Do not wait for proceedings to be filed. As soon as a serious disagreement emerges, such as an objection to a change order, a rejected invoice or a notice of termination, evidence starts to be at risk: messages are deleted under the retention policy, accounts are closed when an employee leaves, and system logs are overwritten on a cycle.

NIST recommends involving management and legal counsel before applying evidence-collection practices, and preserving evidence when in doubt about whether it is needed. ^[2] So the first step is an internal hold notice, issued with counsel, that names the people, systems and time period, and suspends automatic deletion within that scope.

The internal hold notice: what should it contain?

A hold notice is a short internal message, but it is the first thing you will be asked about if the other side claims that evidence was lost or altered after the disagreement emerged. Make sure it includes:

• A brief description of the matter: enough to identify what must be kept, without revealing legal strategy.
• The people concerned: by name and department, including anyone who has left or is about to leave.
• Systems and devices: email, approvals systems, shared files, messaging apps and mobile devices used for work.
• The time period: from the start of the contractual relationship or the relevant event until further notice.
• What is prohibited: deleting, editing, moving or wiping devices, with automatic deletion suspended within the scope.
• A contact point and acknowledgement: who to ask when in doubt, and a request for written acknowledgement of receipt.

Review the notice regularly as the dispute develops, and lift restrictions only on counsel’s written decision. When an employee covered by the notice leaves, preserve their account and device before they are closed or reassigned.

What does UAE evidence law say about electronic evidence?

Federal Decree-Law No. 35 of 2022 promulgating the Law of Evidence in Civil and Commercial Transactions, in force since 2 January 2023, devotes Articles 53 to 64 to electronic evidence. ^[1] Its main provisions are:

• Definition: evidence derived from data or information generated, stored, copied, sent or received by information technology on any medium, which can be retrieved in an understandable form (Article 53). ^[1]
• Forms: including electronic records and instruments, electronic signatures and seals, electronic correspondence including email, and modern means of communication (Article 54). ^[1]
• Probative value: informal electronic evidence binds the parties to a transaction in cases including where it was generated by an electronic means specified in the disputed contract, or by an authenticated or publicly available means (Article 57). ^[1]
• Submission: evidence is produced in its original format or by any other electronic means, and the court may ask for its content in writing where possible (Article 60). ^[1]
• Extracts: extracts have the same probative value as the electronic evidence itself, provided they match it (Article 63). ^[1]

The law also allows the court to appoint one or more experts on technical matters (Article 109). ^[1] The practical point: the strength of the evidence lies in your ability to prove its source and that what you produce matches the original.

These are the federal rules before the UAE courts. If the dispute is before the courts of a financial free zone or an arbitral tribunal, or governed by the law of another Gulf country, the rules on evidence and submission there have their own provisions, so do not assume the federal law applies automatically, although the same preservation steps remain sound in every case.

What to collect: mapping the sources

Start with the question: what fact is in dispute, and where did it leave a digital trace? In a change-order dispute, for example, the trace may be in email, the approvals system, electronic meeting minutes and shared files.

NIST points out that data sources are not limited to the organisation’s computers but include removable media, mobile devices and records held by third parties, some of which may only be obtainable by court order. ^[2] It ranks sources by likely value, volatility and the effort required, so whatever changes or is deleted quickly comes first. ^[2]

The preservation log: documenting source and integrity

Digital evidence is usually challenged on two grounds: its source, and whether it has been altered. The preservation log closes both. NIST recommends: ^[2]

• keeping a log of everyone who had custody of the evidence, what they did with it and when;
• computing hash values for the original and the copy and comparing them to verify that they match;
• working on a copy, not the original, for examination and analysis;
• documenting each collection step and the tools used, so that someone else could repeat it;
• appointing a single evidence custodian and storing evidence securely when not in use.

ISO/IEC 27037:2012 provides guidelines for identifying, collecting, acquiring and preserving potential digital evidence, and remains current after being reviewed and confirmed in 2018. ^[3]

For each item, also record the system or account, the export time and time zone, who exported it and how. A difference in time zone between the mail server and a local device is sometimes enough to cast doubt on the sequence of events.

Screenshots and hash values: what each can and cannot do

A screenshot is useful for presentation, but it usually carries no message headers, message ID or creation data, and is easy to challenge. Keep the original in its native format and use the screenshot for presentation only.

A hash value proves one thing: that the copy matches the original it was computed from and has not changed since. ^[2] It does not prove who created the file, when it was created or that its content is true. So document what the tool cannot prove with supporting evidence, such as account access logs, system logs and the system owner’s statement.

Personal data and the limits of collection

Employees’ correspondence and customer and supplier data are usually personal data. The federal Personal Data Protection Law prohibits processing without the data subject’s consent except in specified cases, including what is needed for legal claims or proceedings. ^[4] That basis does not justify collecting everything: collect what relates to the dispute within a defined time and subject scope, and restrict access to the collected copies.

The federal law does not apply to government entities or to companies in free zones that have their own data protection legislation, ^[4] so establish which law applies before collecting, especially if the data is hosted outside the country.

Hypothetical example: a dispute over approval of a change order

Hypothetical example: A contractor in Dubai carried out additional works under a change order it says was approved by email, while the owner denies approving it. Counsel issued a hold notice covering four employees’ accounts and the project management system for the six months concerned, and the IT team suspended automatic deletion within that scope.

The system owner exported the approvals log with the date and time zone of each approval, the emails were preserved in their original format with headers and attachments, and a hash was computed for each file and its copy and entered in the preservation log with the name of the person who exported it and the export time. The legal team worked on the working copies, and the originals stayed with the evidence custodian. Counsel then assessed how to submit the evidence under the Evidence Law and whether to ask for a technical expert to be appointed.

Conclusion

Preserving digital evidence starts before the formal dispute, with a hold notice and a defined scope agreed with counsel. Collect from the source, record who collected what, when and how, verify integrity with hash values, work on a copy and respect the limits on personal data: these steps are what make the evidence reliable when it is submitted.