Dubai Healthcare City. Health data. Regulation (free zone)
DHCC HDPRDHCC Health Data Protection Regulation No. 7 of 2013
Partly verified
Medium confidence.DHA 2022 health data policy may affect application; no newer DHCC regulation found.
§1Summary
- Synopsis
Governs the collection, use, disclosure and retention of patient health information by DHCC licensees and professionals, wherever the data is held.
- Key themes
- Unique features
Transfers outside DHCC only to jurisdictions deemed adequate (DIFC list or Central Governance Board approval) and with patient authorisation or for ongoing care; no permit route for non-adequate jurisdictions. Fixed retention periods (e.g. 10 years for adults, 20 for medico-legal).
- SaaS relevance
Health SaaS used by DHCC licensees must meet confidentiality and transfer limits, in addition to the federal ICT Health Law localisation rule.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- No specific CPQ duty; periodic incident reporting to Customer Protection Unit
- DPO
- No
- Cross-border transfers
- Adequate jurisdictions only + patient authorisation/care necessity; federal localisation also applies
- Maximum penalty
- Penalty list to be published by DHCA (apparently not published)
§3Dates
- Key dates
- Adopted
- In force
- Replaced DHCC Data Protection Regulation No. 7 of 2008
§4Text and authority
- Text
- Authoritative text dhcc.ae
- Authority
- Dubai Healthcare City Authority; Centre for Healthcare Planning and Quality (CPQ)
§5Where it applies
- Domestic law of
- Dubai Healthcare City
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.DHA 2022 health data policy may affect application; no newer DHCC regulation found.