Commissioning custom web development in Dubai without reading the intellectual property clause is the most common way UAE businesses end up renting a website they thought they bought. UAE law treats software, databases, drawings and photographs as protected works, and it sets out precisely how rights in them move from one party to another. The short version: getting the files is not the same as getting the rights, the domain is a separate question with its own registry rules, and the account logins are the thing that actually strands people when a relationship ends.
Key takeaways
- Article 9 of the UAE copyright law requires a transfer or licence of economic rights to be in writing, specifying the right, the purpose, the duration and the place, and says the author keeps every right not expressly assigned.
- Article 28 sets a different default where nothing is agreed in writing: work created in favour of another person has the copyright attributed to that person.
- Moral rights cannot be assigned at all, so a clause purporting to transfer them does not do what it says.
- WordPress’s own position is that themes and plugins inherit the GPL, which limits what an agency can promise you about exclusivity.
- For a .ae domain, only the registrant can transfer it, cancel it or change the registrant. If that is your agency, the domain is theirs to move.
What UAE copyright law actually protects
Federal Decree-Law No. 38 of 2021 on copyright and neighbouring rights came into force on 2 January 2022. Article 2 lists protected works, and item 2 names smart applications, software and software applications, databases and similar works. Other items on the same list matter to a website project: engineering drawings and plans, works of drawing and painting, photographic works, illustrations and maps. The article also protects the title of a work where the title is innovated.
Article 3 is the limit. Protection does not extend to ideas, procedures, work techniques, mathematical concepts and principles, or abstract facts. Your agency’s process, their approach to discovery, their component structure as a concept: none of that is ownable by you, and a clause claiming it is claiming something the statute does not recognise.
Article 4 is worth knowing because it removes a common worry. Failure to register a work, or a disposition of it, does not prejudice the protection or rights the law establishes, although the Ministry’s registers serve as a reference for a work’s details and ownership. You do not need to register your website to own the copyright in it. Registration is evidence, not the right.
The default when nothing is written down
Article 28 opens with the words that matter: unless otherwise agreed in writing. It then sets three defaults. Where the author creates an innovation in favour of another person, the copyright is attributed to that person. Where an employee creates a work related to the employer’s business, mandated by the employer directly or indirectly, or using the employer’s expertise, information, tools, machinery or materials, the economic rights are attributed to the employer, taking the worker’s intellectual effort into account. Where an employee creates a work unrelated to the employer’s business without using any of those resources, the economic rights stay with the employee.
The first of those is the one founders should read twice, because it runs against the assumption imported from UK and US practice, where a contractor typically keeps copyright unless it is assigned. In our reading, commissioning a website in the UAE with nothing written about IP puts you in a stronger default position than many clients expect.
That is a reason to write a good clause, not a reason to skip one. Article 9 sits alongside Article 28 and states that a transfer or licence of economic rights takes effect in writing, specifying the right in question and indicating the purpose, the duration and the place of utilisation, and that the author owns all rights not expressly assigned. Once you start writing terms, those are the terms you are held to. A contract that says less than Article 28’s default would have given you is worse than silence, and a one-line clause may be argued to fall short of Article 9’s requirements. This is general information rather than legal advice, and the interaction between these two articles is exactly the point to put in front of a UAE lawyer rather than settle from an article.
The clause that decides it
A workable assignment clause names four things, because Article 9 names four things. What is assigned, for what purpose, for how long, and where.
In practice that means listing the deliverables rather than gesturing at them: the source code of the custom theme or application, the layered design originals rather than exported images, the content written for the project, the database schema and the configuration. It means stating that the assignment is perpetual and worldwide rather than leaving duration and place blank. And it means handling anything the agency reuses across clients, which is normal, through a licence rather than an assignment.
Watch for three phrasings that cause trouble. “The client owns the website” is ambiguous about whether that includes the code or only the rendered site. “All intellectual property rights transfer on final payment” is fine as far as it goes, but needs a matching clause saying what happens if the project is terminated part way through, which is when disputes actually arise. And “the agency retains ownership of the framework” needs a definition of the framework, because otherwise it can expand after the fact to cover most of what you paid for.
Article 13 adds a point people miss. The author’s disposition of the original version of a work, in any form, does not transfer the economic rights unless otherwise agreed. Receiving a zip file of the site is a delivery of a copy. It says nothing about who holds the rights, and a client who has the files but no assignment clause is in a weaker position than they feel.
The rights you cannot buy, and the ones you cannot sell
Article 5 gives the author moral rights that are not subject to prescription or assignment: to publish the work first, to have it ascribed to them, and to object to a modification that distorts the work or harms their reputation. There is one software-specific carve-out, in that the right to apply to court to recall a work from circulation does not apply to smart applications, software and software applications.
Two consequences follow. A clause assigning “all rights, including moral rights” does not achieve the assignment of moral rights, whatever it says. And the question of a designer’s credit in your footer is a contractual negotiation about whether they exercise a right, not a transfer of it. If you do not want “Designed by” in the footer, agree that in writing and expect it to be a commercial point rather than an automatic consequence of buying the site.
Duration sits in Article 20: economic rights generally run for the author’s lifetime plus fifty years, and fifty years from first publication where the author of a collective work is a legal person. Academic for a website, relevant when you are valuing an asset in a sale.
Third-party licences override what your contract says
WordPress themes and plugins
Article 12 of the copyright law says the licence of economic rights in software and databases is governed by the terms and conditions carried with the software, and that the purchaser or user is bound by them. Your contract with your agency does not change a licence sitting on top of the code they used.
WordPress is released under the GPL version 2 or later, and the WordPress licence page states that derivatives of WordPress code inherit the GPL, adding that the project feels strongly that plugins and themes are derivative work and so inherit the licence too. The page acknowledges a legal grey area about what counts as a derivative work, which is an honest caveat worth carrying rather than dropping.
The practical reading for a client: an agency cannot straightforwardly promise that a custom WordPress theme is exclusive to you in the sense of forbidding its reuse, because the licence on the code they built on points the other way. What they can promise, and what is worth asking for, is that the design, the brand assets and the content are yours, and that they will not resell this specific build to a competitor as a product. If exclusivity of the codebase is genuinely important to your business, that is an argument for a stack where the licensing supports it, a question we go into in our comparison of WordPress and Strapi for Dubai teams.
Fonts, photography and paid plugins
These are the quiet liabilities in a handover. A commercial font licence is usually tied to a named licensee and a stated number of page views or installations, and it does not transfer because the website did. Stock photography is similar. Paid plugin licences renew in somebody’s account, and when that account is the agency’s, your updates stop the day the relationship does.
Ask for a licence inventory as a deliverable: what is used, under which licence, in whose name, renewing when, at what cost. It takes an hour to produce and prevents the discovery, eighteen months later, that the typeface on your site is licensed to somebody else.
One thing to be blunt about. Article 40 makes it an offence to download or store software, a software application or a database in a computer without authorisation from the author or right holder, with imprisonment of at least six months and a fine of AED 100,000 to AED 700,000. Nulled themes and cracked plugins are not a cost saving, and they are usually the agency’s decision rather than yours, which is why the licence inventory is worth asking for before launch rather than after.
The domain is a separate question
Copyright law has nothing to say about your domain name, and the rules that do apply come from the registry.
For a .ae domain, the registry is administered by the TDRA. Its guidance on changing a domain name’s registrant, last updated on 4 October 2022, states that the registrar must receive a written request for transfer explaining the circumstances, signed by the registrant contact, and must obtain confirmation from both the registrant contact and the proposed registrant. Moving a domain between accredited registrars requires the auth-code, which the registrant provides, and the page says the transfer completes within three working days of a request that is in order.
Read that as a checklist. If your agency is listed as the registrant contact rather than as the technical or administrative contact, they are the party the registry recognises, and you need their signature to change it. The fix is trivial before a dispute and unpleasant after one: check the registrant record now, and put the company as registrant with a company email address that is not an individual employee’s. The same logic applies to a .com registration, where the registrant on record and the account holding it are what matter rather than who paid the invoice. If the domain sits with us or anyone else as part of a domain registration arrangement, the registrant record should still say your company.
Accounts and access, which is what actually strands people
In the disputes that reach us second hand, the argument is rarely about copyright. It is about a login.
Make a list before the project starts and put ownership of each item in the contract. The registrar account and registrant record. DNS. The hosting or cloud account, billed in your name. The code repository, owned by your company rather than sitting in a developer’s personal account. The CMS administrator login. Google Analytics and Tag Manager, where the property should live in your own account with the agency granted access. Google Ads, Google Business Profile, the Meta business account and pixel. The mail provider. Any payment gateway credentials, which should never travel by message.
The test is simple. If the agency disappeared tomorrow, could you still reach every one of those? If the answer is no for any line, that line is the thing to fix in the contract, and it costs nothing to fix at the start. We set out how these items appear on a proposal in our breakdown of a Dubai website development quote, line by line.
What to fix before signing
- An assignment clause that names the deliverables, the purpose, the duration and the territory, matching what Article 9 asks for.
- A termination clause saying what you own if the project stops before final payment, and on what terms.
- A licence, rather than an assignment, for anything the agency reuses across clients, with the reused components identified.
- A written position on the footer credit, treated as a negotiation rather than as part of the assignment.
- A licence inventory as a named deliverable, covering fonts, images, plugins and any commercial libraries.
- An access schedule listing every account, who owns it, and what is handed over at the end.
- Source code delivery on a defined trigger rather than on request, with the repository handed over rather than a zip emailed.
None of these are unusual asks, and a supplier who resists all seven is telling you something useful early. Choosing between an agency and an individual developer changes how realistic some of them are, which we covered in our comparison of an agency and a freelancer in Dubai.
If you are about to sign for custom software or a website build in Dubai, the cheapest hour you will spend on the project is the one reading the IP clause and the access schedule. We are happy to look at what you have been sent, whoever wrote it.
Legal references here are indicative and were checked against the UAE legislation portal, the TDRA and the WordPress project on 18 September 2026. Laws, registry policies and licences change, and this is general information rather than legal advice; take qualified UAE legal advice on your own contract. Cover photo: Dubai Alserkal Avenue 2024-11-17, via Wikimedia Commons (CC0).
