Health data laws compared: HIPAA, GDPR, DPDP, PDPL and the UAE
Who each health data law covers, consent, cross-border transfers, breach reporting and penalties in the US, EU, India, Saudi Arabia and the UAE.
- Global
- US
- EU
- India
- Saudi Arabia
- UAE
Key takeaways
- HIPAA applies to covered entities and business associates; many consumer health apps fall under the FTC instead.
- GDPR and Saudi Arabia's PDPL treat health data as special or sensitive data that needs a stronger legal basis.
- India's DPDP Act protects all personal data alike, with duties applying from 13 May 2027.
- The UAE requires health data to stay in the country by default; the others allow transfers under conditions.
- A product serving several markets should design to the strictest rule for each topic.
How do the main health data laws compare?
| HIPAA (US) | GDPR (EU) | DPDP Act (India) | PDPL (Saudi Arabia) | Health data law (UAE) | |
|---|---|---|---|---|---|
| Who it covers | Providers, plans, clearinghouses and their business associates | Anyone processing personal data of people in the EU | Anyone processing digital personal data in India, or of people in India for offering goods or services | Processing of personal data of people in the Kingdom | ICT use in health fields across the UAE |
| Health data status | Protected health information | Special category (Article 9) | Personal data; no separate category | Sensitive data | Health data |
| Legal basis | Treatment, payment and operations; authorisation otherwise | Explicit consent or another Article 9 condition | Consent with notice, or limited legitimate uses | Explicit consent typically; no legitimate interest | Per law and emirate regulators |
| Cross-border | Allowed with safeguards and contracts | Adequacy or approved safeguards | Allowed except to restricted countries | Adequacy, safeguards or risk assessment | Stays in the UAE by default |
| Applies from | 1996, rules since 2003 | 25 May 2018 | 13 May 2027 for most duties | Enforced since 14 Sep 2024 | 2019 |
What about apps outside HIPAA in the US?
Consumer health apps that are not covered entities are policed by the FTC. Its Health Breach Notification Rule requires notice to users, the FTC and sometimes the media when health data is disclosed without authorisation. State laws such as Washington’s My Health My Data Act add consent requirements for consumer health data.
How should a multi-market product design for all of them?
- Get explicit, specific consent for health data everywhere; it satisfies the strictest regimes.
- Choose hosting per market, with the UAE and often Saudi Arabia in-country.
- Remove identifiers before data reaches AI models or analytics.
- Use one breach playbook that meets the shortest deadline you face.
- Keep a record of processing and a data protection impact assessment per market.
Frequently asked questions
Does HIPAA apply to my wellness app?
Only if you are a covered entity, such as a provider or health plan, or a business associate handling data for one. Many direct-to-consumer apps are not, but the FTC's Health Breach Notification Rule and state privacy laws may still apply.
Which law is strictest?
It depends on the topic. The UAE is strictest on data location, GDPR on legal basis and data subject rights, and HIPAA on specific security and business associate contracts. Design to the strictest rule for each area.
Sources
- HIPAA for professionalsUS Department of Health and Human Services
- Health Breach Notification RuleUS Federal Trade Commission
- General Data Protection Regulation, Article 9EUR-Lex
- Digital Personal Data Protection Rules, 2025Ministry of Electronics and IT, India · 2025-11-13
- Data protection laws of the world: Saudi ArabiaDLA Piper
- New UAE law regulates healthcare dataLatham & Watkins
Found something out of date? Write to contact@brandlabs.app and we will fix it.