Home
Dubai, UAE News
Amendments to the UAE Tax Procedures Law: key points to keep in mind

Amendments to the UAE Tax Procedures Law: key points to keep in mind

At the beginning of the year, significant changes were introduced to the Tax Procedures Law (Federal Decree-Law No. 17 of 2025), which will substantially alter taxation rules in the United Arab Emirates. These amendments affect all companies and individual entrepreneurs paying taxes in the country, aiming to enhance the FTA’s powers and align with international standards like BEPS. This article will outline the main aspects of the changes, their impact on businesses, and the necessary steps to comply with the new requirements.

1. Extension of the standard audit period

One of the most notable changes is the extension of the standard audit period from three to five years to six years. The FTA will now be able to review declarations and financial documents over a longer period, increasing the risks for entrepreneurs.

If signs of non-compliance or fraud are detected, this period can be extended up to 15 years. This measure aims to combat offenses and create a more transparent tax environment.

2. Unified procedural standard

All tax procedures will now be standardized, simplifying interactions between taxpayers and relevant authorities.

Uniform rules will help avoid confusion and misunderstandings, thereby enhancing compliance with the law.

3. Enhanced requirements for legal justification

The amendments strengthen the requirements for the legal justification of business operations. The «substance over form» principle means that tax authorities will more rigorously assess the actual economic substance of transactions rather than just their formal aspects. Companies will need to carefully document their operations and ensure they align with reality.

4. Transition to electronic document management

All documents related to tax audits must now be submitted electronically. This approach will accelerate document processing and enhance the security and confidentiality of information.

5. Expanded rights for the FTA

The changes grant the FTA broader rights to request information from third parties, such as banks, suppliers, and customers. This will enable more effective collection of information needed for inspections and identification of potential violations. Organizations should be prepared for increased scrutiny from government agencies.

6. Simplified procedures for additional tax assessments

The new rules streamline the process for additional tax assessments, potentially leading to more cases where the FTA reviews companies’ tax obligations.

The legislative changes affect various participants in the tax process:

Companies and individual entrepreneurs: all taxpayers should be ready for new regulations and possible inspections by government agencies.
End consumers of goods: the risk of additional taxes also applies to end consumers, impacting their financial obligations.
Banks, accountants, and auditors: compliance with additional requirements from the FTA.

To comply with the new standards and minimize risks, entrepreneurs should take the following steps:

1. Establish a system for documenting all business transactions and their justifications for up to 15 years to avoid issues during inspections.

2. Conduct an audit of tax positions to identify potential risks, allowing for better preparation for possible additional charges and improved reporting.

3. Develop and implement internal control systems to promptly identify and address legislative violations.

4. For organizations involved in international transactions, prepare documentation confirming the validity of prices for intra-group transactions.

5. Ensure compliance with digital document management regulations with the tax service, utilizing modern technologies for data storage and transmission.

The amendments to the UAE Tax Procedures Law mark a significant step toward enhancing transparency and efficiency in tax administration. Businesses must adapt to the new conditions and pay closer attention to accounting. Taking timely measures for documentation, audit, and internal control will help avoid negative consequences and ensure stability in tax relations. Consultations with experienced lawyers will prepare you for the changes and help understand how the new rules may affect your business.

Read other articles on this topic:

Back

Privacy policy regarding the processing of personal data.

1. General provisions

1.1. This personal data processing policy has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (hereinafter referred to as the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data No. 152-FZ “On Personal Data” (hereinafter referred to as the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data taken by Website Administrator, an individual, email address for sending legally significant messages: aleeks777@yandex.ru (hereinafter referred to as the Operator) considers compliance with the rights and freedoms of citizens to be one of the most important conditions for carrying out its activities.

1.2. The Operator's policy regarding the processing of personal data (hereinafter referred to as the Policy) applies to all information that the Operator may receive about visitors to the websites: make-biz.com. Personal data is processed in accordance with Federal Law No. 152-FZ “On Personal Data”.

2. Key terms used in the Policy

2.1. Website — a collection of graphic and informational materials, as well as computer programs and databases that make them available on the Internet at the network address make-biz.com

2.2. User — any visitor to the website make-biz.com.

2.3. Personal data — any information relating to the User of the make-biz.com website.

2.4. Processing of personal data — any action with personal data, performed with or without the use of computers.

2.5. Depersonalization of personal data – actions that make it impossible to determine the ownership of personal data to a specific User or person without using additional information;

2.6. Distribution of personal data – any actions that result in the disclosure of personal data to an indefinite circle of persons;

2.7. Provision of personal data – any actions that result in the disclosure of personal data to a specific group of persons;

2.8. Destruction of personal data – any actions that result in the irrevocable destruction of personal data in personal data information systems and/or on any other physical media.

3. The Operator may process the following personal data of the User:

3.1. List of personal data processed by the Operator: surname, first name, patronymic, telephone number, email address.

3.2. The Operator may process Users' personal data regardless of their citizenship and location, subject to compliance with the requirements of the legislation of the Russian Federation on personal data.

3.3. In addition, the website collects and processes anonymized data about visitors (including cookies) using internet statistics and analytics services (Yandex Metrica and others). Anonymized data is not used to identify a specific User without their consent and is used exclusively for statistical analysis, improving the performance and content of the website.

3.4. The Operator processes the personal data of the following categories of personal data subjects: users of the make-biz.com website who have requested advice or submitted personal data via the website forms for the purposes provided for in this Policy.

3.5. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, changing), use, depersonalization, destruction.

3.6. Automated processing of personal data

3.6.1. The Operator performs both automated and non-automated processing of personal data, including the receipt, transfer, storage, and use of information using information and telecommunications networks.

3.7. The Operator processes only those personal data that are necessary to achieve the processing purposes specified in this Policy and does not allow the processing of excessive personal data.

3.8. The operator does not process special categories of personal data provided for in Article 10 of Federal Law No. 152-FZ, including data on race, nationality, political views, religious or philosophical beliefs, health status, personal life, except in cases expressly provided for by the legislation of the Russian Federation.

3.9. The Operator does not process Users' biometric personal data within the meaning of Article 11 of Federal Law No. 152-FZ.

4. Purposes of personal data processing

4.1. The user's personal data — surname, first name, patronymic, telephone number, email address — is processed for the following purposes: Making an appointment with a lawyer or specialist, consulting the Customer, sending notifications to the Customer. The Operator has the right to send the User notifications about new products and services, special offers, and various events. The User can always opt out of receiving informational messages by sending a letter to the Operator at aleeks777@yandex.ru.

4.2. Anonymized User data collected using Internet statistics services is used to collect information about User actions on the website and to improve the quality of the website and its content. Anonymized data is not used to identify a specific User without their consent.

5. Legal grounds for processing personal data

5.1. The Operator processes the User's personal data only if it is sent by the User through the forms located on the website make-biz.com. The legal basis for the processing of personal data is the voluntary consent of the personal data subject to the processing of their personal data, expressed by filling out feedback forms on the website make-biz.com and placing a corresponding mark of consent to this Policy.

5.2. The processing of anonymized data about the User, including cookies, is carried out with the consent of the User, expressed by continuing to use the site and/or by checking the appropriate box in the site interface, as well as with browser settings enabled that allow the use of cookies and JavaScript technology.

If the User does not agree to the processing of cookies, they must stop using the Website or independently change their browser settings to prohibit the storage of cookies and the use of JavaScript technology. The Operator hereby notifies that the complete or partial disabling of cookies may result in the incorrect functioning of certain features or sections of the Website, for which the Operator shall not be liable.

5.3. Principles of personal data processing

5.3.1. Personal data is processed on a lawful, fair, and transparent basis in accordance with Article 5 of Federal Law No. 152-FZ.

5.3.2. The processing of personal data is limited to the achievement of specific, predetermined, and lawful purposes specified in this Policy.

5.3.3. The Operator processes only those personal data that are necessary and sufficient to achieve the purposes of processing. The processing of personal data that does not correspond to the stated purposes or is excessive in relation to them is not permitted.

5.3.4. Personal data must be accurate, up-to-date, and updated as necessary; the Operator takes reasonable measures to delete or correct incomplete or inaccurate data.

5.3.5. It is not permitted to combine databases containing personal data that is processed for incompatible purposes.

5.4. Processing of personal data without the consent of the data subject

The Operator has the right to process personal data without the consent of the data subject in cases provided for in Article 6 of Federal Law No. 152-FZ, including the performance of a contract, compliance with legal requirements, or the protection of the rights and legitimate interests of the Operator and third parties.

6. Procedure for collecting, storing, transferring, and other types of processing of personal data

6.1. The operator ensures the security of personal data and takes all possible organizational and technical measures to prevent unauthorized persons from accessing personal data, including restricting access to personal data, using information security measures and antivirus software, and monitoring compliance with personal data security requirements.

6.2. The transfer of personal data to third parties is permitted only in cases provided for by the legislation of the Russian Federation, as well as when involving persons who ensure the functioning of the website and the provision of services, provided that they comply with the requirements of the legislation on personal data.

6.3. If inaccuracies are found in personal data, the User may update them by sending a notification to the Operator by email to the Operator's email address aleeks777@yandex.ru with the subject line “Update of personal data”.

6.4. The User's personal data is processed and stored for no longer than is necessary for the purposes of processing personal data, or until the User withdraws their consent to the processing of personal data, unless otherwise provided by the legislation of the Russian Federation. The User may withdraw their consent to the processing of personal data at any time by sending a notification to the Operator by email to the Operator's email address aleeks777@yandex.ru with the subject line “Withdrawal of consent to the processing of personal data”.

6.5. If the purposes of personal data processing are achieved or the User withdraws their consent to the processing of personal data, the personal data shall be destroyed within a period not exceeding 30 calendar days, unless otherwise provided by law. The destruction of personal data is carried out by deleting it from the Operator's information systems and/or destroying physical media.

6.5.1. If it is necessary to temporarily suspend the processing of personal data (for example, if inaccuracies are identified, complaints are received from personal data subjects, or security breaches are suspected), the Operator shall block the personal data until the situation is resolved, without losing the possibility of its subsequent lawful processing, in accordance with Article 16 of Federal Law No. 152.

6.6. Before starting to transfer personal data across borders, the Operator has to make sure that the foreign country where the personal data is going to be transferred provides adequate protection of the rights of personal data subjects. Cross-border transfer of personal data is done in line with the requirements of Article 12 of Federal Law No. 152-FZ.

6.7. The Operator shall take the necessary and sufficient legal, organizational, and technical measures to protect personal data. The Operator shall not be liable to the User for any losses or other negative consequences arising from the disclosure or loss of personal data if such an event occurred:

- as a result of actions, inaction, or violations by the User of information security requirements, including the independent transfer of personal data, passwords, access codes to third parties, providing access to the User's email or devices, as well as other compromises of personal data for reasons beyond the Operator's control;

- as a result of unlawful actions of third parties committed using malicious software or vulnerabilities that could not be prevented by available means of information protection at the time of the incident (including zero-day attacks);

- due to the occurrence of force majeure circumstances within the meaning of Article 401 of the Civil Code of the Russian Federation.

6.8. The recording, systematization, accumulation, storage, and clarification of personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation (“in accordance with Article 18 of Federal Law No. 152”).

6.9. Continuation of processing after withdrawal of consent

6.9.1. In the event of withdrawal of the User's consent, the Operator has the right to continue processing personal data if there are grounds provided for by Federal Law No. 152-FZ, including the performance of a contract, compliance with legal requirements, or the protection of the rights and legitimate interests of the Operator and third parties.

7. Final provisions

7.1 The User may obtain any clarifications on issues of interest concerning the processing of their personal data by contacting the Operator via email at aleeks777@yandex.ru with the subject line “Clarifications on the processing of personal data.”

7.2 This document will reflect any changes in the Operator's personal data processing policy. In the event of significant changes, information may be sent to the User at the email address they have provided.

7.3. This Policy is valid indefinitely until it is replaced by a new version and is subject to free access on the Internet at make-biz.com.

8. Rights of the personal data subject

8.1. The User has the right to:

— receive information about the procedure and scope of data provision, limited to information relating only to the personal data subject.

— request clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, or processed in violation of Russian law;

— appeal against unlawful actions or inaction of the Operator to Roskomnadzor or a court;

— restrict the processing of personal data for marketing purposes;

— withdraw consent to the processing of personal data.

8.2. The Operator shall consider requests from personal data subjects and send a response within 30 calendar days from the date of receipt of the request, unless another period is established by the legislation of the Russian Federation. The response shall be sent to the email address specified by the personal data subject or by other means agreed with the subject.

8.3. User responsibility

8.3.1. The user is responsible for providing inaccurate personal data about themselves or other persons, as well as for providing data about third parties without their consent, in accordance with the legislation of the Russian Federation.