# UAE Health Data — The Jurisdiction-Proof Overlay

## ICT Health Law — Federal Law 2/2019 (+ Cabinet Decision 32/2020, Ministerial Resolution 51/2021)

**The rule:** UAE health data may **not be stored, processed, generated, or transferred outside the UAE**, unless an exception is authorized by the relevant health authority and MOHAP. Approved exceptions include specified telemedicine scenarios (MR 51/2021). **Localization violations carry fines of AED 500,000–700,000.**

- Applies to **all entities handling UAE health/patient data — across mainland, DIFC, ADGM, and other zones** (the PDPL's health-data carve-out means this law prevails)
- Covers the full lifecycle: creation, storage, processing, transfer — including creating data abroad for UAE health services
- Health authorities: **MOHAP** (federal), **DHA** (Dubai), **DoH** (Abu Dhabi) — route approvals and reporting to the correct authority

## ADHICS (Abu Dhabi)
Abu Dhabi Healthcare Information and Cyber Security Standard — binds **all DoH-regulated healthcare entities**: governance, asset/access controls, incident reporting to DoH. Treat as the mandatory cyber baseline for Abu Dhabi health providers, on top of the ICT Health Law.

## DHCC (Dubai Healthcare City)
DHCC's **Health Data Protection Regulation (2013)** governs patient health information of DHCC licensees, enforced by the Centre for Healthcare Planning and Quality (CPQ) — a zone-specific privacy regime layered under the federal localization rule.

## Answer pattern for any UAE health-data question
1. State the localization prohibition + fine range up front
2. Identify the health authority (MOHAP/DHA/DoH) and any zone regime (ADHICS, DHCC)
3. Cloud answers: in-country hosting or an authorized exception — never assume offshore is fixable with contracts
4. Non-health personal data of the same organization still follows PDPL/zone DP law — split the analysis