Qatar’s Data Protection Law (PDPPL): A Business Overview

Qatar’s Personal Data Privacy Protection Law, Law No. 13 of 2016 (often called the PDPPL), sets rules for how organizations collect, use and protect personal data. It was one of the first comprehensive data protection laws in the Gulf. This article gives a plain-language overview to help you plan; it is not legal advice, and you should confirm details with a qualified lawyer and the latest official guidance.

Who the law applies to

The law places duties on controllers (organizations that decide why and how personal data is processed) and processors (those processing data on a controller’s behalf). Commentary on the law describes it as covering personal data processed electronically, or collected with a view to electronic processing. Organizations in the Qatar Financial Centre follow the QFC’s own data protection regulations instead.

Core obligations in plain language

According to legal summaries such as the DLA Piper data protection guide and Clyde & Co’s overview of the regulatory guidelines, organizations should:

• Process data honestly and lawfully, for a clear purpose, and generally with the individual’s consent or another basis the law allows.
• Tell people what data is collected, why, and how it will be used.
• Collect only what is needed and keep it accurate.
• Protect data with appropriate technical and administrative security measures.
• Report breaches that could cause serious harm, as the law and guidelines require.
• Take extra care with sensitive (“special nature”) data, such as health, religious or children’s data, which can require additional permission.
• Manage cross-border transfers in line with the law’s conditions.
• Use privacy by design when building new systems and processes.

Rights of individuals

Individuals generally have rights to be informed, to access their data, to request correction, to object or withdraw consent in certain cases, and to request erasure where processing is no longer justified. Build a simple process so requests are recorded and answered on time.

Guidance and enforcement

Regulatory guidelines have been issued since the law came into force to clarify how its obligations apply. Legal commentators note significant financial penalties for violations. Because guidance evolves, check the current publications of the competent authority before finalizing your compliance program.

Practical first steps for a business

1. Map your personal data: what you collect, where it is stored, who can access it, and who you share it with.
2. Review notices and consent forms on websites, apps and paper forms.
3. Tighten access to systems holding personal data.
4. Write a breach response plan with clear roles.
5. Check contracts with suppliers who process data for you.
6. Train staff, especially in HR, marketing and customer service.
7. Record decisions so you can show how you comply.

Privacy notice checklist

A privacy notice tells people how you handle their data. Check that yours explains, in clear language and in the languages your customers use:

• who you are and how to contact you about privacy;
• what personal data you collect and from where;
• why you collect it and on what basis;
• who you share it with, including service providers;
• whether data is transferred outside Qatar;
• how long you keep it;
• what rights individuals have and how to exercise them.

Steps in a data breach response plan

1. Contain the incident: stop the leak, secure systems, preserve evidence.
2. Assess what data was affected, how many people, and the likely harm.
3. Decide on notifications to the authority and affected individuals, in line with the law and guidance.
4. Communicate clearly and honestly, with one coordinated message.
5. Fix the root cause and update controls.
6. Record what happened and what was done, and review the plan.

Practice the plan with a short tabletop exercise once a year so people know their roles before a real incident.

Frequently asked questions

Does the law apply to small businesses?

Yes. The obligations depend on processing personal data, not on company size, although what is “appropriate” security may differ.

Does it apply to employee data?

Yes, employee records are personal data. HR processes should follow the same principles.

What about AI and analytics?

AI projects using personal data must respect the same rules: a clear purpose, minimal data, security and transparency. See How to start an AI project.

Prime Consulting helps organizations build data governance and privacy into their data and AI programs. See our Data Analysis Solutions and data governance guide.