# UAE ICT Health Law: UAE Federal Law No. 2 of 2019 on the use of ICT in health fields

> UAE federal rules for health data: confidentiality, retention, data location and the use of technology in healthcare.

URL: https://securei3.com/standards/uae-ict-health-law/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


UAE Federal Law No. 2 of 2019 on the use of information and communications technology in health fields governs how health data is collected, stored, shared and protected across the UAE. It sets confidentiality duties, data location requirements, minimum retention periods and responsibilities for anyone handling health information.

We map your health data and systems, check localisation and retention, put the security and governance controls in place and connect the work with ADHICS in Abu Dhabi, Dubai Health Authority requirements and ISO 27001.

## Who it is for

- Hospitals, clinics, pharmacies and labs in the UAE
- Health insurers and third-party administrators
- Health tech, telemedicine and software providers serving UAE healthcare

## Benefits

- Clarity on where health data can be stored and processed
- Retention and confidentiality rules built into systems
- One programme with ADHICS, ISO 27001 and ISO 27799

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Must health data stay in the UAE?

The law requires health data to be stored and processed inside the UAE, with exceptions set by ministerial decision. We help you map data flows and check whether an exception applies.

### How long must health records be kept?

The law sets a minimum retention period of 25 years from the date of the last procedure. Your systems and contracts need to support this.

Related: https://securei3.com/standards/adhics/, https://securei3.com/standards/uae-pdpl/, https://securei3.com/standards/iso-27799/, https://securei3.com/standards/iso-27001/

Contact: https://securei3.com/contact/: info@securei3.com