# Health data laws compared: HIPAA, GDPR, DPDP, PDPL and the UAE

> Who each health data law covers, consent, cross-border transfers, breach reporting and penalties in the US, EU, India, Saudi Arabia and the UAE.

Comparison · Regions: Global, US, EU, India, Saudi Arabia, UAE · By Yash Nerkar (BrandLabs) · Published 2026-11-14 · Reviewed 2026-11-14 · Source: https://www.brandlabs.app/learn/health-data-laws-compared

**TL;DR:** HIPAA covers healthcare providers, plans and their vendors, not every health app. GDPR, Saudi Arabia's PDPL and India's DPDP Act cover anyone processing personal data, and the first two treat health data as a special category. The UAE goes furthest on location, keeping health data in the country by default.

## Key takeaways

- HIPAA applies to covered entities and business associates; many consumer health apps fall under the FTC instead.
- GDPR and Saudi Arabia's PDPL treat health data as special or sensitive data that needs a stronger legal basis.
- India's DPDP Act protects all personal data alike, with duties applying from 13 May 2027.
- The UAE requires health data to stay in the country by default; the others allow transfers under conditions.
- A product serving several markets should design to the strictest rule for each topic.

## How do the main health data laws compare?

| | HIPAA (US) | GDPR (EU) | DPDP Act (India) | PDPL (Saudi Arabia) | Health data law (UAE) |
| --- | --- | --- | --- | --- | --- |
| Who it covers | Providers, plans, clearinghouses and their business associates | Anyone processing personal data of people in the EU | Anyone processing digital personal data in India, or of people in India for offering goods or services | Processing of personal data of people in the Kingdom | ICT use in health fields across the UAE |
| Health data status | Protected health information | Special category (Article 9) | Personal data; no separate category | Sensitive data | Health data |
| Legal basis | Treatment, payment and operations; authorisation otherwise | Explicit consent or another Article 9 condition | Consent with notice, or limited legitimate uses | Explicit consent typically; no legitimate interest | Per law and emirate regulators |
| Cross-border | Allowed with safeguards and contracts | Adequacy or approved safeguards | Allowed except to restricted countries | Adequacy, safeguards or risk assessment | Stays in the UAE by default |
| Applies from | 1996, rules since 2003 | 25 May 2018 | 13 May 2027 for most duties | Enforced since 14 Sep 2024 | 2019 |

## What about apps outside HIPAA in the US?

Consumer health apps that are not covered entities are policed by the FTC. Its Health Breach Notification Rule requires notice to users, the FTC and sometimes the media when health data is disclosed without authorisation. State laws such as Washington's My Health My Data Act add consent requirements for consumer health data.

## How should a multi-market product design for all of them?

1. Get explicit, specific consent for health data everywhere; it satisfies the strictest regimes.
2. Choose hosting per market, with the UAE and often Saudi Arabia in-country.
3. Remove identifiers before data reaches AI models or analytics.
4. Use one breach playbook that meets the shortest deadline you face.
5. Keep a record of processing and a data protection impact assessment per market.

## Frequently asked questions

### Does HIPAA apply to my wellness app?

Only if you are a covered entity, such as a provider or health plan, or a business associate handling data for one. Many direct-to-consumer apps are not, but the FTC's Health Breach Notification Rule and state privacy laws may still apply.

### Which law is strictest?

It depends on the topic. The UAE is strictest on data location, GDPR on legal basis and data subject rights, and HIPAA on specific security and business associate contracts. Design to the strictest rule for each area.

## Where BrandLabs fits

We build one product posture that meets several markets: consent, redaction, regional hosting and breach workflows, tested before launch. https://www.brandlabs.app/services#private-by-design

## Sources

- HIPAA for professionals, US Department of Health and Human Services: https://www.hhs.gov/hipaa/index.html
- Health Breach Notification Rule, US Federal Trade Commission: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule
- General Data Protection Regulation, Article 9, EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj
- Digital Personal Data Protection Rules, 2025, Ministry of Electronics and IT, India, 2025-11-13: https://www.meity.gov.in
- Data protection laws of the world: Saudi Arabia, DLA Piper: https://www.dlapiperdataprotection.com/index.html?c=SA&t=law
- New UAE law regulates healthcare data, Latham & Watkins: https://lw.com/thoughtLeadership/lw-new-uae-law-regulates-healthcare-data