Regulation hub
Run UAE Health ICT Law on one record, across every suite
The UAE's federal law on information and communications technology in health. It applies to anyone in the UAE who provides health services, health insurance or electronic health services, and it keeps health data on patients treated in the UAE inside the country unless an exception is made. Pritect maps the articles that bind those entities to the suites that carry them.
- Instrument
- Federal Law No. (2) of 2019
- Version
- Active
- In force
- See commencement
UAE Health ICT Law
Federal Law No. (2) of 2019
Ready
Data protection
Draft5 obligations mapped
Records of processing, consent, rights requests and impact assessments
- Art. 12
- Art. 13
- Art. 15
- Art. 16
- Art. 20
Cybersecurity
Draft3 obligations mapped
Security controls and the evidence behind them
- Art. 4
- Art. 8
- Art. 14
UAE Health ICT Law is now mapped across 2 suites. Each mapping waits for your Data Protection Officer to confirm it.
01 · Article to module
Every obligation lands in a suite.
The law has 31 articles. This page maps the 8 that place an obligation on the entities that handle health data to the Pritect suite that carries each one. Articles 1 to 3 (definitions, scope and objectives), Articles 5 to 7 and Articles 9 to 11 (the central system and the roles of the Ministry and the health authorities), Articles 17 to 19 and Article 21 (health advertising, training and the ID number) and Articles 22 to 31 (penalties, sanctions and final provisions) are not mapped, because they set the frame or bind an authority rather than the entities that evidence compliance.
Headings are quoted from the official English translation published by the UAE Legislation portal. The Arabic text is the authentic law and prevails in case of conflict. Read the official text
Security and access to health systems
Art. 4, 8 and 14
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 4 | Obligations of using the information and communication technology | Cybersecurity |
| Art. 8 | Obligations of using the central system | Cybersecurity |
| Art. 14 | Prohibitions of using the central system | Cybersecurity |
Where health data is stored
Art. 12 to 13
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 12 | Storing the health data and information inside State | Data protection |
| Art. 13 | Storing and transforming the health data and information outside State | Data protection |
Use, confidentiality and retention
Art. 15, 16 and 20
| Article | Heading | Pritect suite |
|---|---|---|
| Art. 15 | Obligations of using the central system | Data protection |
| Art. 16 | Confidentiality of the patient information and exception therefrom | Data protection |
| Art. 20 | Keeping the health data and information | Data protection |
02 · Timeline
When it applies.
Law issued
6 Feb 2019
Attestation after Art. 31
Executive Regulation issued
22 Apr 2020
Cabinet Resolution No. (32) of 2020
The law states no calendar date for coming into force. Under Article 31 it applies three months after it is published in the Official Gazette, and the Executive Regulation applies six months after its own publication. The UAE Legislation portal lists both effective dates in its metadata.
03 · Overlaps
One record answers several laws.
Where UAE Health ICT Law and its neighbours cover the same ground, Pritect keeps one record and maps every law to it. The grouping is ours, for navigation, and is not a statement that the provisions are legally equivalent.
| Obligation | UAE Health ICT Law | UAE PDPL | ADHICS | GDPR |
|---|---|---|---|---|
| Processing principles | Art. 15 | Art. 5 | DP 1 | Art. 5 |
| Lawful basis | Not tracked | Art. 4 | Not tracked | Art. 6, Art. 9 |
| Consent | Art. 16 | Art. 6 | Not tracked | Art. 7 to 8 |
| Data subject rights | Not tracked | Art. 13 to 19 | DP 3 | Art. 12 to 22 |
| Records of processing | Not tracked | Not tracked | Not tracked | Art. 30 |
| Security of processing | Art. 4, Art. 8, Art. 14 | Art. 20 | A 5, HR 1 to 4, AM 1 to 5, PE 1 to 3, AC 1 to 6, +4 | Art. 32 |
| Breach notification | Not tracked | Art. 9 | IM 1 to 3 | Art. 33 to 34 |
| Impact assessment | Not tracked | Art. 21 | Not tracked | Art. 35 to 36 |
| Data protection officer | Not tracked | Art. 10 to 12 | DP 2 | Art. 37 to 39 |
| Processors | Not tracked | Art. 8 | TP 1 to 2 | Art. 28 to 29 |
| Cross-border transfers | Art. 13 | Art. 22 to 23 | Not tracked | Art. 44 to 49 |
04 · Questions
What teams ask first.
Does Pritect decide whether this law applies to us?
No. Art. 1 and 2 define who it reaches, and your counsel should read them against your operations. The law applies across the UAE, including the free zones. Pritect records the answer once, on the entity and its processing activities, so every later assessment uses it.
What does Article 13 require?
Art. 13, Storing and transforming the health data and information outside State, prohibits storing, processing, generating or transferring health data related to health services provided in the UAE outside the country, unless a resolution allows it. Pritect records where each processing activity and supplier stores and processes health data, so a transfer outside the UAE is visible and its basis is documented once.
Where does Pritect host the UAE edition?
The UAE edition at pritect.ae runs on Microsoft Azure in the UAE North region, and its sub-processors are listed on the UAE trust page. Whether a given arrangement meets Art. 13 is for you, your counsel and the health authority to decide. Pritect does not certify it.
How does this relate to ADHICS?
They work at different levels. This federal law sets the rules for health data across the UAE. ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health, sets the security controls for healthcare entities in Abu Dhabi. Pritect carries the ADHICS V2 controls in its catalogue, so the controls you evidence for ADHICS can also stand behind the security articles of this law.
This page summarises publicly available legal text so you can orient yourself. It is not legal advice.