United Arab Emirates. Health data. Federal Law
ICT Health LawFederal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields
§1Summary
- Synopsis
Regulates the electronic handling of health information by healthcare providers, insurers, claims managers and health-tech service providers, including a central medical records system, confidentiality and retention duties. Article 13 imposes a general health-data localisation rule.
- Key themes
- Unique features
Health data may not be stored, processed, generated or transferred outside the UAE except in cases set by health authorities (Resolution 51/2021: overseas treatment, labs, research, insurance, pharmacovigilance, personal devices etc.). Applies across the UAE including free zones; records kept for at least 25 years.
- SaaS relevance
Any SaaS providing electronic services in the medical field to UAE health entities must host health data in the UAE unless an exception applies.
§2Obligations
- Extraterritorial
- Limited
- DPO
- No
- Cross-border transfers
- Localisation: health data stays in UAE save Resolution 51/2021 exceptions (often with consent, encryption and an in-country copy)
§3Dates
- Key dates
- Adopted
- In force
- Cabinet Resolution 32/2020 implementing regulations (22 Apr 2020); Ministerial Resolution 51/2021 transfer exceptions (issued 28 Apr 2021, in force 16 May 2021)
§4Text and authority
- Text
- Authoritative text uaelegislation.gov.ae
- Authority
- Ministry of Health and Prevention (MOHAP) and emirate health authorities (DOH Abu Dhabi, DHA)
§5Where it applies
- Domestic law of
- United Arab Emirates
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
High confidence.
25-year retention from Lex Mundi (2022) summary.