Qatar Personal Data Privacy Protection Law (PDPPL)

Why does it matter?

The PDPPL is the law a controller in Qatar answers to for any electronically processed personal data, and the NCGAA investigates complaints from any data subject, orders rectification within a set period and fines violations. Because the law uses consent as the default and a permit for personal data of a special nature, a controller that cannot show consent, a lawful purpose or an NCGAA permit for sensitive data is exposed. The 72-hour breach notice and the ban on unsolicited electronic marketing make incident and marketing controls part of compliance.

Key benefits include:

• A consent-first model

Collection and processing need the data subject's consent unless processing is necessary for a lawful purpose of the controller or of the third party receiving the data, so the basis for each processing activity has to be recorded.

• A permit for sensitive data

Personal data of a special nature may not be processed without the NCGAA's authorization, which depends on a permitted reason, an additional condition such as explicit consent, a data protection impact assessment and evidence of safeguards.

• A fixed breach clock

A breach of protective measures that is likely to cause damage is notified to the NCGAA and the data subject as soon as possible and within 72 hours.

• Rights people can use

Controllers must set up internal systems for complaints, access, correction and deletion requests, and adopt technical means that let individuals access, review and correct their data directly.

• Marketing and children covered

Electronic direct marketing requires affirmative, explicit and unambiguous prior consent with an opt-out in every message, and websites directed at children need parental approval and must delete a child's data on request.

How does it work?

Before processing, the controller notifies the data subject of its own details and those of any party processing on its behalf, the lawful purpose, a comprehensive and accurate description of the processing and the degree of disclosure, and any other information needed for the processing to be lawful. Consent is not needed where processing is in the public interest or under official authority, meets a legal obligation, protects the data subject's vital interests, serves scientific research in the public interest or responds to an official request in a criminal investigation.

Personal data of a special nature is processed only after the NCGAA's permission. The controller identifies a permitted reason and an additional condition, such as explicit or parental consent, data made public by the data subject or a necessity in the employment context; completes a data protection impact assessment that records the purpose, the potential harm to the data subject and the risks and mitigations; and shows the NCGAA that it has the administrative, technical and financial precautions in place.

Security is a duty of both controller and processor: precautions against loss, damage, amendment, disclosure, access or use in an accidental or unlawful way, proportionate to the nature and importance of the data. The controller also verifies that the processor follows its instructions and monitors that situation. Transfers follow the same consent or lawful-purpose test, and controllers may not curb trans-border data flow unless the processing would violate the law or cause gross damage to the data subject. A data subject may complain to the NCGAA, which can order rectification within a specified period and impose fines.

Key Elements

• Scope of application

Personal data processed electronically, obtained or collected in preparation for electronic processing, or processed by combining electronic and traditional processing; controllers and processors in Qatar. The Qatar Financial Center has its own, separate data protection regulations.

• Definitions

Personal data (an identified or reasonably identifiable natural person, directly or by combination); personal data of a special nature (ethnic origin, health, physical or mental condition, religious beliefs, relationships, criminal records); lawful purpose (the purpose for which data is processed in accordance with the law); personal data breach; trans-border data flow (accessing, viewing, retrieving, using or storing personal data without the constraints of state borders).

• Lawful processing and notice

Consent as the default, the lawful-purpose exception, five further cases where neither is needed, and the information the controller must give before processing.

• Personal data of a special nature

Processing only with NCGAA authorization, conditioned on a permitted reason, an additional condition, a data protection impact assessment and demonstrated safeguards.

• Controller duties

Review privacy procedures before new processing; specify and train the processors responsible for protection; set up systems for complaints, access, correction and deletion requests; set up systems to manage data and report violations; adopt technical means for direct access and correction; review commitment to protection; verify and monitor processors.

• Breach notification

Notice to the NCGAA and the data subject of any breach of protective measures likely to cause damage, as soon as possible and within 72 hours of the controller becoming aware.

• Direct marketing and children

Prior affirmative, explicit and unambiguous consent for electronic marketing, sender identity and an opt-out address in each message; for websites directed at children, a notice on use and disclosure, parental approval before processing, access for parents, deletion on request and no conditioning of games or prizes on excess data.

• Enforcement

Complaints by any data subject to the NCGAA, investigation, orders to rectify within a specified period and fines of up to QAR 5,000,000.

What does it cover?

The PDPPL applies to personal data when it is processed electronically, obtained, collected or extracted in any other way in preparation for electronic processing, or processed by combining electronic and traditional processing. It binds data controllers, who decide on processing, and data processors acting for them, in the public and private sectors in the State of Qatar. The Qatar Financial Center, an onshore business center with its own regulations, has separate data protection rules and is outside this law. Purely manual records that are not destined for electronic processing fall outside it.

What are its objectives?

Read with the NCGAA's regulatory guidelines, the law sets out to:

Recognize each individual's right to privacy of their personal data and allow processing only within a framework of transparency, honesty and respect for human dignity.

Put processing on consent or a lawful purpose, with the data subject informed before processing begins.

Reserve personal data of a special nature for processing the NCGAA has authorized after an impact assessment.

Require proportionate technical and organizational precautions from controllers and processors, with breaches notified within 72 hours.

Give data subjects working routes to access, review, correct and delete their data and to complain to the NCGAA.

Keep trans-border data flow open except where processing would violate the law or cause gross damage to the data subject.

Framework in Context

The PDPPL stands alone in Qatari law as the general data protection statute, supplemented by the regulatory guidelines the NCGAA's National Cyber Governance and Assurance Affairs issues, which draw on EU privacy concepts to clarify obligations the law leaves open. It is separate from the Qatar Financial Center's data protection regulations, which apply to QFC-licensed firms. The law is not a GDPR transposition: it has no registration, no mandatory data protection officer and no fixed list of data subject rights in the GDPR's form, and it relies on NCGAA permits for sensitive data. The first general data protection law in the Gulf Cooperation Council, it predates the region's later statutes.

Common Framework Mappings

Organizations operating in Qatar and elsewhere map the PDPPL to the privacy laws and information security standards below so that one consent register, one breach procedure and one security baseline can serve several regimes.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27701

NIST Privacy Framework v1.0

UAE PDPL