Patient data protection in clinics: what Saudi PDPL and Egypt’s data law require

This guide covers what each law requires, where clinics most often fall short, and the practical steps to close the gap. It is not legal advice — for a specific situation, consult a lawyer in the relevant market.

The two laws at a glance

In both markets, health data is in the highest-protection category. That means the baseline obligations — consent, security, purpose limitation — apply with the strictest interpretation. <cite index="55-1">Health and genetic data are classified as sensitive under the PDPL, requiring explicit consent and a stricter lawful basis for every processing activity.</cite> <cite index="67-1">Under Egypt's law, sensitive personal data includes data that reveals mental, psychological, physical, or genetic health, and children's data is always deemed sensitive.</cite>

What "explicit consent" means in practice

Both laws require explicit consent to process health data. A patient filling in a registration form does not automatically consent to everything the clinic might do with that information.

Explicit consent means the patient was told:

• What data is collected
• Why it is collected (treatment, billing, insurance claims, reminders)
• Who it is shared with (insurers, labs, referral specialists)
• How long it is kept
• How they can access, correct, or ask for deletion

and then agreed, in a way that is recorded. A signed consent form at first visit, with a copy in the patient's file, meets this. A line of small print on the registration form does not.

Marketing is a separate consent. Sending appointment reminders is part of treatment and needs no extra consent. Sending a promotional message about a new whitening service is marketing, and both laws require a separate, specific opt-in for that.

Where clinics most often fall short

1. Patient data on personal phones. A doctor photographs a lesion on their personal phone to show a colleague. A receptionist WhatsApps a patient's file to the lab from their own number. Both are transfers of sensitive data to unmanaged devices with no audit trail. Under either law, the clinic is responsible.

Fix: Images go into the clinic system, not the camera roll. Lab orders go through the system's lab integration or from a clinic-managed WhatsApp Business account, not personal numbers.

2. No access control. Every staff member can see every patient's full record. The receptionist can read clinical notes; the cleaner's login is the same as the doctor's.

Fix: Role-based permissions. Reception sees demographics, appointments, and billing. Clinical staff see clinical notes. Nobody sees what their job does not need. Every view and edit is logged with the user's name.

3. No retention policy. Records are kept forever because nobody decided otherwise, or deleted when the drive fills up because nobody decided otherwise.

Fix: A written retention period — typically 10 years from last visit in both markets for medical records, longer for minors — and a process to archive or securely delete at the end of it.

4. Cloud storage outside the country without checking. The clinic uses a cloud system hosted abroad. Under both laws, this is a cross-border transfer of sensitive data. <cite index="53-1">Healthcare entities must conduct transfer impact assessments before sharing patient data with external partners located outside Saudi Arabia.</cite> <cite index="69-1">In Egypt, personal data cannot be transferred outside the country unless the receiving country has adequate data protection laws in place.</cite>

Fix: Ask the software vendor where data is hosted. If abroad, ask for their data processing agreement and the safeguards they apply. If they cannot answer, that is the answer.

5. No breach plan. A laptop with patient records is stolen. Nobody knows who to tell or when.

Fix: A one-page breach response plan: who is notified internally, what gets assessed (how many patients, what data), who notifies the regulator and the patients, and within what timeframe. Both laws expect notification without undue delay.

The one document every clinic should have

A Record of Processing Activities — one page, kept current — that lists:

This document is what the regulator asks for first. It takes an afternoon to write and shows the clinic has thought about its data.

What Medicolize does

Medicolize applies role-based access by default: each user sees only what their role requires, and every access is logged. Patient consent is captured as a form at registration and stored with the record. Data is hosted in-region with a data processing agreement available on request. Retention rules can be set per record type. Audit logs show who accessed what, when — the evidence a clinic needs if a patient asks or a regulator inspects.

Start this week

1. Write the Record of Processing Activities. One page.
2. Check who in the clinic can see what. Remove access that is not needed.
3. Add a consent form to the registration process if there is not one.
4. Ask your software vendor where patient data is hosted.
5. Write the breach response plan. One page.

None of this requires a lawyer or a consultant. It requires a few hours and the decision to do it.

Medicolize is built with role-based access, consent capture, audit logs, and in-region hosting. Request a demo.