Qatar. Comprehensive data protection. Law
PDPPLLaw No. (13) of 2016 on Protecting Personal Data Privacy
In force
Partly verified
Medium confidence.Adoption/in-force dates from prior knowledge.
§1Summary
- Synopsis
The first GCC comprehensive data protection law, covering electronic processing and certain manual processing, with transparency, rights, security and breach duties supplemented by NCSA guidelines.
- Key themes
- Unique features
Processing of 'special nature' data (health, religion, children, etc.) requires NCGAA permission plus a DPIA; specific website rules for children's data; prior opt-in for direct marketing.
- SaaS relevance
Applies to processing of data in Qatar and by Qatari controllers; SaaS processors must support breach and security obligations.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- NCGAA and data subjects within 72h where damage likely
- DPO
- No
- Cross-border transfers
- Free flow unless processing breaches the law or causes gross damage
- Maximum penalty
- QAR 5m
§3Dates
- Key dates
- Adopted
- In force
- Guidelines issued by the NCSA's National Cyber Governance and Assurance Affairs (NCGAA)
§4Text and authority
- Text
- Authoritative text almeezan.qa
- Authority
- National Cyber Security Agency – National Cyber Governance and Assurance Affairs (NCGAA)
§5Where it applies
- Domestic law of
- Qatar
- Also applies in
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Adoption/in-force dates from prior knowledge.