Use of the Human Genome in the UAE: Consent, Genetic Data, Research, and Prohibited Practices

Use of the Human Genome in the UAE: Consent, Genetic Data, Research, and Prohibited Practices

Genetic information can reveal present health conditions, future risks, family relationships and characteristics shared across relatives. A genomic testing service is therefore not an ordinary laboratory service. In the UAE, the use of human genes, genomes, biological samples and genomic or genetic data is regulated through a specific federal framework that combines consent, specialist supervision, licensing, confidentiality, research controls and restrictions on discrimination and human enhancement.

Federal Law by Decree No. 49 of 2023 Regulating the Use of the Human Genome is the central statute. It addresses genomic screening, genetic screening, scanning, informed consent, biological samples, gene therapy, scientific and clinical research, genetic data, a National Genomic Database, licensed facilities and prohibited uses. It should be read together with health-facility licensing rules, research and clinical-study requirements, data-protection obligations and decisions issued by the Ministry of Health and Prevention or the competent health authority.

Consent is not a signature added after a sample is taken. Under the UAE human-genome framework, the person must understand the purpose and potential effects of the screening or scanning, and a new consent analysis may be required if the sample or data will be used for an additional purpose.

This article explains the compliance framework for healthcare providers, laboratories, researchers, universities, technology businesses, employers and investors considering genomic services in the UAE. It is general legal information, not a clinical recommendation or advice on a particular consent form, research protocol, patient or data transfer.

1. What does the UAE regulate?

The law regulates more than the final laboratory report. The regulated chain may include:

• genomic screening and genetic screening;
• genomic and genetic scanning, including population or public-health programmes;
• collection, coding, analysis, storage, preservation, transfer and destruction of biological samples;
• genomic and genetic data, reports, results, statistics and information;
• gene therapy and the products, specialists and laboratories used to provide it;
• scientific or clinical research involving human genes, genomes or their applications; and
• facilities and advertising for human-genome or gene-related services.

In practical terms, a provider should map the complete data-and-sample lifecycle: who orders the test, who gives consent, who collects the sample, which laboratory analyses it, where the sample and results are stored, who can access them, whether they are reused, whether they leave the UAE, and how they are destroyed or retained.

2. The principal legal framework

The main source is Federal Law by Decree No. 49 of 2023 Regulating the Use of the Human Genome. The Ministry of Health and Prevention also publishes the law and related regulatory material through its legislation portal.

The framework interacts with:

• health-authority licensing rules for hospitals, laboratories, clinics, biobanks and specialist services;
• laws and approval procedures governing scientific and clinical studies;
• privacy and personal-data rules, including secure processing and lawful disclosure;
• professional licensing for physicians, laboratory personnel and genetic counsellors; and
• separate rules for forensic DNA databases, which should not be confused with clinical or research genomic datasets.

The exact authority depends on the emirate and the service. A business should confirm whether approval is required from MoHAP, the Department of Health–Abu Dhabi, Dubai Health, another local health authority or more than one regulator.

3. Screening, scanning and the consent threshold

Voluntary screening and scanning

The law generally requires consent before a person is subjected to voluntary genomic screening, genetic screening or scanning. Consent must come from the person or, where the person is incapacitated or legally incompetent, the legal representative. The statute also recognises limited mandatory scanning situations established by the competent authority—for example, where public-health protection or the diagnosis of environmental effects on genes or the genome requires it.

A provider should never describe a voluntary consumer test as “routine” in a way that obscures the genetic nature of the service. Marketing, intake forms, the clinician’s explanation and the laboratory workflow should all identify the test’s purpose and limits.

What informed consent must contain

Article 6 requires the participant or legal representative to receive the data related to the screening or scanning and to understand its purpose and potential effects. The approval must be written, explicit and given on the form approved by the health authority.

A robust consent file should therefore record, in language the participant can understand:

• what is being tested and what is outside the test’s scope;
• the clinical, preventive, public-health or research purpose;
• possible physical, psychological, social and family implications;
• the type of result that may be produced and its limitations;
• who will receive the result and who may access the underlying data;
• how the sample and data will be stored, retained, transferred or destroyed;
• whether the sample or data may be used for a later or additional purpose;
• the identity of any research sponsor, laboratory or technology provider; and
• the contact point for questions, complaints and clinically significant findings.

A checkbox buried in general clinic terms is a weak control. The consent should be specific enough to show that the person agreed to the relevant genomic activity, not merely to “all medical procedures.”

Genetic counselling before a sample

Before a biological sample is taken, the law requires a specialist physician or genomics specialist to provide genetic counselling or a general explanation. The explanation should cover the purpose and uses of the screening or scanning, negative physical or psychological effects, risks, periodicity and other relevant matters.

The provider should retain evidence of who delivered the counselling, their licence or role, the information supplied, the participant’s questions, the decision made and the time between counselling and collection. For children or adults who cannot provide valid consent, verify the legal representative’s authority and record why the representative is authorised to act.

4. Biological sample controls

Genomic compliance continues after consent. The sample itself must be handled through a controlled process that protects identity, integrity, confidentiality and traceability.

Collection, coding and analysis

Samples should be collected at facilities, public places or other locations designated or approved by the health authority. Coding is a key safeguard: the sample should be linked to a controlled identifier rather than displayed with unnecessary personal details.

Analysis should be limited to the genetic areas targeted by the approved screening or scanning and should follow medical principles and standards. A laboratory should not expand a test to unrelated genetic areas simply because the technology makes additional analysis possible.

Analysis must be carried out by laboratories accredited or licensed by the health authority and equipped for the relevant work. The laboratory’s scope, method validation, quality controls, reporting pathway and incident escalation should be documented.

Existing data and duplicate sampling

The framework contemplates a National Genomic Database. If a person’s relevant genomic data is already available in that database, the law restricts unnecessary repetition of the sampling procedure. A provider should verify whether an authorised database lookup is available before collecting a new sample, while respecting access controls and the purpose limitation of the programme.

Additional use of a sample

If the provider wants to use a collected biological sample for an additional purpose, written consent must be obtained again from the person or legal representative, and the person has a right to reject that additional use. This is especially important for:

• future research not described in the original consent;
• commercial product development or algorithm training;
• sharing with a different laboratory, sponsor or university;
• family studies or population comparisons; and
• new analyses made possible by a later technology.

“Consent to testing” and “consent to indefinite future research” should not be treated as identical. The sponsor should document whether the original wording clearly covers the new use or whether fresh consent and approval are required.

Transfer, storage and destruction

Transfer, circulation, preservation and destruction of biological samples and residual material must occur within the UAE according to controls set by the minister or health-authority head, with biobank requirements taken into account. A biological sample may not be transferred or stored outside the UAE except in cases determined by the health authority or after its approval of the justification.

A compliant chain-of-custody record should show collection, receipt, access, analysis, storage location, transfer approvals, return or destruction date and the responsible person. Sending a sample to an overseas laboratory should be treated as a regulatory event, not merely a courier arrangement.

5. Genetic and genomic data

Confidentiality

Article 25 requires all genomic and genetic data in the UAE to be kept completely confidential and prohibits circulation or disclosure except where permitted by applicable legislation. Confidentiality covers more than the final report. It may include raw sequence data, variant files, family information, genetic counselling notes, sample identifiers, algorithms, research datasets, statistics and the fact that a person underwent a test.

Technical and organisational controls should include:

• role-based access and strong authentication;
• separate keys for identity data and genomic data;
• encryption in transit and at rest;
• audit logs showing access, export and deletion;
• vendor and cloud contracts with confidentiality and incident obligations;
• segregation of clinical, research and commercial datasets;
• controlled retention and destruction schedules; and
• an incident-response process that can identify affected samples and people.

National Genomic Database

The law provides for a National Genomic Database in which genomic and genetic data and information are stored in the State. Cabinet controls determine its establishment, data sources, registration, preservation, management, use, exchange and links with relevant health, research and private databases. Parties organising or conducting genomic screening, genetic screening or scanning may have obligations to provide relevant data for storage in that database.

Providers should not promise a participant that data will never be included in a national system if the law or an authorised programme requires submission. The consent and information materials should distinguish voluntary choices from mandatory legal or public-health requirements and explain the applicable authority and purpose.

Non-discrimination

Genomic or genetic data may not be used in a way that leads to discrimination between members of the community because of genetic traits, ethnic origin or lineage, resulting in a limitation of rights granted under UAE law. This requires a careful review of intended users and decision rules, especially where data is shared with employers, insurers, schools, lenders, platforms or marketing teams.

Compliance is not achieved merely by removing a person’s name. A dataset can still expose lineage, a rare condition or a small family group. De-identification, aggregation and access controls should be assessed against the actual risk of re-identification.

6. Research and clinical studies

Scientific or clinical research involving human genes, genomes or their applications is permitted only within the controls of the human-genome law and the legislation governing scientific and clinical studies in the UAE. MoHAP’s health-research support service states that competent-authority approvals must be obtained before research is conducted and that a data-confidentiality form is required when requesting statistical data.

Permitted research objectives

The law identifies legitimate objectives such as understanding the structure and function of the human body, understanding diseases affecting humans and promoting public health. A research protocol should connect each genomic collection and analysis to a defined objective, explain the scientific necessity, identify the minimum data and samples required, and state how results will be protected.

Research approval file

A sponsor, university or laboratory should be able to produce:

• the protocol and scientific justification;
• institutional and health-authority approvals;
• participant information sheet and consent form;
• legal-representative process for incapacitated participants;
• sample and data-flow map, including any cross-border element;
• risk assessment for physical, psychological and family implications;
• data-management and access plan;
• secondary-use and publication approval process;
• adverse-event, breach and withdrawal procedures; and
• destruction, retention and audit evidence.

Research consent does not automatically authorise commercialisation, unrelated future studies or disclosure of identifiable results. The sponsor should define the boundaries at the outset and re-consent where the additional use is material.

Publication of UAE Genome Programme data

Research or studies containing data, information or statistics related to the UAE Genome Programme may not be published without approval from the minister or the head of the health authority in accordance with Cabinet controls. Publication review should occur before a manuscript, conference poster, dataset, press release or investor presentation is released.

7. Gene therapy

The law permits human genes or genomes to be used for gene therapy only within detailed controls. The treatment must be based on approval from a health-authority-licensed specialist physician and relate to diseases identified through the applicable specialist-committee process. It must not cause more harm than the existing condition, must pursue recovery or pain relief without immediate or future harm, and must address a specific disease or prevention objective.

Other controls include:

• the absence of an equally effective and efficient therapeutic alternative;
• no acquisition of traits unrelated to the therapeutic purpose;
• consent of the person or legal representative on the health-authority form;
• treatment by licensed specialists;
• use of a facility with a licensed laboratory meeting genetic-analysis requirements; and
• use of licensed gene-therapy products under applicable legislation.

A clinic should not market an experimental enhancement product as gene therapy merely because it uses genetic terminology. The clinical indication, product status, specialist approval, facility licence, consent and risk-benefit analysis must align.

8. Prohibited and high-risk practices

Human cloning and impermissible trait modification

Human genes and genomes may not be used with the intention of altering the genomic structure of people to improve lineage, purify the human race or pursue another use inconsistent with the law. The exception is treatment or prevention of disease under the gene-therapy controls.

Research or clinical studies may not involve human cloning, modifying human traits of persons or embryos for purposes contrary to the law, or creating a risk of genetically modified biological organisms that threaten humans or the environment.

Consentless voluntary screening

Subjecting a person to voluntary genomic or genetic screening or scanning without the required consent can trigger a fine. This includes pressure disguised as a workplace, school, insurance or family requirement where no valid mandatory legal basis applies.

Unlicensed facilities and advertising

A facility may not provide human-genome or gene services—including research, biological-sample analysis, sample storage or preservation, sample or data transfer, and related data services—without the health-authority licence. Advertising those services through visual, written, audio or social-media channels also requires the relevant licensing approval.

Unauthorised disclosure and discrimination

Uploading a genomic report to an unapproved analytics platform, sharing a family dataset with a sponsor without authority, or using a genetic trait to limit a person’s legal rights can create separate confidentiality and discrimination exposure. A commercial objective does not override the statutory restrictions.

9. Penalties and enforcement risk

The law contains offence-specific penalties in addition to licensing and administrative measures. The exact outcome depends on the provision breached, the facts, the responsible person and any other applicable law. The published law provides, among other consequences:

Conduct	Published penalty framework	Control response
Subjecting a person to voluntary genomic or genetic screening or scanning without consent	Fine of AED 10,000–100,000.	Stop the process, preserve the consent evidence and investigate the collection chain.
Taking, analysing, storing, circulating, transporting or destroying a sample contrary to the sample controls	Imprisonment and/or AED 50,000–200,000, depending on the applicable provision.	Secure the sample, freeze unauthorised transfers and notify the responsible authority where required.
Breaching genomic-data confidentiality	Imprisonment and/or a fine within the ranges specified for the relevant Article 25 breach.	Activate the data-incident plan and restrict further access or disclosure.
Using data to discriminate because of genetic traits, ethnic origin or lineage	Imprisonment and/or AED 20,000–500,000 under the published penalty framework.	Stop the decision rule, preserve logs and conduct a rights-impact review.
Prohibited human-genome research or publication involving UAE Genome Programme data without approval	Imprisonment and/or AED 100,000–300,000 under the applicable offence provision.	Withdraw or suspend the publication and seek specialist regulatory advice.
Operating a private facility providing human-genome or gene services without a licence	At least six months’ imprisonment and/or AED 100,000–1,000,000; legal persons may face AED 2,000,000–10,000,000 and closure or dissolution measures.	Stop the unlicensed service and secure patient, sample and data records.

Administrative penalties, confiscation, closure, deportation consequences for a convicted foreign national and other measures may also apply under the law or related legislation. The company should not assume that a fine resolves the underlying licensing, patient-safety or data-protection problem.

10. Practical compliance programme

For a clinic or laboratory

1. Confirm the facility and professional licences before accepting samples or advertising.
2. Use the health-authority consent form and a separate information sheet where needed.
3. Document genetic counselling or the required explanation before collection.
4. Use coded identifiers and a validated sample chain of custody.
5. Limit analysis to the approved genetic areas and purpose.
6. Verify the receiving laboratory’s accreditation or licence.
7. Obtain fresh consent for additional sample or data uses.
8. Keep cross-border transfers inside the health-authority approval process.
9. Restrict access to reports, raw data and family information.
10. Maintain a destruction, retention and incident register.

For a university or research sponsor

• Obtain all competent-authority and ethics approvals before recruitment.
• Separate clinical care consent from research consent.
• State whether samples are coded, identifiable or linked to a national programme.
• Define secondary use, commercialisation and publication controls.
• Use data-confidentiality commitments for statistical or research data requests.
• Document withdrawal, destruction and inability-to-withdraw limits where analysis is irreversible.
• Review every external vendor, cloud host, sequencing laboratory and sponsor access path.

For an employer, insurer or technology business

Do not collect or request genetic data merely because it might improve a risk score or recruitment decision. Identify the legal basis, purpose, authority, necessity and non-discrimination safeguards first. A de-identified dataset may still carry family, lineage or rare-condition risks. Any proposed use that could affect a person’s rights requires a specialised legal and technical assessment.

11. Practical examples

Example 1: Direct-to-consumer test sold online

A website sells a “complete DNA health profile” and sends saliva kits to UAE customers. Before launch, the business must confirm the responsible health authority, facility licence, approved collection and laboratory arrangements, consent form, advertising approval, data storage location and any overseas laboratory transfer. A disclaimer that the service is “for information only” does not cure an unlicensed operation.

Example 2: Researcher wants to reuse stored samples

A university has consented samples for a diabetes study and later wants to analyse ancestry markers for a separate project. The original consent and approval should be reviewed. If the proposed use is an additional purpose, fresh written consent and research approval may be required, and the participant must be able to reject the additional use.

Example 3: Employer requests applicants’ genetic results

An employer asks shortlisted candidates to provide genetic reports to assess future absence risk. This creates a serious confidentiality and discrimination risk. The employer should not collect the data without a clearly lawful, necessary and regulator-approved basis, and should obtain specialist advice before any decision is made.

Example 4: Overseas sequencing provider

A local clinic uses an overseas laboratory because it is cheaper. The clinic must first determine whether sample or data transfer outside the UAE is legally permitted and obtain the required health-authority approval. The courier contract alone is not sufficient.

Example 5: UAE Genome Programme publication

A research team prepares a paper containing programme statistics and believes that aggregated numbers are automatically safe. The team should obtain the approval required for publication before submitting the paper, poster, dataset or press release.

Example 6: “Wellness” gene-editing product

A clinic markets gene editing to improve athletic performance or appearance. That is not ordinary treatment. The law prohibits alteration of genomic structure for enhancement or lineage-related purposes and restricts gene therapy to defined disease-related controls.

12. Frequently asked questions

Is genetic testing always voluntary in the UAE?

No. Voluntary screening requires consent, but the law recognises limited mandatory scanning determined by the competent authority, including public-health situations and other cases established through the authorised legal process.

Can a general medical consent form cover genetic screening?

It is unsafe to assume so. The law requires written, explicit consent on the health-authority-approved form, together with information about purpose and potential effects.

Can a parent consent for a child?

A legal representative may consent where the person is incapacitated or legally incompetent, subject to the health-authority process. Verify the representative’s authority and use age-appropriate information for the child.

Can a sample be used for future research?

Only within the scope of the original approval and consent. If the use is an additional purpose, the law requires written consent to be obtained again and gives the person a right to reject that use.

Can genomic samples be sent outside the UAE?

Not as an ordinary outsourcing decision. The law restricts transfer or storage outside the UAE unless the case is determined by the health authority or the authority approves the justification.

Can a company sell anonymised genetic data?

Anonymisation does not automatically remove all legal risk. The company must assess consent, purpose, re-identification, confidentiality, national-database obligations, research approvals and discrimination risk.

Is gene therapy prohibited?

No. Disease-related gene therapy may be permitted within the statutory controls, including specialist approval, valid consent, licensed specialists, an appropriate facility and licensed products. Enhancement or unrelated trait modification is not treated the same way.

Does a research ethics approval replace a health-facility licence?

No. Ethics or scientific approval is one part of the file. The facility, professionals, laboratory, sample handling and data-processing arrangements must also satisfy the applicable health and human-genome requirements.

What if a participant withdraws consent?

Follow the approved protocol and consent terms. Stop future collection or use where required, document what has already been analysed or shared, and apply the relevant retention, destruction and legal-record obligations.

Can an app provide genetic-risk recommendations without a clinic?

The business should not assume that an app is outside the law. If it collects, analyses, stores, transfers or reports genomic or genetic data, it may be providing a regulated service or supporting a regulated facility.

13. HZ Legal practical view

The safest genomic projects begin with a purpose-and-authority matrix. For every sample and data field, record the purpose, consent basis, responsible authority, licensed person or facility, storage location, permitted users, retention period, secondary-use rule and destruction trigger. If the project cannot answer those questions, it is not ready to launch.

Businesses should also separate three documents that are often incorrectly merged: the clinical consent, the research consent and the commercial data-use notice. Each serves a different purpose. A participant may agree to treatment but reject research, agree to research but reject commercial reuse, or agree to a test while requiring strict limits on family disclosure.

HZ Legal Consultancy can assist with genomic-service licensing, consent and counselling documentation, research and clinical-study contracts, sample-transfer and biobank arrangements, data-protection controls, vendor review, publication approvals, incident response and regulatory correspondence.

Official sources and further reading

• Federal Law by Decree No. 49 of 2023 Regulating the Use of the Human Genome.
• MoHAP legislation page and regulation file.
• MoHAP Support and Coordination of Health Research service.
• Federal Decree-Law No. 39 of 2023 on the Federal DNA Fingerprinting Database for the separate forensic-DNA framework.

Editorial note: UAE health, research, privacy and human-genome rules, authority forms and approval procedures may change. Confirm the current law, health-authority requirements, consent form, data-transfer position and research approvals before collecting samples, launching a service or publishing results.