When health tech companies plan a UAE launch, the conversation usually starts with the federal Personal Data Protection Law, which I covered in UAE PDPL and AI architecture. For health data there is a more specific and stricter rule: the federal law on the use of information and communications technology in health fields, Federal Law No. 2 of 2019. Its localisation requirement is the one that most often changes an architecture.
As always, this is an architect's reading. Confirm the current position and any emirate-level rules with UAE counsel.
The core rule
Article 13 of the law provides that health data relating to health services provided in the UAE cannot be stored, processed, generated or transferred outside the country, unless permitted, such as by a resolution of a health authority in coordination with the Ministry of Health and Prevention14.
In 2021 the Ministry issued a resolution setting out exceptions. Commentary describes ten circumstances, including pharmacovigilance reporting, scientific research, insurance claims administration, and processing in the context of wearables and health monitoring devices23. Qualifying is not automatic: each exception carries conditions that organisations must be able to meet2.
Treat in-country as the default and every cross-border flow as an exception that needs a named legal basis and evidence that its conditions are met.
Where AI and cloud designs trip up
| Component | The localisation question |
|---|---|
| Primary database and backups | Are both in a UAE region, including disaster recovery copies? |
| Model inference | Does any prompt containing health data reach a model hosted abroad? |
| Embeddings and vector store | Are embeddings of clinical text created and stored in the UAE? |
| Logs, traces and analytics | Do prompts, responses or identifiers land in a foreign observability tool? |
| Support and engineering access | Can staff abroad view production health data? |
| Wearables and devices | Which exception applies, and are its conditions met? |
The same hidden-transfer problem I described for Saudi PDPL and cross-border AI applies here, with less room for manoeuvre because the default is stricter.
The architecture I use
- A UAE data plane. Databases, object storage, backups, vector stores and analytics in UAE cloud regions or on-premises, with infrastructure policies that block resources elsewhere.
- In-country inference for anything touching health data: private models or in-region managed services, following the options in where to run models in the UAE.
- A gateway that enforces it, redacting or blocking health data before any call to services outside the country.
- Local observability, with a regional OpenTelemetry gateway as in Collector deployment patterns, and metadata-only export if anything must leave.
- Access controls by location for support and engineering, with break-glass procedures and logging.
- A register of exceptions, mapping any permitted transfer to the specific exception, its conditions and the evidence.
A regional platform
For companies serving several Gulf markets, I design one platform with a data plane per jurisdiction and a shared control plane that never touches patient data. It costs more than a single region, but it is far cheaper than re-platforming after a regulator or a hospital client asks where their data lives.
How I can help
I design health data and AI platforms for the UAE and wider Gulf with residency built in from the start. See my UAE practice and healthcare data architecture, or analyse your challenge and bring the result to a call.
- 1Health data transfers outside the UAEAl Tamimi & Company · 29 Jun 2021
- 2Setting healthy boundaries: regulated exemptions to restrictions on the transfer of health data outside of the UAEAl Tamimi & Company · Jan 2022
- 3UAE health data law: permitted transfers of health dataBaker McKenzie · 2021
- 4Healthcare data protection in the UAEPwC Middle East