⁦Qatar PDPPL⁩

⁦Qatar⁩ الخصوصية

الحالة

⁦Issued 3 November 2016 and published in Official Gazette No. 15 of 2016. The National Cyber Security Agency (NCSA) publishes the law and its guidelines for regulated entities (version 2.0, September 2022).⁩✓المصادر: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

على من ينطبق

⁦Personal data processed electronically, collected or prepared for electronic processing, or processed by a mix of electronic and traditional means (Art. 2). Excluded: processing by individuals in a private or family setting, and processing to produce official statistics (Art. 2). The law has no separate clause on processing done outside Qatar.⁩⁦Art. 2 ↗⁩

حدود الحجم

⁦No size, turnover or volume threshold. The only exclusions are private or family processing and official statistics (Art. 2).⁩

الجهة الرقابية

⁦The law gives enforcement to the⁩ '⁦Competent Department⁩' ⁦of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.⁩✓المصادر: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

الإبلاغ عن الخروقات أو الحوادث

⁦The controller must tell the Competent Department and the individuals affected of any breach of its security precautions that may cause serious damage to personal data or privacy (Art. 14); a processor must tell the controller at once (Art. 13). NCSA⁩'⁦s breach guideline sets the time: within 72 hours of becoming aware of the breach.⁩✓⁦Arts. 13–14; NCSA breach guideline ↗⁩ · المصادر: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

مهلة الرد على طلبات البيانات الشخصية

⁦The law gives rights to access, a copy (for no more than the service charge), correction, erasure, objection and withdrawal of consent (Arts. 5 and 6) but sets no deadline. NCSA⁩'⁦s Individuals⁩' ⁦Rights guideline: respond within 30 calendar days.⁩⁦Arts. 5–6; NCSA rights guideline ↗⁩ · المصادر: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

مسؤول حماية البيانات

⁦The law does not require a data protection officer. Controllers must name the processors responsible for protecting personal data, train them, and set up internal systems for complaints and access, correction and erasure requests (Art. 11).⁩⁦Art. 11 ↗⁩

الممثل المحلي

⁦The law has no requirement to appoint a representative in Qatar.⁩

نقل البيانات إلى الخارج

⁦Open by default: a controller may not take any decision or measure that limits cross-border data flows, unless the processing breaches the law or may cause serious damage to the data or the individual⁩'⁦s privacy (Art. 15). The law has no adequacy list or transfer permit.⁩⁦Art. 15 ↗⁩

ملفات تعريف الارتباط والموافقة

⁦Processing needs the individual⁩'⁦s consent unless it is necessary for a Lawful Purpose of the controller or the recipient (Art. 4). Direct-marketing electronic messages need prior consent, must name the sender and give an address to opt out (Art. 22). Websites aimed at children need the guardian⁩'⁦s explicit consent (Art. 17). There is no cookie-specific rule.⁩

أقصى عقوبة

⁦Fines up to QAR 5,000,000 for breaching the security precautions (Art. 13), processing special-nature data without a permit (Art. 16(3)) or breaking the children⁩'⁦s website rules (Art. 17) (Art. 24); up to QAR 1,000,000 for breaches of Articles 4, 8 to 12, 14, 15 and 22 (Art. 23). A legal person faces up to QAR 1,000,000 (Art. 25).⁩✓⁦Arts. 23–25 ↗⁩ · المصادر: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Process personal data only with consent or for a Lawful Purpose, and tell individuals before processing who you are, why and how the data is disclosed (Arts. 4 and 9).⁩
• ⁦Get the Competent Department⁩'⁦s permit before processing special-nature data: ethnic origin, children, health, religion, marital relations, criminal offences (Art. 16).⁩
• ⁦Put security precautions in place and tell the regulator and affected individuals of a serious breach; NCSA expects this within 72 hours (Arts. 13 and 14).⁩
• ⁦Set up internal systems to handle complaints and access, correction and erasure requests; NCSA expects answers within 30 calendar days (Arts. 5, 6 and 11).⁩
• ⁦Send direct-marketing messages only with prior consent, with the sender⁩'⁦s identity and an opt-out address (Art. 22).⁩

التغييرات الأخيرة

⁦NCSA updated its guidelines for regulated entities to version 2.0 in September 2022, including the guidelines on personal data breach notifications and on individuals⁩' ⁦rights.⁩

المصادر

• المصدر الأساسي: ⁦https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?mimetype=application%2Fpdf⁩&⁦filename=Law+No.+%2813%29+of+2016+on+Protecting+Personal+Data+Privacy.pdf⁩
• المصدر الثاني: ⁦https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2919/1.0~87ad685f-7efe-476e-89f3-d2ae1cfed459?mimetype=application/pdf⁩&⁦filename=NO.pdf⁩
• الجهة الرقابية: ⁦The law gives enforcement to the⁩ '⁦Competent Department⁩' ⁦of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.