Health Data Protection Rules in the UAE: What Clinics Must Do
Short answer: Health data protection in the UAE is governed mainly by Federal Law No. 2 of 2019 on the use of ICT in health fields and its Executive Regulation, Cabinet Resolution No. 32 of 2020. Clinics must keep patient data confidential, get written consent before using it for anything other than health purposes, store it inside the UAE unless a listed exception applies, and keep records for at least 25 years after the last treatment. Dubai and Abu Dhabi add their own policies on top.
Last verified: October 2026 against Federal Law No. 2 of 2019, Cabinet Resolution No. 32 of 2020, Ministerial Decision No. 51 of 2021 and the DHA health data policies PP-11 and PP-12.
Key Takeaways
- Federal Law No. 2 of 2019 applies across the UAE, including the free zones, to anyone handling health data and information.
- Patient data may only be used for health purposes unless the patient gives written consent, with five exceptions in Article 16, such as insurers verifying a claim.
- Health data about services given in the UAE must be stored and processed inside the UAE; Ministerial Decision No. 51 of 2021 lists the ten cases where it may leave.
- Records must be kept for at least 25 years from the last health procedure, and DHA wants paper files digitised and destroyed only with approval.
- Storing or moving data abroad in breach of the law carries a fine of AED 500,000 to 700,000, and the health authority can also warn, fine, suspend or cancel system access.
Which Rules Apply to Patient Data
Most clinic owners we speak to assume the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, in force since 2 January 2022) is the main rule. For patient records, health data protection in the UAE rests on a health specific rulebook:
- Federal Law No. 2 of 2019 on the use of information and communications technology in health fields, issued in February 2019. Article 2 applies it “in the State, including the free zones”.
- Cabinet Resolution No. 32 of 2020, its Executive Regulation, issued in April 2020. It covers consent, access to the central health system and how data is stored.
- Ministerial Decision No. 51 of 2021, issued by the Minister of Health and Prevention on 28 April 2021, which lists when health data may be stored or transferred outside the UAE.
- Local regulator rules. In Dubai, DHA’s Policy for Data and Health Information Protection and Confidentiality (PP-11, 2022) and Policy for Health Information Assets Management (PP-12, effective 26 March 2023). In Abu Dhabi, DOH’s Healthcare Information and Cyber Security Standard (ADHICS).
The general data protection law still matters. DHA’s PP-11 brings its data subject rights into how Dubai facilities handle health information, and states that where rules overlap, the regulation that is more specialised in health wins. Your staff and job applicant files are ordinary personal data, so do not leave them out of your privacy work.
Consent, Confidentiality and Permitted Sharing
Article 16 of the federal law requires anyone who handles health data to keep it confidential and to use it only for health purposes, unless the patient gives written approval. The Executive Regulation allows that consent to be given on paper or by electronic means. Article 16 then lists five cases where data can be shared without that consent:
- Requests from insurers or other funders of health services, to check and approve what they are paying for.
- Scientific and medical research, provided the patient’s identity is not disclosed and research ethics are followed.
- Preventive or curative public health measures, or protecting the health and safety of the patient or people in contact with them.
- Requests from the competent judicial authorities.
- Requests from the health authority for inspection, supervision and public health protection.
Dubai adds a step for secondary use. Under PP-11 clause 4.3.2, using patient information beyond care, including research, audit, accreditation and marketing, must be justified, recorded and approved through DHA at HISH@dha.gov.ae.
Access is restricted too. The Executive Regulation grants central system access by professional role (Article 4) and requires access to end when a staff member leaves (Article 5). PP-11 asks for confidentiality clauses in all staff contracts and your prior written authorisation before a vendor uses a sub-processor.
Keeping Health Data Inside the UAE
Article 13 of the federal law says health data and information relating to health services provided in the UAE may not be stored, processed, generated or transferred outside the country, except in cases set by a decision of the health authority in coordination with the Ministry. Ministerial Decision No. 51 of 2021 sets out those cases:
| Case | When Data May Leave the UAE |
|---|---|
| 1 | Treatment of the patient abroad, limited to what that treatment needs |
| 2 | Laboratory samples sent for testing abroad |
| 3 | Research approved by the health authority, with data that does not identify the patient |
| 4 | Insurers and claims administrators, with the patient’s consent and strict conditions |
| 5 | Requests from competent international organisations that cooperate with the UAE |
| 6 | Simple personal medical devices, such as blood pressure, blood sugar or oxygen monitors |
| 7 | Data on side effects or adverse effects, under good pharmacovigilance practice |
| 8 | Other health data the health authority approves, if it is not confidential and reveals no medical secret without written consent |
| 9 | Telehealth, with time limited access for the treating doctor and the patient’s written consent |
| 10 | A person’s own request to send or receive their data abroad |
The conditions matter as much as the list. Several cases need written consent and encryption, and for some a copy must stay in the UAE. The insurance case is narrow: the insurer must operate in the UAE and keep the data here, and only the policy number may go abroad. Dubai’s PP-11 also requires encryption in transit.
For your systems, the most practical part of health data protection in the UAE is this: your EMR database, imaging archive and backups should sit on servers inside the UAE. Abu Dhabi facilities should also read ADHICS before choosing any cloud host: the early version of the standard stated that facilities shall not use cloud services to store, process or share health information, so check what the current DOH version allows.
Record Retention and Secure Disposal
Article 20 of the federal law requires health data to be kept for not less than 25 years from the date of the last health procedure. Article 21 requires the patient’s Emirates ID number to be recorded in health transactions, except in emergencies and cases exempted by the Ministry.
Dubai’s PP-12 adds the practical detail:
- As a general rule, health information assets are kept for at least 25 years after the last encounter, and the retention duty continues even if the facility closes or merges. Some record types have their own periods in the policy’s table, for example fertility records at 30 years.
- Paper records are to be digitised, and paper originals destroyed only after digitisation and quality checks are complete.
- Nothing may be destroyed while an investigation, litigation or legal hold is open, and disposal needs proper authorisation from the facility’s executive leader or medical director.
- Paper is shredded or burned, never binned, digital media is destroyed to the ISO 27001 standard, and DHA approval through HISH@dha.gov.ae is needed to destroy or transfer records.
Data Breaches and Penalties
Under PP-11, a Dubai facility must investigate a breach from discovery until closure and report it to DHA at HISH@dha.gov.ae and to the federal office named in the policy, covering what happened, when and how it was found, the cause, the approximate number of people affected and the severity. The policy points to the federal data protection rules for the reporting window. The federal health law and its Executive Regulation do not set an hour deadline. In Abu Dhabi, incident reporting follows ADHICS, so confirm the current timelines with DOH.
The penalties for breaking the rules on health data protection in the UAE are in Articles 22 to 26 of the federal law:
| Article | What It Covers | Penalty |
|---|---|---|
| 24 | Storing, processing or transferring health data outside the UAE in breach of Article 13 | Fine of AED 500,000 to 700,000 |
| 23 | Health advertising through the central system without a licence | Fine of AED 100,000 to 200,000 |
| 25 | Breaches by facilities or authorised users | Written notice, written warning, a fine of AED 1,000 to 1,000,000, suspension of system access for up to six months, or cancellation |
| 26 | Appeal against an Article 25 sanction | Grievance within 15 days of learning of the decision; no reply within 30 days counts as rejection |
Article 22 keeps any more severe penalty under another law, so these are not the only possible consequences.
Frequently Asked Questions.
Can a UAE clinic keep patient records in the cloud?
Only if the data, including backups, stays on servers inside the UAE, because Article 13 of Federal Law No. 2 of 2019 bars storing or processing it abroad outside the listed exceptions. Abu Dhabi facilities should also check what the current DOH ADHICS standard allows before using any cloud service.
How long must a clinic keep medical records in the UAE?
At least 25 years from the date of the last health procedure, under Article 20 of the federal law. In Dubai the duty continues if the clinic closes or merges, and some record types, such as fertility records, have longer periods under DHA’s PP-12.
Do we need patient consent to send claims to insurers?
Not for a UAE insurer checking a claim: Article 16 lets insurers and funders request the data they need to approve and verify what they pay for. Sending data to an insurer abroad is different and needs consent and the strict conditions in Ministerial Decision No. 51 of 2021.
Can a clinic use patient contact details for marketing?
Not without the patient’s written consent, because Article 16 limits patient data to health purposes. In Dubai, marketing is also a secondary use under DHA’s PP-11 and needs DHA approval through HISH@dha.gov.ae.
Where This Comes From.
- Federal Law No. 2 of 2019 on the Use of ICT in Health Fields (MOHAP, English)
- Federal Law No. 2 of 2019, official Arabic text (DHA)
- Cabinet Resolution No. 32 of 2020, Executive Regulation of Federal Law No. 2 of 2019 (MOHAP)
- Ministerial Decision No. 51 of 2021 on storing and transferring medical data outside the State (MOHAP, Arabic)
- DHA Policy for Data and Health Information Protection and Confidentiality (PP-11)
- DHA Policy for Health Information Assets Management (PP-12)
- DOH Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS)
- u.ae: Data protection laws
How OzaniX Partners Can Help.
Health data protection in the UAE touches your EMR contract, your staff contracts, your consent forms and your marketing. Our Technology and IT Support service checks where your systems and backups are hosted, sets up role based access and leaver steps, and reviews vendor and sub-processor terms against the federal law and your regulator’s policy. We do not resell any EMR or cloud vendor. If the work is part of a new licence or an inspection, our Licensing and Regulatory team runs it alongside your application.
Book a Discovery Call