Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields

This is a hard localisation rule, not a transfer-mechanism regime, and it is the single most operationally disruptive provision in the UAE for a health or health-adjacent business. Art. 13 prohibits storing, processing, generating or transferring health data relating to health services provided in the UAE outside the UAE, and separately prohibits GENERATING such data outside the UAE — so an offshore analytics pipeline or a foreign cloud region is not cured by contractual safeguards. The only route out is an express approval from the relevant health authority or the Minister, and it remains unclear whether those are granted case by case or by category. Penalties run from AED 500,000 to AED 700,000. Note the scope: the law applies across the whole UAE INCLUDING the free zones, so a DIFC or ADGM entity cannot rely on its free-zone data regime to displace this, and health data is separately carved out of the federal PDPL as sector-regulated. Marked 'check': the primary texts are Arabic-language originals and the approval practice is not publicly documented.