TRW & Co · Healthcare
Health Data in the UAE: ICT in Health Law, Localisation and Confidentiality
Health data law UAE rules start from Federal Law No. 2 of 2019 on ICT in health fields. Health data about services provided in the UAE must by default stay in the country, may be disclosed without consent only in defined cases and must be kept for at least 25 years. Here is how localisation, the exceptions and the health information exchanges work.
Key pointRemote access counts: an overseas support or analytics team that can view UAE patient records may be processing health data outside the UAE even when the servers are in Dubai, so foreign access needs a documented exception.
At a glance
Federal ICT Health Law
Federal Law No. 2 of 2019 governs health data processed through technology across the UAE, including free zones, and has been in force since May 2019.
Localisation by default
Health data on services provided in the UAE may not be stored or transferred abroad except in cases permitted by the health authorities.
Ten permitted exceptions
Ministerial Resolution No. 51 of 2021 allows transfers for cases such as overseas treatment, research, insurance and telehealth, each with conditions.
25-year retention
Health data must be kept for at least 25 years from the date of the last procedure, far longer than most corporate retention policies.
PDPL carve-out
The federal PDPL excludes health data governed by its own legislation, so the ICT Health Law is the primary onshore regime for health data.
Swipe or scroll →
Health data law UAE rules are stricter than general data protection rules in one key respect: health information about services provided in the UAE must, by default, be stored and processed inside the country. Federal Law No. 2 of 2019 on the use of information and communication technology in health fields (the ICT Health Law) sets that localisation rule, imposes confidentiality and accuracy duties, requires long retention and underpins the national health information exchange. It applies throughout the UAE, including in free zones.
This guide explains the framework, the permitted exceptions for cross-border transfers, how the health information exchanges work, how the law interacts with the federal PDPL and the DIFC and ADGM regimes, and what hospitals, insurers and health-tech companies should do. It reflects official guidance as of October 2026.
Health data law UAE: the short answer
- A specific federal law. The ICT Health Law, in force since May 2019, governs health data processed using technology by health facilities, insurers, claims managers, e-health providers and others connected to health services.
- Localisation by default. Health data relating to health services provided in the UAE may not be stored, processed, generated or transferred outside the country except in cases permitted by the health authorities.
- Defined exceptions. A 2021 ministerial resolution sets out permitted cases, such as overseas treatment, overseas laboratories, research, insurance, telehealth and patient requests, each with conditions.
- Confidentiality and consent. Health data may be used or disclosed without consent only in defined cases, such as anonymised research, insurance verification, judicial requests and public health.
- Long retention. Health data must be kept for at least 25 years from the date of the last procedure.
- National exchange. Providers connect to the federal and emirate health information exchanges: Riayati, Malaffi in Abu Dhabi and NABIDH in Dubai.
For most providers and health-tech businesses, the hard question is not consent but location: where the data sits, who can access it from abroad and which exception, if any, covers a transfer.
The legal framework
The ICT Health Law
Federal Law No. 2 of 2019 aims to ensure the optimal use of technology in health, align practice with international standards, enable the Ministry of Health and Prevention (MOHAP) to collect and analyse health information nationally and protect the security of health data. It defines health data broadly and applies to any entity in the UAE that provides health services, health insurance, claims management or electronic health services, or is otherwise connected with applying the law.
Core duties include keeping health data confidential, ensuring it is accurate and reliable, making it available to authorised persons when needed, using it only for the purpose of providing health services unless the patient consents, and putting in place technical, organisational and operational security measures. Breaches carry administrative sanctions and fines, with the localisation breach attracting some of the heaviest penalties.
Implementing rules
Cabinet Resolution No. 32 of 2020, the executive regulation, set the rules for the central health information system: who joins, who may access it, permission controls, confidentiality duties for authorised users and controls on storage. Patients may give access to persons of their choice and may ask to restrict access to their information, subject to the Ministry's controls.
Ministerial Resolution No. 51 of 2021 then defined the cases in which health data may be stored or transferred outside the UAE, ending a period in which the localisation rule had no formal exceptions.
Emirate regulators
The Dubai Health Authority and Abu Dhabi's Department of Health set their own standards for data, cybersecurity and their exchanges. Abu Dhabi's healthcare information and cyber security standard and Dubai's NABIDH policies add detailed technical and governance requirements for licensed facilities.
Localisation and the permitted exceptions
The default under health data law UAE rules is that health data about services provided in the UAE stays in the UAE. Ministerial Resolution No. 51 of 2021 defines "health services provided within the State" and lists ten cases where storage or transfer outside the UAE may be permitted.
| Permitted case | Key conditions |
|---|---|
| Treatment of the patient abroad | Written consent; access limited to the concerned party; only what is needed; encryption |
| Samples sent to overseas laboratories | Written consent; limited access and data; encryption |
| Scientific research | No identifiable patient data; research use only; encryption and secure transfer |
| Insurance and claims management | Insurer or claims manager operating in the UAE; data stored in the UAE; no identifiable data transferred; consent |
| Organisations cooperating with the UAE | Conditions on consent, identification and encryption; copy kept in the UAE |
| Simple personal medical devices and wearables | Personal-use devices recording simple medical data |
| Drug safety and adverse reactions | Conditions on consent and limitation; copy kept in the UAE |
| Transfers approved by a health entity | Subject to public security, public interest and public health; copy kept in the UAE |
| Telehealth services | Within the scope of the telehealth service |
| Formal request by the patient | Official request by the patient or legal representative; copy and consent records kept in the UAE |
The conditions matter as much as the categories. Several exceptions require written consent, encryption to high standards and that a copy of the data and the consent records stay in the UAE. A global cloud contract that simply mirrors UAE patient records to a foreign region will rarely fit any exception. Our pages on cross-border data transfers and cloud and outsourcing explain how to structure compliant architectures.
The health information exchanges
The ICT Health Law contemplates a central system for collecting and exchanging health data. In practice the UAE runs three linked exchanges: Riayati, the federal platform run by MOHAP; Malaffi, operated for the DOH in Abu Dhabi; and NABIDH in Dubai. Integration between them has been extended in phases, so that clinicians can see records from facilities in other emirates.
For licensed facilities, connecting to the relevant exchange is part of licensing and continuing compliance, as our guide to healthcare licensing in the UAE explains. For vendors, integration with these exchanges requires meeting their technical and security standards.
Compliance programme: step by step
- Map health data flows. Identify what health data you hold, where it is stored and processed, and who can access it, including support teams and vendors abroad.
- Confirm the applicable regimes. Determine whether you are a health facility, insurer, claims manager, e-health provider or vendor, and which emirate regulator and exchange applies.
- Localise or justify. Host health data in the UAE by default, and document the specific exception and conditions relied on for any offshore storage or access.
- Update consent and notices. Obtain written consent where an exception requires it and keep consent records in the UAE.
- Apply security controls. Implement access controls, encryption, logging and incident response in line with federal and emirate standards.
- Set retention schedules. Keep health records for at least 25 years from the last procedure, with secure archiving and controlled destruction after that.
- Review contracts. Put localisation, security, audit and breach-notification terms into vendor, cloud and research agreements.
Remote access is a transfer risk. An overseas IT support team or a group analytics function that can view UAE patient records from abroad may be processing health data outside the UAE even if the servers are in Dubai. Restrict and log foreign access, and document the exception relied on where access is genuinely needed.
What it means by type of organisation
Hospitals and clinics. For licensed facilities, health data law UAE obligations sit alongside licensing conditions. Expect regulators to look at exchange connectivity, access controls, record retention and the location of electronic medical record systems during inspections. Clinical and IT teams need shared ownership of compliance.
Insurers and third-party administrators. Insurers and claims managers can receive health data to verify entitlements, but the insurance exception requires them to operate in the UAE, keep the data in the UAE and avoid transferring identifiable data abroad. Group reinsurance and actuarial work should use anonymised data where possible. Our page on insurance and reinsurance covers the wider regulatory picture.
Health-tech and software vendors. Vendors that host or process health data for UAE providers are within the law's reach as concerned entities. Product design should assume UAE hosting, role-based access and audit logs from the start, rather than retrofitting them after a customer's due diligence.
Pharmaceutical and research organisations. Research and pharmacovigilance have their own exceptions, but each depends on anonymisation, consent or keeping a copy in the UAE. Clinical trial sponsors should build health data law UAE requirements into protocols, site agreements and data management plans.
Employers. Employers that hold occupational health records or medical fitness results should treat them with health-data level care. Limit access to those who need it and avoid storing such records in global HR systems hosted abroad without analysis.
Across all of these, the common thread is documentation. If a regulator asks where UAE health data is held and on what basis any of it leaves the country, the organisation should be able to answer with a data map, the exception relied on and evidence that the conditions are met. Health data law UAE compliance is ultimately demonstrated on paper.
How the law interacts with the PDPL, DIFC and ADGM
The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) excludes health personal data that has its own legislation regulating its protection and processing. In practice, the ICT Health Law is the primary regime for health data onshore, while the PDPL remains relevant to other personal data a health business holds, such as employee and marketing data. See our guide to the UAE PDPL.
The DIFC and ADGM have their own data protection laws, which treat health data as a special category requiring additional safeguards. Because the ICT Health Law applies throughout the UAE including free zones, a business in either centre that handles health data about services provided in the UAE should consider both regimes. Our pages on DIFC data protection and ADGM data protection explain those regimes.
Illustrative scenario: a telehealth platform expands to the UAE
This scenario is illustrative only and uses generic facts.
A telehealth company based in Singapore plans to serve UAE patients through UAE-licensed doctors. Its platform stores all records in a single overseas cloud region, and its engineering team works from abroad.
Under health data law UAE rules, it moves UAE patient records to an in-country cloud region, restricts and logs foreign engineering access, and documents the telehealth exception for the limited data flows that remain. It obtains written consent where required, sets a 25-year retention schedule and connects its UAE partner clinics to the relevant exchange. Its telemedicine licensing and data compliance now run as one project.
Risks and common mistakes
Treating health data like ordinary personal data
Businesses that build a PDPL or GDPR programme often assume it covers health data. It does not fully: the ICT Health Law imposes localisation, long retention and exchange obligations that general data protection laws do not. Because the PDPL excludes health data covered by its own legislation, relying on PDPL transfer mechanisms such as adequacy or contractual safeguards will not by itself legitimise a health data transfer. Map health data separately and apply the health-specific rules.
Using global cloud and analytics by default
Group-wide platforms often replicate data across regions for resilience or analytics. For UAE health data, that replication can breach the localisation rule unless an exception and its conditions are met. Review cloud configurations, backup locations and analytics pipelines, and use anonymised or aggregated data for group reporting where possible. Contract terms should prohibit vendors from moving data offshore without approval.
Weak access controls and breach response
Health data is a prime target for attackers, and major leaks have been reported in the UAE. The ICT Health Law requires appropriate security measures, and emirate regulators set detailed cybersecurity standards. Weak access controls, shared accounts and missing logs are common findings. Prepare an incident response plan that covers regulator notification and patient communication; our page on data breach response sets out the essentials.
Destroying records too early
The 25-year retention period is far longer than many organisations' default policies, and it runs from the last procedure, not from the first visit. Facilities that close, merge or change systems must plan how records will be kept and accessed for the full period. Medical records are also central evidence in malpractice cases, as our article on medical malpractice in the UAE explains.
Cross-border angle
Groups headquartered in the UK, Singapore, India or Bangladesh often run shared services for HR, IT and analytics from home. For UAE health data, those models need adapting: either the service runs on UAE-hosted systems with tightly controlled remote access, or the data shared abroad is anonymised. TRW & Co's offices in Dhaka, London and Singapore can help align group policies with the UAE position.
Checklist: what to do next
- Map health data flows, including remote access from abroad.
- Confirm which regulator, exchange and data protection regimes apply.
- Host UAE health data in the UAE and document any exception relied on.
- Review consent forms, retention schedules and vendor contracts.
- Test security controls and breach response against federal and emirate standards.
For help with a health data law UAE review, cloud migration or cross-border transfer analysis, contact TRW & Co at info@trw.co or +971 58 942 1012, Dubai, United Arab Emirates.
Frequently asked questions
01Can health data be stored outside the UAE?
Only in permitted cases. The ICT Health Law prohibits storing, processing, generating or transferring health data about services provided in the UAE outside the country except as permitted by the health authorities. Ministerial Resolution No. 51 of 2021 lists ten cases, including overseas treatment, overseas laboratories, research, insurance, telehealth and formal patient requests, each subject to conditions such as consent, encryption and keeping a copy in the UAE.
02Does the UAE PDPL apply to health data?
The federal Personal Data Protection Law excludes health personal data that has its own legislation regulating its protection and processing. The ICT Health Law is therefore the main regime for health data onshore. The PDPL still applies to other personal data a health business processes, such as employee, supplier and marketing data, and the DIFC and ADGM have their own data protection laws that treat health data as a special category.
03How long must medical records be kept in the UAE?
The ICT Health Law requires health data and information to be kept for at least 25 years from the date of the last procedure. That period runs from the last treatment, not the first visit, so records for long-term patients may need to be kept for decades. Facilities should plan for retention through system changes, mergers and closures.
04Who does the UAE health data law apply to?
It applies to any entity in the UAE, including in free zones, that provides health services, health insurance, claims management or electronic health services, or is otherwise connected with applying the law. That covers hospitals, clinics, pharmacies, laboratories, insurers, third-party administrators, telehealth platforms and technology vendors that process health data for them.
05Can patient data be shared without consent?
Only in defined cases. The ICT Health Law permits use or disclosure without consent for scientific research without disclosing identity, to allow insurers and payers to verify entitlements, on a request from a competent judicial authority, on a request from the health authority for public health purposes including inspections, and for public health prevention and treatment. Otherwise, consent is required.
06What are Riayati, Malaffi and NABIDH?
They are the UAE's health information exchanges. Riayati is the federal platform run by MOHAP, Malaffi is Abu Dhabi's exchange operated for the Department of Health and NABIDH is Dubai's exchange. They have been progressively integrated so clinicians can access records from facilities in other emirates. Licensed facilities are expected to connect to the relevant exchange.
Sources and official materials
- Ministry of Health and Prevention — Federal health regulator and Riayati platform
- Dubai Health Authority — Dubai health regulator and NABIDH exchange
- Department of Health Abu Dhabi — Abu Dhabi health regulator and Malaffi exchange
- Health and fitness (u.ae) — Federal government information on health services
- Malaffi, Riayati and NABIDH integration (Aletihad) — Integration of the health information exchanges
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
