GCC Health Data Sovereignty Compliance: Saudi PDPL, Oman PDPL, and UAE Health Data Residency Requirements

GCC governments are investing heavily in digital health as part of national transformation programmes such as Saudi Vision 2030 and Oman Vision 2040. The same programmes place a premium on national control of sensitive data. For health data, the practical result is a combination of strict consent and permit requirements, restrictions on transfer outside the country, and sector rules that favour in-country hosting.

Any architecture that depends on copying patient records into an external platform, even an anonymised one, will encounter these constraints early. Architectures that leave data where it is and move only queries and aggregate results start from a stronger position.

The Saudi Personal Data Protection Law, issued by Royal Decree M/19 of 2021 and amended in 2023, came into force on 14 September 2023 with a one-year transition period. It is supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). Health data is classed as sensitive data and attracts additional obligations.

Transfers of personal data outside the Kingdom are governed by the Regulation on Personal Data Transfer outside the Kingdom, which permits transfer only on specified grounds such as an adequate level of protection, appropriate safeguards or defined exceptions, and generally requires a risk assessment. Health-sector and government cloud requirements frequently add an expectation that health data is hosted in-Kingdom.

Oman’s Personal Data Protection Law, Royal Decree 6/2022, took effect in February 2023, and its Executive Regulations were issued in 2024 by the Ministry of Transport, Communications and Information Technology, followed by a transition period. The law is notable for requiring a permit from the Ministry before processing certain categories of data, including health, genetic and biometric data.

Controllers must also meet obligations on consent, security, breach notification and cross-border transfer. For health organisations, the permit requirement means that the purposes and safeguards of each processing activity must be defined clearly before processing begins.

Health data in the UAE is governed principally by Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in Health Fields and its implementing regulations. The law requires health data and information relating to health services provided in the State to be stored and processed inside the UAE, subject to exceptions set by ministerial decision.

The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, excludes health personal data that is governed by its own legislation. Emirate-level health authorities, including the Department of Health Abu Dhabi and the Dubai Health Authority, issue their own data and cybersecurity standards, and the DIFC and ADGM free zones operate separate data protection regimes.

Qatar’s Law No. 13 of 2016 on Personal Data Privacy Protection treats health data as personal data of a special nature, which may only be processed with permission from the competent authority and subject to additional safeguards. Bahrain’s Law No. 30 of 2018 on Personal Data Protection likewise classes health data as sensitive and restricts its processing and transfer.

The common thread is that health data should stay under national control, that each use should be tied to a defined, permitted purpose, and that the organisation should be able to prove both. Infrastructure that meets these expectations tends to share several properties.

• In-country deployment: data remains in national infrastructure; analysis is brought to it.
• Purpose-bound access: every query is checked against the patient’s consent and the organisation’s permit or legal basis before it runs.
• Aggregate outputs: only de-identified, disclosure-controlled results leave the environment.
• Evidence by default: a tamper-evident audit trail of consent events and access decisions, available to regulators on request.

Consenta is sovereign data infrastructure. Its federated model runs within the data holder’s environment, its programmable consent engine enforces permissions at the point of use, and its trust layer anchors only cryptographic hashes of consent events, never personal or health data. Consenta is in discussion with health organisations in the Gulf.