Data Protection in Qatar

Data Protection in Qatar

The firm covers Qatar matters in cooperation with an announced partner office in Qatar. That partner office is not a branch owned by the firm, and the firm does not itself hold a Qatar law practice license; local licensing and representation are assessed for each matter in the State of Qatar. Personal data in Qatar is governed by Law No. 13 of 2016 on Protecting Personal Data Privacy, published in Official Gazette No. 15 of 2016. The National Cyber Governance and Assurance Affairs of the National Cyber Security Agency publishes the law, the guidelines and the request forms for regulated entities. Entities licensed in the Qatar Financial Centre also follow the QFC Data Protection Regulations 2021, supervised by the QFC Data Protection Office. With our partner office we work out which regime applies and what the entity has to put in place.

What controllers must do

A controller may process personal data only with the individual's consent, unless processing is necessary for a lawful purpose of the controller or the recipient. Before processing it must tell the individual who it is, the purposes and how the data will be disclosed. It must keep data relevant, accurate and no longer than needed, review privacy measures before new processing, identify and train the people who process data, run internal systems for complaints and access or correction requests, audit compliance and supervise its processors, and protect data against loss, damage, alteration and unauthorised disclosure.

Special-nature data, rights and marketing

Data on ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations and criminal offences is data of a special nature, and may be processed only with the permission of the competent department. A website aimed at children needs the guardian's explicit consent. Individuals can withdraw consent, object, ask for erasure or correction and obtain a copy of their data, and electronic direct marketing needs prior consent and must identify its sender.

Breaches, cross-border flows and penalties

A controller must inform the individual and the competent department of a breach of its precautions that may cause serious damage to the data or the individual's privacy. Controllers may not take decisions that restrict cross-border data flow unless the processing breaches the law or may cause serious damage. Fines reach QAR 1 million for most breaches of the duties above and QAR 5 million for breaches of the security duty, the special-nature rules and the children's rules. For a QFC entity, breaches go to the QFC Data Protection Office within 72 hours where feasible. To scope a Qatar compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE and Qatar, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law governs personal data in Qatar?

Law No. 13 of 2016 on Protecting Personal Data Privacy. Entities licensed in the Qatar Financial Centre also follow the QFC Data Protection Regulations 2021, with their own Data Protection Office.

Does sensitive data need permission in Qatar?

Data of a special nature, such as health, ethnic origin, children's data, religious creeds, marital relations and criminal offences, may be processed only with the permission of the competent department, under the controls set by ministerial decision.

Who handles Qatar data protection matters at the firm?

Qatar matters are handled in cooperation with the firm's announced partner office in Qatar. The firm does not itself hold a Qatar law practice license, and local licensing and representation are assessed for each matter.

Other markets

Corporate & Commercial Law in Qatar · Data Protection in Egypt · Data Protection in Saudi Arabia · Data Protection in the UAE · Data Protection in Oman · Data Protection in Bahrain