Law: Federal Law No. 2 of 2019 (only available in Arabic here) ('the Healthcare Data Protection Law')  and the Health Data Protection Regulation 2013 (DHCC Regulation No. 7 of 2013) ('the DHCC Data Protection Regulation')

Regulator: The Ministry of Health and Prevention ('MOHAP'), the Dubai Healthcare City Authority – Regulatory ('DHCR'), and the Customer Protection Unit at the Center of Healthcare Planning and Quality ('CPQ') at Dubai Healthcare City Free Zone

Summary: The DHCC is an economic free zone within the UAE and is principally comprised of over one hundred medical facilities. While federal civil law does not apply to the DHCC, federal criminal law is applicable.

The Healthcare Data Protection Law regulates the protection of individuals' data within the DHCC and establishes essential concepts such as restrictions on data disclosures and transfers. The Healthcare Data Protection Law is primarily focused on providing safeguards for health data. The Healthcare Data Protection Law followed the DHCC Data Protection Regulation, which established principles with respect to the collection, use, and disclosure of personal data by the DHCA and Licensees of Patient Health Information within DHCC, as well as establishing a complaints mechanism for the investigation of complaints regarding patient health information. In addition, the DHCC Data Protection Regulation establishes the CPQ, which is responsible for the compliance and enforcement of the same.