The UAE health data law is the short name many clinics and software vendors use for Federal Law No. 2 of 2019 on the use of information and communication technology (ICT) in health fields. Its best-known rule is Article 13, which restricts storing, processing, generating or transferring health data outside the country unless a resolution allows it. That single article decides where a clinic's patient records may sit, and it matters to any clinic, hospital or software vendor choosing a cloud server. This guide explains the law from the official legislation text read on 11 November 2026, covering scope, the data-location rule, the 25-year retention rule, the penalty and the questions a clinic should put to a software vendor. It is general information, not legal advice, and the Arabic text of the law prevails over the English version.
Key takeaways
- The law applies to all uses of ICT in the health field in the UAE, including the free zones.
- Article 13 says health data related to health services provided inside the UAE may not be stored, processed, generated or transferred outside the UAE, except where a resolution is issued by the health authority in coordination with the Ministry of Health and Prevention.
- Article 20 requires health data kept through ICT to be retained for a period commensurate with need and not less than 25 years from the last health procedure for the person concerned.
- Article 24 sets a penalty of no less than AED 500,000 and no more than AED 700,000 for violating Article 13.
- Clinics should ask every software vendor in writing where patient data is stored, processed and backed up, and which exception, if any, is relied on.
What the UAE health data law covers
Article 2 says the law applies to all methods and uses of information and communication technology in the areas of health in the UAE, including the free zones. The u.ae government portal summarises the same point: the law regulates the use of ICT in the health care sector, including free zones, and lists duties for health providers to keep data confidential, protect it from unauthorised change and keep it available to authorised parties. These duties come from Article 4 of the law. In plain terms, a clinic that records patient information in software is using ICT in the health field, so the law is relevant to the clinic and to the vendor whose system holds the data.
The law defines the circulation of health information broadly. It includes accessing, exchanging, copying, transforming, storing, publishing, disclosing or sending health data. That breadth is why a backup copy in another country, a support engineer abroad who can open records, or an analytics service processing patient data offshore can all raise questions, not only the main database.
Article 13: the data-location rule
Article 13 is titled storing and transforming the health data and information outside the State. It says it is not permissible to store, process, generate or transform health data and information outside the UAE, where they are related to health services provided inside the UAE, except where a resolution is issued by the health authority in coordination with the Ministry. Article 12 separately leaves the terms and controls for storing health data inside the UAE to a resolution of the Minister in coordination with the health authorities.
Two features of the wording matter. First, the rule covers processing and generating data, not only storing it, so a cloud service that is hosted abroad and processes patient data may be caught even if the database itself is local. Second, the exceptions are not written in the article. They come from resolutions. The government's health legislation listing refers to Ministerial Resolution No. 51 of 2021, which concerns the cases in which health data may be stored or transferred outside the UAE. This guide does not summarise that resolution because its text could not be read for it, so a clinic that wants to rely on an exception should read the resolution directly and take advice.
Retention and confidentiality
Article 20 covers keeping health data and information through ICT. The retention period should commensurate with the need for the data, and it must not be less than 25 years from the last date of the health procedure of the person concerned. A clinic therefore needs a system that can keep records, and keep them readable and confidential, for a very long time. Switching software vendors or closing an account must not destroy records the clinic still has to keep. A vendor should be able to explain how data is exported at the end of a contract.
Article 16 deals with confidentiality of patient information. Anyone who circulates information related to patients must keep it confidential and use it only for health purposes unless the patient has given written approval, with listed exceptions. The article lists, for example, requests from health insurance companies or funding authorities to review financial entitlements, and scientific and clinical research where patient identities are not disclosed. Other exceptions exist in the full text, so the article should be read in full before any disclosure policy is written.
The penalty for breaching Article 13
Article 24 says that whoever violates Article 13 is punished by a penalty of no less than AED 500,000 and no more than AED 700,000. That figure is taken from the legislation text on the official UAE legislation portal, read on the date above. Other articles contain disciplinary sanctions, and local health authorities such as those in Dubai and Abu Dhabi may add their own requirements. This guide does not describe those local rules, because they were not read for it.
Questions to ask a software vendor
- Where is patient data stored? Ask for the country and the hosting provider, in writing.
- Where is it processed? Include search, reporting, messaging and any artificial intelligence features, not only the database.
- Where are backups kept? A local database with an offshore backup can still be a transfer.
- Who can access records from abroad? Support staff and developers count.
- Which exception is relied on? If the vendor says data may leave the UAE, ask which resolution or authority decision allows it.
- What happens at the end of the contract? Ask for the export format and the deletion process, remembering the retention rule.
Where CareTrack fits
CreativeIn Tek builds CareTrack, a clinic management system. It runs on a single server region and holds no UAE certification, so it is not offered to UAE licensed clinics at this time, and nothing in this guide should be read as a claim that it meets the rules above. Clinics elsewhere can compare how other markets treat records in the guide to medical record retention for clinics in Pakistan. For software built to a specific hosting requirement, see the healthcare software service.
A practical checklist for UAE clinics
- List every system that holds patient information, including messaging and reporting tools.
- Record the country where each one stores, processes and backs up data.
- Read Article 13 and the relevant resolutions with an adviser before signing any cloud contract.
- Check the retention plan against the 25-year rule in Article 20.
- Review annually, because resolutions and local authority rules can change.
Frequently asked questions
What is the UAE health data law?
It is Federal Law No. 2 of 2019 on the use of information and communication technology in health fields. It applies to all uses of ICT in health in the UAE, including free zones.
Can health data be stored outside the UAE?
Article 13 says it is not permissible to store, process, generate or transfer health data related to services provided inside the UAE outside the country, except where a resolution is issued by the health authority in coordination with the Ministry. A clinic should check the current resolutions with an adviser.
How long must health data be kept?
Article 20 says the retention period must not be less than 25 years from the last health procedure of the person concerned, for data kept through ICT.
What is the penalty for breaching Article 13?
Article 24 sets a penalty of no less than AED 500,000 and no more than AED 700,000.
Does the law apply to free zones?
Yes. Article 2 says the law applies to uses of ICT in health in the UAE, including the free zones.
Last reviewed: 11 November 2026, against the official text of Federal Law No. 2 of 2019 on the UAE legislation portal and the u.ae summary of ICT in the health sector. Laws, resolutions and local authority rules change, and this article is general information and not legal advice. Businesses planning health software for the UAE can talk to CreativeIn Tek.
