⁦Qatar PDPPL⁩

⁦Qatar⁩ پرائیویسی

حیثیت

⁦Issued 3 November 2016 and published in Official Gazette No. 15 of 2016. The National Cyber Security Agency (NCSA) publishes the law and its guidelines for regulated entities (version 2.0, September 2022).⁩✓ذرائع: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

یہ کن پر لاگو ہوتا ہے

⁦Personal data processed electronically, collected or prepared for electronic processing, or processed by a mix of electronic and traditional means (Art. 2). Excluded: processing by individuals in a private or family setting, and processing to produce official statistics (Art. 2). The law has no separate clause on processing done outside Qatar.⁩⁦Art. 2 ↗⁩

سائز کی حدیں

⁦No size, turnover or volume threshold. The only exclusions are private or family processing and official statistics (Art. 2).⁩

ریگولیٹر

⁦The law gives enforcement to the⁩ '⁦Competent Department⁩' ⁦of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.⁩✓ذرائع: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦The controller must tell the Competent Department and the individuals affected of any breach of its security precautions that may cause serious damage to personal data or privacy (Art. 14); a processor must tell the controller at once (Art. 13). NCSA⁩'⁦s breach guideline sets the time: within 72 hours of becoming aware of the breach.⁩✓⁦Arts. 13–14; NCSA breach guideline ↗⁩ · ذرائع: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦The law gives rights to access, a copy (for no more than the service charge), correction, erasure, objection and withdrawal of consent (Arts. 5 and 6) but sets no deadline. NCSA⁩'⁦s Individuals⁩' ⁦Rights guideline: respond within 30 calendar days.⁩⁦Arts. 5–6; NCSA rights guideline ↗⁩ · ذرائع: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

ڈیٹا پروٹیکشن آفیسر

⁦The law does not require a data protection officer. Controllers must name the processors responsible for protecting personal data, train them, and set up internal systems for complaints and access, correction and erasure requests (Art. 11).⁩⁦Art. 11 ↗⁩

مقامی نمائندہ

⁦The law has no requirement to appoint a representative in Qatar.⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Open by default: a controller may not take any decision or measure that limits cross-border data flows, unless the processing breaches the law or may cause serious damage to the data or the individual⁩'⁦s privacy (Art. 15). The law has no adequacy list or transfer permit.⁩⁦Art. 15 ↗⁩

کوکیز اور رضامندی

⁦Processing needs the individual⁩'⁦s consent unless it is necessary for a Lawful Purpose of the controller or the recipient (Art. 4). Direct-marketing electronic messages need prior consent, must name the sender and give an address to opt out (Art. 22). Websites aimed at children need the guardian⁩'⁦s explicit consent (Art. 17). There is no cookie-specific rule.⁩

زیادہ سے زیادہ سزا

⁦Fines up to QAR 5,000,000 for breaching the security precautions (Art. 13), processing special-nature data without a permit (Art. 16(3)) or breaking the children⁩'⁦s website rules (Art. 17) (Art. 24); up to QAR 1,000,000 for breaches of Articles 4, 8 to 12, 14, 15 and 22 (Art. 23). A legal person faces up to QAR 1,000,000 (Art. 25).⁩✓⁦Arts. 23–25 ↗⁩ · ذرائع: ⁦ncsa.gov.qa⁩, ⁦ncsa.gov.qa⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦Process personal data only with consent or for a Lawful Purpose, and tell individuals before processing who you are, why and how the data is disclosed (Arts. 4 and 9).⁩
• ⁦Get the Competent Department⁩'⁦s permit before processing special-nature data: ethnic origin, children, health, religion, marital relations, criminal offences (Art. 16).⁩
• ⁦Put security precautions in place and tell the regulator and affected individuals of a serious breach; NCSA expects this within 72 hours (Arts. 13 and 14).⁩
• ⁦Set up internal systems to handle complaints and access, correction and erasure requests; NCSA expects answers within 30 calendar days (Arts. 5, 6 and 11).⁩
• ⁦Send direct-marketing messages only with prior consent, with the sender⁩'⁦s identity and an opt-out address (Art. 22).⁩

حالیہ تبدیلیاں

⁦NCSA updated its guidelines for regulated entities to version 2.0 in September 2022, including the guidelines on personal data breach notifications and on individuals⁩' ⁦rights.⁩

ذرائع

• بنیادی ذریعہ: ⁦https://ncsa.gov.qa/shared/document_library/94787172324409/33000/8821/1.0~735ebb9c-e29e-4acb-a7ed-96449884a20b?mimetype=application%2Fpdf⁩&⁦filename=Law+No.+%2813%29+of+2016+on+Protecting+Personal+Data+Privacy.pdf⁩
• دوسرا ذریعہ: ⁦https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2919/1.0~87ad685f-7efe-476e-89f3-d2ae1cfed459?mimetype=application/pdf⁩&⁦filename=NO.pdf⁩
• ریگولیٹر: ⁦The law gives enforcement to the⁩ '⁦Competent Department⁩' ⁦of the Ministry of Transport and Communications (Arts. 1, 26 and 27). Today the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs, issues the guidelines, receives breach notifications and handles complaints.⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.