“We are a small team, everyone knows what to do. We do not need written policies.”
Internal policies are the written rules that tell your team how to handle daily tasks, tricky decisions, and the situations nobody planned for. In the UAE, where the labour market is diverse, the regulatory environment is active, and free zone versus mainland rules differ in real ways, unwritten culture is not enough. Yet many owners still resist writing things down. Below are five beliefs we hear most often, and what actually happens when a business relies on them.
Myth 1
Myth: Policies Are Only for Large Corporates
The reasoning sounds sensible. Ten people in one office can just talk to each other. But size is not what triggers risk, activity is. A five-person trading company in JLT handles bank transfers, customer data, employee end-of-service calculations, and health and safety obligations exactly like a fifty-person company does, only with fewer people to catch the mistakes.
The UAE Labour Law (Federal Decree-Law No. 33 of 2021) applies to businesses with a single employee. So do the Personal Data Protection Law and the anti-money-laundering rules for regulated sectors. A written policy on leave, conduct, and grievance handling is often the first document the Ministry of Human Resources and Emiratisation asks for when a complaint is filed. If you do not have one, the default falls back to the law, and that reading is usually less favourable than the reasonable internal rule you could have written yourself.
Myth 2
Myth: Policies Slow the Business Down
The opposite is closer to the truth. When a supplier invoice lands on a Sunday morning and three people could authorise it, the question “who signs this off” costs an hour of Slack messages. A one-page financial authority matrix answers it in ten seconds. Speed comes from removing decisions, not from removing rules.
- Approval limits. Who can sign a purchase order up to AED 10,000, up to AED 50,000, and above.
- Onboarding checklist. Emirates ID copy, visa status, bank letter, signed offer, IT access request, in that order.
- Customer refund rules. What the front desk can approve without escalation.
- Incident reporting. Where a near-miss on the warehouse floor gets logged before the shift ends.
Each of these removes a recurring bottleneck. Staff stop asking the founder for permission on routine matters, and the founder stops being the pipe through which every small decision flows.
Myth 3
Reality: Data Security Is a Legal Duty, Not an IT Preference
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data set out obligations that cover almost every UAE business collecting customer or employee information. That includes the salon storing client phone numbers, the clinic storing medical files, and the e-commerce brand storing delivery addresses. There is no small-business exemption.
A written data policy names who has access to what, how long records are kept, how a breach is reported, and what happens when an employee leaves. Without it, a stolen laptop or a copied customer list becomes a legal problem on top of the commercial one. Many UAE firms have started pairing their written policy with digital tools for compliance and risk management so the paperwork actually reflects what the systems are doing day to day.
The most expensive myth: “Fraud will not happen to us.”
Occupational fraud in small and mid-sized businesses is almost always internal, and almost always enabled by the same three gaps: one person controlling both payments and reconciliations, no mandatory leave for finance staff, and vendor bank details that can be changed without a second approval. A short financial controls policy that separates these duties is the single highest-return document a UAE SME can write. According to the Association of Certified Fraud Examiners the typical fraud case runs for over a year before it is discovered, and the median loss is well into six figures in USD terms.
Myth 4
Myth: A Policy Written Once Is a Policy Forever
This is where policies quietly become useless. A handbook drafted in 2019 that still references the old Labour Law, unlimited-term contracts, and pre-VAT invoicing is not just outdated, it is actively misleading the team. UAE rules have changed several times in the last five years: the labour law was rewritten, corporate tax was introduced, end-of-service benefit structures were updated in several free zones, and data protection was overhauled.
- Assign an owner. Every policy needs one person accountable for keeping it current, usually HR, finance, or operations depending on the topic.
- Set a review cadence. Twelve months is the maximum. Six months is better for anything touching payroll or tax.
- Track the version. A footer with “v3.1, reviewed March 2025” is enough. Staff should know which version they are reading.
- Communicate changes. A revised policy that nobody has read is not in force in practice.
- Get sign-off. Employees acknowledge in writing that they have read the updated version. This is the document you want on file if a dispute reaches the labour court.
Myth 5
Reality: Workplace Safety Is Not Only a Construction Issue
Ask most office-based UAE owners about health and safety and they picture hard hats on a Dubai construction site. But Ministerial decisions on occupational health and safety apply to offices, kitchens, salons, clinics, and warehouses. A cleaner slipping on a wet floor, a receptionist with a repetitive strain injury, a delivery rider with no route safety brief, all of these produce claims, insurance disputes, and sometimes Ministry inspections.
A short safety policy that covers evacuation routes, first-aid responsibilities, incident reporting, and heat-stress rules for outdoor workers during the summer midday break is not paperwork for its own sake. It is the document your insurer, your landlord, and your regulator will ask to see the first time something goes wrong. Free zones like DMCC and JAFZA now request evidence of these policies during licence renewal reviews in some categories.
How to Actually Get Started This Quarter
You do not need a 200-page manual. Start with the four policies that cover the highest-frequency risks:
- Employee handbook, covering conduct, leave, grievance, and end-of-service in line with the UAE Labour Law.
- Financial controls, with approval limits, segregation of duties, and vendor onboarding.
- Data and IT usage, aligned with the UAE Personal Data Protection Law.
- Health and safety, proportional to your activity and premises.
Draft each in plain English (and Arabic where your team requires it), have a UAE-licensed legal advisor review the labour and data sections, and roll them out with a short team briefing rather than a group email nobody opens. Policies protect the business only when the team actually knows they exist, understands why they exist, and sees the founder following them too.
Frequently asked questions
Are internal policies legally required for small businesses in the UAE?
Some are effectively required, even if the law does not use the word “policy”. The UAE Labour Law expects employers to have clear rules on conduct, grievance, and disciplinary procedures. The Personal Data Protection Law expects documented handling of personal information. Regulated sectors like financial services and healthcare have their own explicit requirements.
Even where a written policy is not mandatory, having one is what allows you to prove reasonable conduct if a complaint is filed against your business.
How often should we review our internal policies?
At least once every twelve months, and immediately after any major change in UAE law, in your licence category, or in your business model. Payroll, tax and data policies tend to need review every six months because those areas change more often.
What is the difference between a policy and a procedure?
A policy states what the rule is and why it exists, for example “All vendor bank account changes require two approvers.” A procedure explains how the rule is carried out step by step, for example the exact form, system, and sign-off chain used to update a vendor record.
Both are useful. Policies protect you legally, procedures make the day-to-day work repeatable.
Do free zone companies need the same internal policies as mainland companies?
Broadly yes, though the specific employment rules can differ. DIFC and ADGM have their own employment regulations that override the federal Labour Law within those jurisdictions. Other free zones typically follow the federal law but may add their own compliance requests at licence renewal.
The safest approach is to write policies that meet federal standards and then check for anything additional required by your specific free zone authority.
Who should own and update policies in a small UAE business?
Assign one person per policy. HR owns the employee handbook, finance owns financial controls, IT or operations owns data and IT usage, and whoever runs the physical premises owns health and safety. In a very small company these roles overlap, but the accountability should still be named on the document itself.
What is the cheapest way to reduce fraud risk in an SME?
Separate three tasks between at least two people: creating a payment, approving a payment, and reconciling the bank account. Require a second approver for any change to vendor bank details. Make annual leave mandatory for anyone handling money, because most internal fraud is uncovered when the person running it is finally away from their desk.
None of this needs new software. It needs a one-page written policy and the discipline to follow it.
