UAE health data law: localisation rules for health tech
Federal Law No. 2 of 2019 keeps UAE health data in the country by default. Here are the exceptions, the penalties and what it means for AI products.
- UAE
Key takeaways
- Federal Law No. 2 of 2019 covers all ICT use in health fields across the UAE, including free zones.
- By default, health data must be stored and processed inside the UAE.
- Ministerial Resolution No. 51 of 2021 lists exceptions, such as sending samples' data to overseas laboratories, each with conditions.
- Breaching the localisation rule carries a fine of AED 500,000 to AED 700,000.
What does the UAE health data law require?
Federal Law No. 2 of 2019 regulates how information and communications technology is used in health fields across the UAE, including free zones. Its central rule is localisation: health data and information must be stored and processed inside the UAE, unless a health authority or the Minister approves otherwise.
What are the exceptions?
The law left exceptions to later regulation. Ministerial Resolution No. 51 of 2021 lists permitted cases, for example data relating to samples sent to laboratories outside the UAE. Each exception comes with conditions, and transfers under them remain tightly controlled.
What are the penalties?
Breaching the localisation requirement in Article 13 carries a fine of AED 500,000 to AED 700,000, roughly $136,000 to $190,000.
How do Abu Dhabi and Dubai fit in?
The Department of Health in Abu Dhabi and the Dubai Health Authority set their own policies for health information, cloud use and AI on top of federal law. Licensed providers in each emirate must follow their regulator’s standards.
What does this mean for health AI products?
| Approach | Fits the localisation rule? |
|---|---|
| Identifiable health data sent to a foreign AI API | Generally no, unless an exception or approval applies |
| Model hosted in a UAE cloud region | Yes, subject to emirate rules |
| Identifiers removed in the UAE, then only de-identified text processed abroad | Often workable; confirm with counsel |
Plan hosting before you build, because moving data later is expensive.
Frequently asked questions
Can a UAE health app use a US-hosted AI model?
Sending identifiable health data to a model hosted abroad conflicts with the default localisation rule unless an exception or approval applies. Common approaches are UAE-hosted models, or removing identifiers in the UAE before any data leaves.
Does the federal PDPL also apply?
The federal data protection law excludes health data that is covered by its own legislation, so the 2019 health data law is the main reference for health information. Emirate health authorities in Abu Dhabi and Dubai add their own policies.
Sources
- New UAE law regulates healthcare dataLatham & Watkins
- Setting healthy boundaries: regulated exemptions to restrictions on the transfer of health data outside of the UAEAl Tamimi & Company · 2022-01
- Healthcare data protection in the UAEPwC Middle East
Found something out of date? Write to contact@brandlabs.app and we will fix it.