Qatar
SubstantialLaw No. 13 of 2016 on Personal Data Privacy Protection
Authority: Compliance and Data Protection Department (CDPD) | Enforcement: Active | Enacted: November 2016
Overview
Qatar enacted its Personal Data Privacy Protection Law in 2016. The QFC also has its own data protection framework (QFC DP Regulations 2021). The national law provides foundational protections with cross-border transfer rules and breach notification.
14-Topic Coverage
Data Protection Authority
Fully AddressedCDPD within the Ministry of Transport and Communications oversees compliance.
Consent Requirements
Fully AddressedConsent required for processing. Must be informed, specific, and freely given.
Data Subject Rights
Fully AddressedRights to access, correction, deletion, and objection.
Cross-Border Transfer
Fully AddressedTransfers permitted with adequate protection or ministerial approval.
Breach Notification
Fully AddressedMust notify the Ministry and affected individuals of data breaches.
DPO Requirements
Partially AddressedNot explicitly required but implied for certain organisations.
Children's Data
Partially AddressedGeneral provisions apply. No specific age-based provisions.
Penalties & Enforcement
Fully AddressedFines up to QAR 5 million. Criminal penalties including imprisonment up to 3 years.
Sector-Specific Rules
Fully AddressedQFC DP Regulations 2021, QCB financial data rules, health data regulations.
Cookie/Tracking
Partially AddressedGeneral consent requirements apply.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions.
Data Localisation
Partially AddressedGovernment data and certain sectors require local storage.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Qatar's regulations.
Book a Consultation