Your duties under data-protection law
Pharmacy · checked 2026-10-24
A pharmacy keeps patient data: an ID, a date of birth, prescriptions and what was dispensed. Every market in this guide treats health data as a special category, so the law puts duties on the shop as well as on the apps. This page lists those duties for ten markets, as the laws read in October 2026. It reports what each law says and cites it. It is not legal advice, and some points are not settled. Ask your adviser before you rely on a row.
What your shop keeps
The two pharmacy apps keep records on your own site. Pharmacy counter rules keeps each patient's ID, date of birth, authority to possess and consent, each prescription with its image if you attach one, and each dispensing. Expiry and recall finds the customers who bought a recalled lot. Pages that describe the records: Pharmacy counter rules and Expiry and recall.
Register, officer and breach notice
| Market and law | Register, license or notify | Data protection officer | Tell, if patient data is exposed |
|---|---|---|---|
| Kenya: Data Protection Act 2019 | Register with the Data Commissioner. It applies at any size, because health administration and patient care are named purposes (Registration Regulations, reg. 13(4)). | Not read. | 72 hours to the Data Commissioner. The patient in writing within a reasonably practical period (s. 43(1)). If the Digital Health Act applies, 48 hours to the Digital Health Agency. |
| Nigeria: Data Protection Act 2023 and the 2025 Directive | The health sector makes a controller one of major importance, which must register, name an officer and file yearly audit returns (Directive, Sch. 7). A rule for traders with fewer than 15 staff reads two ways and is not settled. | Yes, for a controller of major importance. | 72 hours to the Nigeria Data Protection Commission (NDPC). The patient immediately where the risk is high (s. 40). |
| Ghana: Data Protection Act 2012 | Register every controller before processing. Renew every two years. Processing while unregistered is an offence (ss. 27, 46(3), 53). | Not read. | The Data Protection Commission and the patient as soon as reasonably practicable (s. 31). No hour limit. |
| Egypt: Law 151 of 2020 and its 2025 Regulation | A license from the Personal Data Protection Center for every controller and processor, of any size. The law covers electronic processing only. Compliance is due about 1 November 2026. | Yes, registered with the Center. | 72 hours to the Center (Art. 7). The patient within 3 working days of that report (Regulation, Art. 5). |
| Saudi Arabia: Personal Data Protection Law 2023 | A controller that processes sensitive data registers on the National Data Governance Platform (Register Rules, Art. 2(3)). | Yes, where sensitive data is the core activity (Implementing Regulation, Art. 32(1)(c)). | 72 hours to SDAIA, the Saudi Data and AI Authority, where harm is possible. The patient without undue delay (Implementing Regulation, Art. 24). |
| UAE: Federal Law 2 of 2019 on health data | No data-protection registration. Join the central health-information system (Art. 7). Put the ID number in every health record, except in emergencies and cases a Ministry decision sets (Art. 21). | Dubai asks for one where processing is high-risk, profiling or large (Dubai Health Authority policy PP-11 §4.19.1). | Abu Dhabi: 72 hours to the Department of Health (DoH). Dubai: the period is not issued yet. Data in the NABIDH health exchange: 48 hours. |
| Jordan: Personal Data Protection Law 24 of 2023 | Fill the controller's register within 30 days of starting. It names the retention period and the place (Register Instructions, Arts 4 and 5). | Yes, for sensitive data (Art. 11(a)(2)). | Where severe harm is likely: the patient within 24 hours and the authority's Unit within 72 hours (Art. 20(a)). |
| Mexico: the 2025 federal law on private parties' data | No registration. Name a person or department for patients' requests (art. 29). | A person or department for requests, not an officer. | The patients only, immediately (art. 19). No notice to an authority. |
| Rwanda: Law 058/2021 | Register with the supervisory authority (Art. 29). | Not read. | Not read. |
| Cameroon: Law 2024/017 | Not read. Compliance was due by 23 June 2026 (Art. 73). | Not read. | Not read. |
Some points need a person's judgment, and the laws read do not decide them:
- Whether a retail pharmacy is a health care provider in Kenya, or a health establishment in Nigeria. A provider has further duties, such as notifying the Digital Health Agency in Kenya.
- The UAE's federal breach period. The rules that would set it are not issued.
Where patient data may be kept
In several of these markets the law keeps patient data in the country, or licenses what leaves. This applies to your site and to every service that reads patient data. Ask your partner where each one runs.
| Market | May patient data leave the country |
|---|---|
| UAE | No, except in cases a Health Authority decision sets (Law 2 of 2019, Art. 13). In Abu Dhabi, copies in any form stay in the UAE, backups included. Only people in the UAE, or licensed by the DoH, may reach a system that keeps patient data. |
| Saudi Arabia | Not in practice. No list of countries is published, and three of the four exemptions bar sensitive data. |
| Kenya | Only with the patient's consent and safeguards (s. 49(1)). A pharmacy that provides primary health care keeps its processing on a server in Kenya, or keeps one serving copy there (General Regulations, reg. 26). If the Digital Health Act applies to your pharmacy, personal health information leaves Kenya only for health tourism (s. 47). |
| Egypt | Only under a license, which a cloud server abroad also needs (Art. 14). A processor outside Egypt needs a license and a representative in Egypt. |
| Jordan | By exception: medical data a patient's treatment needs, or the patient's consent after a warning that protection is lower (Art. 15). |
| Rwanda | It is stored in Rwanda, unless the authority certifies otherwise (Art. 50). |
| Cameroon | A transfer abroad needs the authority's prior authorization (Art. 32(1)). |
| Nigeria | Yes, with safeguards such as contract clauses. The 2025 Directive also asks the patient's consent before a transfer to a country with no adequacy decision, and none is published (Art. 18(1)(e)). A data protection impact assessment is filed with the NDPC for health care services and for a transfer abroad. |
| Ghana | The Act sets no condition. A processor abroad must follow Ghana's law (s. 30(4)). |
| Mexico | Yes. A processor abroad is not a transfer (art. 2-XX), and the same rules bind it wherever it runs. |
Pharmacy counter rules and Expiry and recall run where your partner hosts them, so choose your own country. Age-restricted sale check and the five general apps listed in Pharmacy on iVendNext run on CitiXsys hosting in the United States. Every check on a till profile is sent the details of each sale, and a prescription number is one of them. Of these apps, that means Age-restricted sale check and Coupon rules. Whether a pharmacy's sales count as health data in your country is for your adviser to say. Check it before you turn one of these apps on in the UAE, Saudi Arabia, Kenya, Egypt, Rwanda, Jordan or Cameroon. In Nigeria, file the data protection impact assessment first.
Consent
Several laws ask for the patient's consent for what no pharmacy law requires. Pharmacy counter rules records it on the patient record and can refuse a sale until it is there. See its step for drug schedules, which lists each market.
When a patient asks you to erase a record
Every law read except Egypt's lets the period of your register or prescription record win over a request to erase. Egypt's law lists no exception to erasure, so a register line rests on the legal ground of being authorized by law, which is an inference. When the period ends, most of these laws ask you to destroy the data or make it anonymous. Pharmacy counter rules lists the periods and the steps.