United Arab Emirates: Health Data Law - Permitted Transfers of Health Data

In brief

The UAE's Ministry of Health and Prevention (MoHAP) has issued a long awaited resolution setting out exceptions to Article 13 of Federal Law No. 2 of 2019 ("Health Data Law"), which by default prohibits the transfer, storage, generation or processing of health data that relates to health services provided in the UAE ("UAE Health Data") outside of the UAE.

Ministerial Resolution 51/2021 ("Resolution") relaxes the data transfer restriction for certain types of processing operation, and will be welcomed by industry players many of whom have adopted a 'risk-based' approach to cross-border data transfers since the restriction was introduced. 

This alert summarises the exceptions to the Article 13 restriction and identifies certain of the practical challenges that remain to be considered. An interactive reference guide setting out the conditions applicable to each exception is also linked to this alert and can be accessed here.


Contents

Key takeaways

  • The Resolution sets out a list of permitted exceptions to Article 13 of the Health Data Law to permit crossborder transfers and overseas processing of UAE Health Data in 10 separate circumstances, including to support pharmacovigilance reporting, scientific research, the administration of insurance claims and UAE Health Data processing in the context of wearables and healthcare monitoring devices.
  • The Resolution provides much-needed clarity to companies operating within the healthcare and lifesciences sector as well as to companies who provide technology services for the benefit of UAE patients and/or healthcare providers.
  • Ensuring that a processing operation fits within the scope of an exception is only the first step required under the Resolution. Companies wishing to benefit from an exception must go on to ensure that they are able to comply with any associated conditions. The majority of the exceptions are subject to various conditions, some of which will be more challenging than others to implement in practice.
  • Businesses wishing to rely on an exception under the Resolution are advised to work with their IT and product teams to consider the practical as well as the legal implications associated with relying on a particular exception.
  • If none of the scenario specific exceptions are applicable, the Resolution offers companies the option of relying on the formal consent of the concerned person (i.e., data subject) or their representative to permit the export or overseas processing of UAE Health Data. There is currently no guidance on what form this formal request should take.
  • The Resolution has also reconfirmed that the requirements of the Health Data Law only apply to health data that originates from UAE patients and that relates to healthcare services provided in the UAE. Accordingly, the Article 13 restriction will not apply to services provided in the UAE to the extent they involve the processing of data derived from healthcare services provided overseas.
  • MoHAP has set out its expectations when it comes to export and overseas processing of UAE Health Data and so non-compliant processing activities are unlikely to be tolerated any longer. To avoid fines, companies which process UAE Health Data are advised to review their data flows and assess whether the arrangements are compliant or whether changes or additions need to be made.

Click here to access the full article in more detail.

Click here to access the interactive reference guide.
 

For future updates, you can visit and subscribe to our Middle East Insights blog: me-insights.bakermckenzie.com/.

10260

This client alert was issued by BM Habib Al Mulla, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner or equivalent in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.


Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.