🇶🇦Personal Data Privacy Protection Law, 2016
A privacy law built around transparency, consent and lawful purpose
Qatar's Law No. (13) of 2016 on Protecting Personal Data Privacy creates a rights-based framework for the electronic processing of personal data. It applies where personal data is electronically processed, obtained, gathered or extracted in preparation for electronic processing, or processed through a combination of electronic and traditional means.
The law's central idea is simple: personal data may be processed only within a framework of transparency, honesty, respect for human dignity and acceptable practices. Controllers must obtain consent unless processing is necessary for a lawful purpose, inform individuals before processing begins, keep data relevant and accurate, apply safeguards, control processors, and respect individual rights.
Who the law covers — and what it does not cover
The law applies to Personal Data, meaning data of an individual whose identity is defined or can reasonably be defined either through the personal data itself or by combining it with other data. Personal Data Processing is defined broadly and includes gathering, receipt, registration, organisation, storage, preparation, modification, retrieval, usage, disclosure, publication, transfer, withholding, destruction, erasure and cancellation.
The law distinguishes between the Controller, who determines how personal data may be processed and the purposes of processing, and the Processor, who processes personal data for the controller. This distinction matters because the controller carries the primary duties to inform individuals, verify relevance and adequacy, implement internal systems, supervise processors, and notify breaches.
Article 2 excludes personal data processed by individuals within a private or family scope. It also excludes personal data processed for the purpose of obtaining official statistical data under Qatar's official statistics law. Those exclusions should not be read as general exceptions for commercial platforms, employers, service providers or website operators.
Consent and lawful purpose — the processing gateway
Article 4 provides the basic processing rule. The controller must process personal data only after obtaining the individual's consent, unless the processing is necessary to achieve a lawful purpose for the controller or for another recipient of the data. This is a narrower and more operational test than a long list of abstract lawful bases: the controller must be able to show either consent or necessity for a lawful purpose.
Article 3 frames processing standards in broader terms. Each individual has the right to protection of personal data, and processing must occur within the framework of transparency, honesty, respect for human dignity and acceptable practices. This means that even where a lawful purpose exists, the processing must still be handled in a manner consistent with those standards.
Acceptable practices are processing activities determined or approved by the competent department for different types of lawful purposes. That gives the regulator an important role in shaping what compliant processing looks like in practice.
Individual rights — access, correction, erasure, objection and withdrawal
Article 5 gives individuals several active rights. An individual may withdraw prior consent for processing, object to processing where it is unnecessary for the purposes for which the data was collected or where the data is excessive, discriminatory, unfair or illegal, request omission or erasure where the purpose has ceased or justifications for retention no longer exist, and request correction of personal data supported by proof of accuracy.
Article 6 gives individuals the right to access and review their personal data against any controller. The individual has the right to be notified of processing and its purposes, to be notified of any disclosure of inaccurate personal data, and to obtain a copy of personal data after paying an amount that must not exceed the service charge.
These rights require internal workflows. A controller cannot meet the law merely by listing rights in a privacy notice. It must have processes for identity verification, intake, review, correction, erasure, objection handling, copies of data and complaint escalation.
Pre-processing notice — what the controller must tell the individual
Article 9 requires the controller, before starting any personal data processing, to inform the individual of the controller's details and any other party conducting processing for or used by the controller. The controller must also identify the lawful purposes for which it or another party wants to process the personal data.
The controller must provide a comprehensive and accurate description of processing activities and levels of disclosure for the lawful purposes. If it cannot do so, it must provide a general description. It must also provide any other information necessary and required for fulfilling the conditions of personal data processing.
This is one of the law's most important operational duties. Notice must come before processing. It must explain who is involved, why data is being processed, what processing activities will occur, and how disclosure will happen. A generic privacy policy that does not map to actual processing and disclosure levels is unlikely to be enough.
Data relevance, adequacy, accuracy and retention
Article 10 requires the controller to verify that personal data collected by it or for its benefit is relevant to the lawful purposes and adequate for achieving them. The controller must ensure that the data is accurate, complete and up to date to meet those lawful purposes.
The controller must also not keep personal data for longer than the period necessary to achieve those purposes. This turns retention into a compliance obligation. The organisation should be able to explain why each category of personal data is retained, for how long, and when it will be erased, anonymised or otherwise removed from active use.
A website operator collects ID details, location data and family information from every user even though only an email address and payment details are needed to provide the service. Even if the user has clicked “I agree”, Article 10 still requires personal data to be relevant and adequate for the lawful purpose. Article 5 also allows objection where collected personal data is beyond the extent required. Consent does not cure excessive collection.
Controller and processor obligations
Article 8 requires the controller to process personal data honestly and legitimately, consider controls when designing, changing or developing products, systems and services involving personal data processing, take appropriate administrative, technical and financial precautions to protect personal data, and comply with privacy protection policies developed by the competent department and issued by ministerial decision.
Article 11 requires the controller to review privacy protection measures before new processing operations, identify processors responsible for personal data protection, train and raise processor awareness, develop internal systems to receive and investigate complaints and access, omission and correction requests, develop systems for effective personal data management and breach reporting, use appropriate technologies to allow individuals to directly access, review and correct personal data, conduct audits and reviews, and verify processor compliance with instructions.
Article 12 requires the controller, when disclosing personal data or transferring it to the processor, to ensure that the disclosure or transfer aligns with lawful purposes and is processed according to the law. Article 13 requires both controller and processor to take precautions necessary to protect personal data against loss, damage, change, disclosure, access or inadvertent or illegal use. Those precautions must be proportionate to the nature and importance of the data.
Breach notification
Article 13 requires the processor to immediately notify the controller of any breach of protective precautions or any risk threatening personal data. Article 14 then requires the controller to inform the individual and the competent department of any breach of those precautions where the breach may cause serious damage to personal data or individual privacy.
The law does not treat breach response as only an internal security issue. Processor-to-controller escalation and controller notification to both the individual and competent department are part of the legal compliance model. Contracts with processors should therefore include clear incident reporting duties, escalation timelines and cooperation obligations.
Cross-border data flows
Article 15 provides that, taking into account the law's obligations, the controller is forbidden from taking any decision or measure that may limit cross-border data flow unless processing breaches the law or may cause serious damage to personal data or the individual's privacy.
This is a distinctive feature of Qatar's law. The law recognises cross-border data flows and does not impose a general localisation rule in Article 15. The compliance focus is on whether the processing is lawful and whether the transfer may cause serious damage to personal data or individual privacy.
Personal data of a special nature and children
Article 16 treats personal data relating to ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations and criminal offences as personal data of a special nature. The Minister may add other types of special-nature personal data where misuse or disclosure may cause serious damage to the individual.
Personal data of a special nature may be processed only after obtaining permission from the competent department in accordance with measures and controls issued by ministerial decision. Additional safeguards may also be imposed by the Minister.
Article 17 creates specific duties for website owners or operators addressing children. They must post notice on the website explaining what child data is, how it is used and the policies for disclosure, obtain explicit guardian consent, provide the guardian with a description and copy of processed child data upon request after verifying identity, delete, remove or suspend processing of child data when requested by the guardian, and must not make a child's participation in games, promotional awards or activities conditional on providing excessive personal data.
Direct marketing
Article 22 prohibits sending electronic communications to an individual for direct marketing unless prior consent has been obtained. The electronic communication must identify the sender, make clear that it is sent for direct marketing, and include a valid address through which the individual can request that communications stop or revoke consent.
This is a consent-first marketing rule. The practical controls are consent capture, suppression lists, sender identification, unsubscribe channels and proof that marketing communication was not sent without consent.
Complaints, enforcement and penalties
Article 26 allows an individual to file a complaint with the competent department where the law or implementing decisions are violated. After investigating and establishing seriousness, the competent department may issue a reasoned decision requiring the controller or processor to rectify the breach within a specified period. The controller or processor may grieve the decision to the Minister within 60 days of notification, and the Minister must decide within 60 days.
Article 23 provides a penalty of up to QAR 1,000,000 for violations of Articles 4, 8, 9, 10, 11, 12, 14, 15 and 22. Article 24 provides a penalty of up to QAR 5,000,000 for violations of Article 13, Article 16 paragraph 3 and Article 17. Article 25 provides for a penalty of up to QAR 1,000,000 on a violating legal person where crimes are committed in its name or interest, without prejudice to the criminal liability of affiliated natural persons.
Article 28 states that any contract or agreement made in violation of the law is null and void. This makes privacy compliance relevant to commercial enforceability, not only regulatory exposure.
Article 2 — Application: electronic processing, preparation for electronic processing, and mixed electronic/traditional processing.
Articles 3–4 — Core standard and consent/lawful purpose: transparency, honesty, human dignity, acceptable practices, consent unless necessary for lawful purpose.
Articles 5–6 — Individual rights: withdrawal, objection, erasure, correction, access, review, notification and copy rights.
Articles 8–13 — Controller and processor obligations: honest processing, privacy by design controls, notices, adequacy, accuracy, retention, internal systems, processor oversight and security precautions.
Article 14 — Breach notification: controller must inform the individual and competent department where breach may cause serious damage.
Article 15 — Cross-border data flows: restrictions only where processing breaches the law or may cause serious damage.
Articles 16–17 — Special-nature data and children: permission for special-nature data and specific child website duties.
Article 22 — Direct marketing: prior consent and sender/opt-out information required.
Articles 23–25 — Penalties: up to QAR 1,000,000 or QAR 5,000,000 depending on violation category, plus legal person liability.
Article 30 — Adjustment period: covered parties must adjust their position within six months from effectiveness, extendable by Council of Ministers decision.
Qatar's law is practical and controller-heavy. Your organisation should be able to prove why processing is lawful, show when consent is required, give pre-processing notice, keep data relevant and accurate, avoid excessive collection, maintain security precautions, supervise processors, support access/correction/erasure/objection workflows, handle special-nature and child data only with the required approvals, and ensure direct marketing is consent-based. The highest exposure sits around security, special-nature data and children's data, where penalties can reach QAR 5,000,000.