15 of Federal Decree-Law 20/2018 places the STR duty and its lawyer-specific carve-out in one paragraph. The reporting side reads: financial institutions and designated non-financial businesses and professions "shall, upon suspicion or if they have reasonable grounds to suspect a transaction or funds…inform the Unit without delay, directly." The carve-out reads: "Lawyers, notaries, other legal professionals and independent legal auditors shall be exempted from this provision if the information related to these operations have been obtained subject to professional confidentiality."

Two things are worth noting.

First: the statute itself does not enumerate the professions covered — Article 1 defines DNFBP by reference to the Implementing Regulation (Cabinet Decision 10/2019), not in the text of the decree. The presence of a lawyer-specific carve-out in Article 15 is textual evidence that lawyers are among the DNFBPs to which the reporting duty attaches — otherwise the carve-out would have nothing to except from. A firm's compliance program has to acknowledge the STR obligation on that inference, not treat it as inapplicable.

Second: the carve-out is not an all-purpose exemption. It attaches only when the information was obtained "subject to professional confidentiality." Article 15 does not itself specify where the boundary sits between information the firm handles operationally in the course of executing a transaction (funds moving through the firm's bank, mechanics of a completion) and information obtained in the confidential circumstances of privileged consultation. The text sets the condition — the route by which the information reached the firm — without defining that route's precise perimeter. Firms should not treat the carve-out as automatic on either side of that line without their own considered position.

For the WhatsApp calculus this matters. A client sending the firm a message that describes suspicious circumstances — a source of funds that does not match the client's known profile, an urgent request to accept a payment from an unfamiliar third party — is information obtained through a confidential channel about which the firm must apply Article 15's professional-confidentiality assessment. The firm's compliance function has to know that WhatsApp is a channel through which such information regularly arrives, and it must have the ability to preserve the exchange for later reference regardless of whether reporting is or is not triggered.

Article 16(1)(b) of the same decree imposes the general due diligence obligation: "Take the necessary due diligence measures and procedures and define their scope, taking into account the various risk factors." Detailed CDD procedures are set out in the Implementing Regulation (Cabinet Decision 10/2019). Article 14 of Decree-Law 20/2018 sets the administrative sanctions for violation — from written warnings through licence revocation, with fines from AED 50,000 to AED 5,000,000 per violation — and does not itself contain the CDD detail.

For the same reason WhatsApp is not the verification channel: a passport photograph uploaded into a WhatsApp thread is an image of identification, not identification verification. The CDD process is carried out through the firm's chosen verification arrangement, and WhatsApp carries the client-facing coordination around it.

Personal data — PDPL processing bases and the Article 17 stop-right

Federal Decree-Law 45/2021 on the Protection of Personal Data came into force on 2 January 2022 (Article 31). Its consent standard, at Article 1, is a "specific, informed and unambiguous indication of the Data Subject's agreement to the Processing of his/her Personal Data"; Article 6 requires that consent be given "in a clear, simple, unambiguous and easily accessible manner," include notice of the right to withdraw, and be withdrawable at any time without affecting the lawfulness of prior processing.

Article 4 lists the situations in which personal data may be processed without consent. The list includes protection of the public interest; data that the data subject has made public; necessity for judicial claims and proceedings; preventive or occupational medicine and health insurance; protection of public health; archival, scientific, historical, or statistical purposes; protection of the data subject's own interests; performance of obligations under labor law and social security; execution of the contract with the data subject; and performance of other legal obligations. The list does not include direct marketing.

Article 17 gives the data subject a right to object to processing for "direct marketing purposes, including Profiling related to direct marketing," to processing for statistical surveys (except those necessary for public interest), and to processing that violates the protection under Article 5.

The consequence for a firm considering WhatsApp outreach to non-clients is a two-layer question. First, the initial sending is a processing activity that needs a lawful basis. Article 4 does not provide one for marketing to a person the firm has no contractual relationship with. Consent under Articles 5-6 must therefore be obtained before the sending. Second, Article 17 sits on top of that basis analysis: even where a controller believes it has a basis for the initial processing, the data subject retains an unconditional right to object to direct marketing (and to profiling related to it), and the controller must honor the objection immediately.

The contrast with UK is worth stating precisely. UK's PECR regulation 22(2) creates an explicit prior-opt-in gate for unsolicited direct marketing via electronic mail to individual subscribers. UAE's PDPL does not create an equivalent bespoke marketing gate — the analysis runs through the general processing bases in Article 4, none of which supports cold marketing, plus the Article 17 objection right. The two systems converge on approximately the same practical outcome for cold WhatsApp outreach to non-clients — it is not defensible — through different legal mechanics.

For file service to existing clients, the two systems also converge: Article 4's "execution of the contract with the data subject" basis covers processing the client's number for the purpose of servicing the retainer, in the same way that UK's PECR treats file-service messages as not being direct marketing at all.

One item explicitly not resolved here. Article 29 of PDPL provides a "six (6) months from the date of issuance of its Executive Regulations" transitional period for controllers and processors to align with the law. On the date of this article the author has not confirmed the issuance of PDPL Executive Regulations through primary sources on uaelegislation.gov.ae or through announcements by the UAE Data Office. Firms should verify the current status of the Executive Regulations directly rather than rely on the pace suggested by any secondary summary.

Cross-border transfer of personal data has its own analysis under Articles 22 and 23 (transfer to a jurisdiction with adequate protection, or transfer with contractual and other safeguards where adequacy is absent). To the extent that a firm's use of the WhatsApp Business Platform involves processing of client data outside the UAE — a fact the firm should verify with the provider directly rather than assume — Articles 22 and 23 apply, and a firm handling significant volumes of client data has to consider its position under those articles.

Client money — the absence of a statutory framework in FDL 34/2022

Federal Decree-Law 34/2022 does not contain a statutory client-money regime for advocates and legal consultants. There is no equivalent to the SRA Accounts Rules, which specify how client money is defined, where it must be held, how it must be segregated from firm money, and how an accountant's report demonstrates compliance. The formal disciplinary control over a lawyer's handling of client money in onshore Dubai runs through the general conduct duties in Article 45(1) — deception, misleading the client, misusing the position of the profession — enforced through the disciplinary regime under Article 45(2) and the "Misconduct Violation" standard of Administrative Resolution 54/2022 Article 4 as cited within Circular No. 1 of 2024.

For a firm using WhatsApp with clients, one implication follows directly from this shape. Because the formal system runs on discipline rather than on prescriptive account rules, misstatements about client money in messages carry disciplinary risk without a specific statutory rule they violate. A WhatsApp reply saying "yes, we will hold the deposit for you" creates an operational and disciplinary exposure that the law does not settle in advance. The evaluative standard applies.

A second implication follows for the choice of channel for money instructions themselves. Whatever arrangement a firm has for receiving client funds, the instruction to a client about where to send those funds — the account details, the beneficiary name, the reference number — is a message a firm may reasonably send by WhatsApp to a current client. What that message cannot do is convert an in-thread payment mechanism into a client-money receipt route, because there is no statutory route validated for that purpose; the payment must land through the firm's actual banking channel.

A DLD real estate file — where WhatsApp fits, where it doesn't

Dubai Law No. 7 of 2006 concerning Real Property Registration governs the transaction structure for real estate in the Emirate. Article 9 makes the registration point non-negotiable: "All transactions that create, transfer, amend, or extinguish Real Property Rights will be recorded in the Property Register…Such transactions will not be deemed valid unless recorded in the Property Register." Article 7 gives that register "absolute evidentiary value against all parties," subject only to proof of fraud or forgery.

Article 4 sets the ownership perimeter: UAE nationals, GCC nationals, companies wholly owned by them, and public shareholding companies may hold real property directly; non-nationals may acquire freehold or 99-year leasehold rights, with the Ruler's approval, "in certain areas determined by the Ruler." This designation-plus-approval structure creates one of the practical touchpoints where the firm's WhatsApp use has to be careful — the firm cannot advise a non-national buyer that a specific property is available for their ownership without checking whether the property sits in an area currently determined by the Ruler for that purpose.

Article 6(9) provides that the Land Department "determine[s] fees payable for services provided by the Department." The specific transfer fee percentage is set by the Department's own price schedule, not by Law 7/2006. Firms should quote the current published rate from the Land Department directly rather than rely on secondary summaries; both the amount and any split between parties can change by administrative resolution.

Against that regulatory floor, the file has a series of client-facing steps where a WhatsApp update to a current client is service to the retainer, not solicitation:

• Confirming that the firm has requested a check of the current position in the Property Register — the register whose accuracy Article 7 gives absolute evidentiary value; a screen capture of the entry showing the vendor's registered ownership is a natural WhatsApp attachment.
• For a non-national buyer, confirming that the specific property sits in an area currently determined by the Ruler for that purpose under Article 4, before the transaction proceeds any further.
• Confirming that the transfer has been recorded in the Property Register and that under Article 9 the transaction became legally valid at the moment of recording rather than at any earlier signing.
• Confirming the reference number of the recorded transaction and the date on which the register entry was made, so the client has the citation they would need to invoke Article 7's absolute evidentiary value if a later question arose.

Each of these is a service message on a live retainer. None is direct marketing under PDPL Article 17. None is solicitation under Article 45(1)(h). Each is confidentiality-covered under Article 45(1)(a). None is a substitute for the underlying regulatory workflow — verification of the client and the transaction under the AML regime, the client's own bank instructions for funds movement, and the acts of registration themselves — which happens through the firm's own arrangements rather than in the WhatsApp thread.

WhatsApp Business Platform costs — what Meta publishes, what it doesn't

Meta moved the WhatsApp Business Platform to per-message pricing on 1 July 2025. Under the current model, businesses are only charged when a template message is delivered; utility templates sent inside an open customer service window — the 24-hour window that opens each time the client sends the firm an inbound message — are free; marketing and authentication templates are charged whether inside or outside the window. Meta publishes the actual per-market rates as downloadable rate cards (CSV and PDF, per currency including AED for the UAE) rather than inline on the pricing page. The most current numbers live at developers.facebook.com/documentation/business-messaging/whatsapp/pricing — the rate-cards section links out to the specific CSV for AED.

For a Dubai firm whose WhatsApp usage is dominated by file-service updates in reply to current clients' inbound messages — the utility-inside-CSW pattern — the platform bill is small. Firms attempting outreach messaging outside that pattern run into both a bigger bill and the Article 45(1)(h) plus PDPL analyses set out above at the same time.

Scope — onshore Dubai; DIFC and ADGM run separate frameworks

This piece covers advocates and legal consultants regulated by the Dubai Legal Affairs Department under Federal Decree-Law 34/2022. Firms and practitioners registered in the Dubai International Financial Centre or in the Abu Dhabi Global Market are regulated under separate frameworks specific to those jurisdictions; the analyses above do not extend to them and should be run through the applicable framework directly.

FAQ

Can we message a current client on WhatsApp about their live matter?

Yes. A message to a current client about the client's live matter is service to the existing retainer, not solicitation under Article 45(1)(h), and processing the client's number for that purpose falls within PDPL Article 4's "execution of the contract with the Data Subject" lawful basis. Article 45(1)(a) means the exchange has to be handled inside the firm's confidentiality controls — the same way any other client communication would be.

Can a Dubai firm run WhatsApp outreach to a purchased list of prospects?

No. Article 45(1)(h) prohibits promotion "by any means of promotion or enticement by intermediaries" if the conduct goes against the ethics of the profession, and DLAD Circular 1/2024 spells out the intermediary-driven marketing restriction. Separately, PDPL Article 4 does not provide a lawful basis for the underlying processing of the recipient's contact details for marketing without their consent, and Article 17 gives the recipient the right to object. The two systems reach the same practical conclusion.

What happens when a client sends the firm information about a possibly suspicious transaction on WhatsApp?

The information is subject to Article 45(1)(a) confidentiality — WhatsApp is a covered channel by the text of the article. Federal Decree-Law 20/2018 Article 15 sets the STR duty for DNFBPs and then exempts lawyers "if the information related to these operations have been obtained subject to professional confidentiality." The exemption depends on the route by which the information reached the firm; information obtained in a privileged consultation, whatever the channel, is inside the exemption. The firm's compliance function should be structured to receive and assess these messages consistently rather than case by case.

Are staff personal WhatsApp accounts acceptable for firm communications with clients?

Not for client-file communications. Article 45(1)(a) puts the confidentiality obligation on the firm regardless of the technical channel; a client conversation on a fee earner's personal account sits on a device the firm cannot recover when the fee earner leaves and cannot audit for compliance purposes. The workable pattern is a firm WhatsApp Business number tied to firm infrastructure so that messages are captured in the client file.

If PDPL Executive Regulations have not been issued, does the six-month compliance period apply?

Article 29 of PDPL ties the six-month transition period to the date of issuance of the Executive Regulations. Where Executive Regulations have not been issued, the transition period has not started. Firms should verify the current issuance status of the Executive Regulations directly through uaelegislation.gov.ae or the UAE Data Office; this piece does not confirm their status.