🇶🇦Qatar

Qatar's privacy framework is built around consent, lawful purpose and regulator-approved practice

Qatar's personal data privacy regime is anchored by Law No. (13) of 2016 on Protecting Personal Data Privacy. The law regulates the electronic processing of personal data and applies where personal data is processed electronically, obtained or gathered for electronic processing, or processed through a combination of electronic and traditional processing.

The law is not a copy of the GDPR. Its structure is more direct: individuals have a right to have their personal data processed within a framework of transparency, honesty, respect for human dignity and acceptable practices. Controllers must obtain consent unless processing is necessary for a lawful purpose, provide pre-processing information, protect data through administrative and technical safeguards, control processors, and respect individual rights to access, correction, erasure, objection and withdrawal of consent.

The three ideas to understand first

Consent is important, but lawful purpose matters too. Article 4 requires the controller to process personal data only after obtaining the individual's consent, unless the processing is necessary to achieve a lawful purpose for the controller or another recipient of the data. This means consent is not the only route to processing, but the lawful purpose must be real, defined and capable of being justified.

The controller carries the main accountability burden. The controller determines how and why personal data is processed. The controller must inform individuals before processing begins, ensure data relevance, adequacy, accuracy and retention limits, protect data, supervise processors, manage complaints and access/correction requests, conduct audits and report breaches.

The law has special rules for sensitive data, children and direct marketing. Personal data relating to ethnic origin, children, health, physical or psychological condition, religious beliefs, marital relations and criminal offences is treated as personal data of a special nature. Processing such data requires permission from the competent department. Direct marketing by electronic communication requires prior consent and must include identification and opt-out information.

How the law works in practice

The law uses broad definitions. Personal data is data relating to an individual whose identity is defined or can reasonably be defined, either from that data alone or by combining it with other data. Processing includes gathering, receipt, registration, organisation, storage, preparation, modification, retrieval, usage, disclosure, publication, transfer, withholding, destruction, erasure and cancellation.

Before processing begins, the controller must tell the individual who the controller is, who else may process the data, the lawful purposes of processing, the processing activities, the disclosure levels and any other information necessary for processing conditions to be fulfilled. This makes notice an operating requirement, not a cosmetic privacy-policy paragraph.

Qatar also gives individuals meaningful control rights. They may withdraw consent, object to unnecessary or excessive processing, request erasure when the purpose has ceased or justification for retention no longer exists, request correction, access their personal data, review it, be told about processing purposes and disclosures of inaccurate data, and obtain a copy of their data subject to a service charge limit.

What organisations should prioritise

Start with a controller inventory. Identify what personal data is electronically processed, who determines the purpose and means, which processors are involved, whether special-nature data is processed, whether children are involved, and whether direct marketing communications are sent.

Then build the pre-processing notice layer. Article 9 requires information before processing starts. The notice should identify the controller and any processing party, explain the lawful purposes, describe the processing and disclosure levels accurately, and include any additional information needed to make the processing fair and transparent.

Finally, test the controls that sit behind the notice: consent capture and withdrawal, objection and erasure handling, correction requests, access requests, processor instructions, breach escalation, security precautions, audits, and marketing opt-out mechanisms.