Qatar PDPPL

Qatar Privacy

Status

Issued 3 November 2016 and published in Official Gazette No. 15 of 2016. The National Cyber Security Agency (NCSA) publishes the law and its guidelines for regulated entities (version 2.0, September 2022).✓Sources: ncsa.gov.qa, ncsa.gov.qa

Who it applies to

Personal data processed electronically, collected or prepared for electronic processing, or processed by a mix of electronic and traditional means (Art. 2). Excluded: processing by individuals in a private or family setting, and processing to produce official statistics (Art. 2). The law has no separate clause on processing done outside Qatar.Art. 2 ↗

Size thresholds

No size, turnover or volume threshold. The only exclusions are private or family processing and official statistics (Art. 2).

Regulator

The law gives enforcement to the 'Competent Department' of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.✓Sources: ncsa.gov.qa, ncsa.gov.qa

Breach or incident reporting

The controller must tell the Competent Department and the individuals affected of any breach of its security precautions that may cause serious damage to personal data or privacy (Art. 14); a processor must tell the controller at once (Art. 13). NCSA's breach guideline sets the time: within 72 hours of becoming aware of the breach.✓Arts. 13–14; NCSA breach guideline ↗ · Sources: ncsa.gov.qa, ncsa.gov.qa

Deadline to answer personal data requests

The law gives rights to access, a copy (for no more than the service charge), correction, erasure, objection and withdrawal of consent (Arts. 5 and 6) but sets no deadline. NCSA's Individuals' Rights guideline: respond within 30 calendar days.Arts. 5–6; NCSA rights guideline ↗ · Sources: ncsa.gov.qa, ncsa.gov.qa

Data protection officer

The law does not require a data protection officer. Controllers must name the processors responsible for protecting personal data, train them, and set up internal systems for complaints and access, correction and erasure requests (Art. 11).Art. 11 ↗

Local representative

The law has no requirement to appoint a representative in Qatar.

Sending data abroad

Open by default: a controller may not take any decision or measure that limits cross-border data flows, unless the processing breaches the law or may cause serious damage to the data or the individual's privacy (Art. 15). The law has no adequacy list or transfer permit.Art. 15 ↗

Cookies and consent

Processing needs the individual's consent unless it is necessary for a Lawful Purpose of the controller or the recipient (Art. 4). Direct-marketing electronic messages need prior consent, must name the sender and give an address to opt out (Art. 22). Websites aimed at children need the guardian's explicit consent (Art. 17). There is no cookie-specific rule.

Maximum penalty

Fines up to QAR 5,000,000 for breaching the security precautions (Art. 13), processing special-nature data without a permit (Art. 16(3)) or breaking the children's website rules (Art. 17) (Art. 24); up to QAR 1,000,000 for breaches of Articles 4, 8 to 12, 14, 15 and 22 (Art. 23). A legal person faces up to QAR 1,000,000 (Art. 25).✓Arts. 23–25 ↗ · Sources: ncsa.gov.qa, ncsa.gov.qa

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Process personal data only with consent or for a Lawful Purpose, and tell individuals before processing who you are, why and how the data is disclosed (Arts. 4 and 9).
• Get the Competent Department's permit before processing special-nature data: ethnic origin, children, health, religion, marital relations, criminal offences (Art. 16).
• Put security precautions in place and tell the regulator and affected individuals of a serious breach; NCSA expects this within 72 hours (Arts. 13 and 14).
• Set up internal systems to handle complaints and access, correction and erasure requests; NCSA expects answers within 30 calendar days (Arts. 5, 6 and 11).
• Send direct-marketing messages only with prior consent, with the sender's identity and an opt-out address (Art. 22).

Recent changes

NCSA updated its guidelines for regulated entities to version 2.0 in September 2022, including the guidelines on personal data breach notifications and on individuals' rights.

Sources

• Primary source: https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?mimetype=application%2Fpdf&filename=Law+No.+%2813%29+of+2016+on+Protecting+Personal+Data+Privacy.pdf
• Second source: https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2919/1.0~87ad685f-7efe-476e-89f3-d2ae1cfed459?mimetype=application/pdf&filename=NO.pdf
• Regulator: The law gives enforcement to the 'Competent Department' of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.