Who Actually Owns Your Website in Dubai (2026): Domain, Code, Hosting and the Handover Checklist

Short answer: under UAE Federal Decree-Law No. 38 of 2021 on Copyright and Neighboring Rights, Article 28 vests copyright in the person who commissioned the work - so if you paid for the website, the code and design are legally yours unless your contract says otherwise. That is the law. The practical reality is different: whoever controls the domain registrar login, the DNS zone and the hosting account controls your business online, regardless of who owns the copyright. Most Dubai SMEs discover the gap between those two sentences on the day they try to change agency.

Key takeaways

• Copyright is not control. Article 28 gives you ownership of commissioned work by default. It does not give you the registrar password.
• Four assets decide everything: the domain (registrant record), DNS, hosting, and the source code repository. If any one sits in your agency's account, you are a tenant.
• A .ae domain transfer between registrars is free and typically completes in 1 to 3 working days using an AuthInfo code - and the AuthInfo code can only be released to the registrant, not to a reseller.
• You get 30 days. After a .ae domain expires there is a 30-day grace period at standard renewal rates, then it moves to pending deletion. Renewal is only AED 120-179 a year plus 5% VAT - people lose domains over a bill smaller than a phone plan.
• Fighting for a domain costs USD 1,500 in WIPO filing fees under the aeDRP and takes 2 to 3 months. Preventing the fight costs one email today.

Why this is a Dubai-sized problem

Dubai issued 58,337 new business licences across mainland and free zones in the first half of 2026 and renewed 173,652 more - over 230,000 licensing transactions in six months. Almost every one of those businesses bought a website and a domain in its first ninety days, usually from whichever agency, freelancer or business-setup consultant was already in the room.

The national domain has grown alongside it. The UAE's .ae namespace passed 347,000 registrations, served by 26 accredited registrars under the .aeDA, which is administered by the TDRA. UAE domain registrations grew close to 20% in a single quarter in a recent TDRA reporting period.

Here is what almost nobody checks in that first ninety days: whose name is in the registrant field. Not the technical contact, not the billing contact - the registrant. In a large share of Dubai SME setups it is the agency's trade name, the consultant's personal email, or a generic info@ mailbox on a domain the company no longer uses. The website works, the invoices get paid, nobody looks. Then the relationship ends.

The four assets that decide whether you own your website

Forget the contract for a moment. Ownership in practice is these four records, and you should be able to log into all four yourself, today.

Asset	What ownership actually looks like	Annual cost if you hold it
Domain name	Your company is the registrant in WHOIS, on your own registrar account, with your own login	.ae from AED 120-179 + 5% VAT; .com roughly AED 60-120
DNS zone	You control the nameservers and can edit A, MX, TXT and CNAME records without asking anyone	Free to AED 100 (Cloudflare free tier is fine)
Hosting / server	The account is billed to your company card, root or admin access is yours	AED 400-3,000+ depending on stack
Source code	A repository under your company's GitHub, GitLab or Bitbucket organisation, plus a deployable copy	Free to AED 200 per seat
Business email	Google Workspace or Microsoft 365 tenant owned by your company, not an alias inside the agency's tenant	From roughly AED 25 per user per month
Analytics and ad accounts	You are the owner in GA4, Google Ads, Meta Business Manager and Search Console - agency added as a user	Free

The column that matters is the last one. Total cost of holding every critical asset yourself is roughly AED 1,000-4,000 a year. That is the entire price of never being held hostage - and it is usually less than one month of the retainer you are already paying.

Dubai website ownership: the rules you can actually cite

Copyright: the law is already on your side

Federal Decree-Law No. 38 of 2021 came into force on 2 January 2022 and explicitly recognises computer programs and smart applications as protected works. Its Article 28 puts work-for-hire on a statutory footing: copyright in a work created for the benefit of another person vests in that person, and copyright in work created by an employee within the scope of their job vests in the employer.

Read that carefully, because it cuts both ways. It is a default, subject to agreement to the contrary. An agency contract with a clause reserving IP, or licensing the site to you rather than assigning it, overrides the default. Which is why the single most valuable paragraph in any Dubai web development contract is a plain-language assignment: all deliverables, source code, design files and content are assigned to the client on final payment.

Domains: the .aeDA rules in practice

The second-level .ae is unrestricted - anyone in the world can register it, no UAE residency, no trade licence, no documents. The restricted third-level zones are where proof is required:

Zone	Who may hold it
.ae	Anyone. No trade licence or residency needed
.co.ae	Valid UAE trade licence or a registered / applied-for UAE trademark; registrant must hold at least 50% control
.net.ae	UAE-licensed IT or network service provider, or a UAE IT trademark
.org.ae	UAE-registered non-profit with Ministry certification
.sch.ae / .ac.ae	School registration certificate or Ministry of Education / Higher Education licensing
.gov.ae / .mil.ae	Official authorisation letter from the relevant minister, agency or military officer

Registration terms run 1 to 5 years. Transfers between accredited registrars are free - no exit fees are permitted - and normally complete in 1 to 3 working days once you have the AuthInfo code. Critically, that code is released to the registrant, not to a reseller. If your agency is the registrant, you are not entitled to it. If the code cannot be obtained from the current registrar, it can be requested from the registry directly through its password recovery process.

A change of registrant - actually moving ownership rather than just registrars - needs a written, signed request from both parties, and for restricted zones the incoming registrant must document eligibility. Both parties. That is the leverage point, and it is why you fix this while the relationship is still good.

And note what the .aeDA can do if the WHOIS record is fiction: a domain can be revoked where false information was submitted - a fictitious trade licence number, or someone else's trademark registration. A .co.ae registered against your agency's licence rather than yours is not just awkward, it is fragile.

The handover checklist: run this in 30 minutes

Do this today, not on the day you decide to switch. Every item is a yes/no question you can answer from your own laptop.

1. WHOIS lookup on your own domain. Is your company the registrant? Is the admin email an address you control? Is the expiry date more than 60 days out?
2. Log into the registrar yourself. Not a screenshot from the agency - your own credentials, with 2FA on an email or phone the company owns.
3. Check the DNS host. Can you add a TXT record right now without emailing anyone? If not, you cannot verify a new tool, move mail, or migrate hosting.
4. Check who the hosting is billed to. If the invoice goes to the agency, the server disappears when the retainer does.
5. Ask for the repository, not a zip file. A repo under your organisation with full commit history, plus build instructions and the environment variables (secrets rotated, obviously).
6. Confirm you are the owner, not an admin, on GA4, Google Ads, Meta Business Manager, Search Console and your Google Business Profile. Admin access is revocable by the owner. Ownership is not.
7. Get the design source files - Figma or Adobe originals, not exported PNGs - plus font licences in your company name.
8. Get a written IP assignment citing assignment of all deliverables on final payment, and a data processing arrangement if the agency touches customer personal data, which UAE PDPL expects between controller and processor.
9. Set auto-renew and a calendar reminder 60 days before expiry. Then verify the card on file does not expire before the domain does.
10. Take your own backup. Database dump plus files, stored somewhere the agency cannot reach.

If you answered no to any of items 1, 2, 4 or 6, you do not currently own your website in any way that matters. Fix those four first.

How Aquarius does it

We register the domain in your company's name, on your own registrar account, with you as registrant from day one - and we send you the login. Hosting is billed to you or handed over with root credentials. The repository lives in your organisation. Every project closes with a written handover: assignment of all deliverables under Federal Decree-Law No. 38 of 2021, design source files, environment documentation and a backup you hold.

That is not generosity, it is how a studio behaves when it expects to keep clients on results rather than on hostages. Our Starter Site begins at AED 500 and the Business Site at AED 2,500 before VAT, handover included at both tiers. See our pricing and what each service includes.

Already stuck with someone else? We run the migration: transfer the registrar, rebuild the DNS zone with near-zero mail downtime, move hosting, and reconstruct what cannot be recovered.

Related reading: what website maintenance actually costs in Dubai, UAE PDPL compliance for websites and apps, and real 2026 Dubai website costs.

The cost of inaction, in one line: losing a domain you cannot prove you own means a USD 1,500 WIPO filing fee under the aeDRP and 2 to 3 months to a decision - during which your email is dark, your rankings decay and your printed collateral points at a URL you do not control. Holding all six assets yourself costs about AED 1,000-4,000 a year. The renewal you might miss is AED 129.

FAQ

Who legally owns a website in the UAE - the client or the agency?

Under Article 28 of Federal Decree-Law No. 38 of 2021, copyright in a work created for the benefit of another person vests in that person, so a commissioned website defaults to the client. But this is subject to agreement to the contrary - an IP-reservation or licence-only clause in the agency contract overrides it. Always get a written assignment of all deliverables on final payment.

How do I transfer a .ae domain away from my agency?

If your company is already the registrant, request the AuthInfo code - it is released to the registrant, not to a reseller - open an account with another accredited registrar and submit the transfer. It is free, with no exit fees permitted, and typically completes in 1 to 3 working days. If the agency is the registrant, you need a change of registrant, which requires a written signed request from both parties.

What if the agency will not release my domain?

Escalate in this order: the accredited registrar (registry password recovery exists where a registrar will not cooperate), then a formal complaint under the aeDRP, filed with the WIPO Arbitration and Mediation Center at USD 1,500 for one to five domains before a single panellist, with most cases decided in 2 to 3 months. Separately, the .aeDA can revoke a domain registered on false information, such as a fictitious trade licence number or someone else's trademark.

Do I need a UAE trade licence to register a .ae domain?

Not for a plain .ae - it is unrestricted, open to anyone worldwide with no residency or documents. You do need a valid UAE trade licence or a registered or applied-for UAE trademark for .co.ae, and the registrant must hold at least 50% control. Other third-level zones have their own eligibility proofs.

How long do I have if my domain expires?

A 30-day grace period at standard renewal rates, after which the domain moves to pending deletion. Renewal is only AED 120-179 a year plus 5% VAT, so set auto-renew and check that the card on file outlives the registration.

What should a proper website handover include?

Registrar login with you as registrant, DNS control, hosting billed to you with admin access, the source repository under your organisation with commit history, owner-level access to GA4, Google Ads, Meta Business Manager, Search Console and Google Business Profile, design source files and font licences, a written IP assignment, and a backup you hold yourself.

Bottom line: in Dubai the law already says the website is yours - the logins are what decide it. Run the WHOIS check and the four critical items today, while the relationship is still friendly, because a change of registrant needs both signatures and a dispute needs USD 1,500 and a quarter of a year. Talk to Aquarius for a free ownership audit of your domain, DNS, hosting and accounts, or a fixed AED quote to migrate everything into your own name.