Qatar passed a national data privacy law in 2016 – Qatar Law No. 13, the Personal Data Privacy Protection Law, to protect personal data. The Qatar data privacy law recommends steps that organizations must take while processing personal data within Qatar and also gives rights to the data subjects. 14 new guidelines were announced in 2021 by the Ministry of Transport and Communications for data subjects along with the regulated organizations.
The PDPPL applies to all personal data processed or subject to processing electronically in Qatar, barring the Financial Center Free Zone in Qatar.
The NCSA or National Cyber Security Agency has put the NCGAA or National Cyber Governance and Assurance Affairs in charge of administering and implementing the PDPPL and developing security controls to fulfil its provisions.
Table of Contents
The Qatar data privacy and protection law defines the entities to whom the law applies, the type of personal law it’s appliable to, and its territorial boundaries:
The Qatar PDPPL applies to all the personal data that is collected or electronically extracted, including data collected through a combination of electronic and conventional data processing methods. The exception is for data collected for use as statistical data, like for the census and data collected in private settings.
The territorial scope has not been overtly defined; we assume that it applies to all personal data being processed within Qatar.
There are 31 Articles and corresponding provisions related to personal data. Let’s check out the most important requirements.
Under the PDPPL, the data controller must ensure the following while handling personal data:
Article 4 of the Qatar Data Protection Law 2020 explicitly mentions that the controller must get the individual’s consent before processing their personal data, unless the processing is such that is mandated by law, for the controller or any other recipient.
Where the personal data is that of a child, explicit consent must be obtained from the guardian through an appropriate method. After the identity verification of the guardian, if they request, the controller must provide a description of the kind of data processed and the reason for such processing, along with a copy of that data.
Individuals whose data is being processed have the right to withdraw the consent given previously; data controllers must maintain a record of obtaining the consent.
Articles 11 and 13 of the Qatar PDPPL have vaguely mentioned the requirement to conduct a DPIA. The controller must review the measures for privacy protection before processing new data.
Therefore, the new guidelines recommend that data controllers carry out an evaluation to identify risks related to personal data processing and whether such processing could harm the individual’s data or privacy. Failure to conduct the DPIA can subject the organizations to fines of up to USD 275,000 or QAR 1,00,000.
Entities unable to conduct the DPIA for any reason must maintain detailed records of those reasons, as it is a critical component of the personal data management system under Qatar data privacy law.
The PDPPL mentions that the controller must maintain a thorough and detailed record of personal data disclosures and processing carried out for lawful purposes. The RoPA reports, cross-border data transfer, assessing privacy, and managing consent and sensitive data, are the compliance requirements that must be maintained. Additionally, they are mandated to maintain records of marketing activities.
The PDPPL does not allow the data controller to take steps against cross-border data transfer that may hinder the flow of international data; however, they can step in if the transfer violates the provisions of the Qatar data privacy law, or the processing can cause harm to the individuals or their data.
Data controllers cannot directly send marketing communications to individuals without clear and express consent. Such electronic communication must mention details like the identity and contact information of the data controller, and that this material is sent for marketing purposes. A valid address must also be mentioned so that the individual can withdraw their consent.
Data controllers must check their processors’ compliance level and must sign a data processing contract with their processors, stating the type of processing, duration, purpose, individual rights, security measures, etc.
Data controllers and processors must take precautions to ensure that personal data is protected from alteration, loss, theft, damage, or illegal use. The controller must be informed of any breach in the precautions as mentioned in the law or where any risk surfaces to threaten personal data.
Personal Data with Special Nature, including data corresponding to health, children, religion, ethnicity, marital relations or criminal activities is in a separate category under the Qatar data privacy law. The data controller must get the necessary permission from the relevant department to process this data.
Under the PDPPL, data controllers must formulate a system for effective management of personal data, notifying breaches, and fulfilling individual rights. This internal system is called the Personal Data Management System and includes DPIA and RoPA, as discussed above.
Under the Qatar data privacy law, individuals whose personal data is being processed have the following rights:
Breach notifications are covered by Articles 13 and 14 of the Qatar PDPPL. The data processor is mandated to notify the data controller whenever a data breach that could cause “serious damage” to an individual’s privacy or their data. The controller has to notify the NCGAA and the affected individual.
The PDPPL guidelines state that the notification must be made within 72 hours of the breach happening or being detected. Additionally, the guidelines mention these circumstances as being reasons of causing serious harm to the privacy of an individual.
The PDPPL imposes stringent penal fines for non-compliance and legislative violations. However, it doesn’t impose criminal penalties like prison time. Based on the severity of the violation, the penalty can be anything between QAR 1,000,000 to 5,000, 000.
When you have disorganized and unstructured data, you make yourself vulnerable to damage or unauthorized access to data; lack of security controls leave you open to breaches. Follow these best practices to avoid violations and protect sensitive data:
Or, you could simply engage the services of a reputed and experienced compliance consultant in the GCC like Wattlecorp and do focus on your core business while we ensure that your organization achieves compliance with Qatar PDPPL.
With governments and individuals becoming increasingly concerned about the privacy of personal information and the need to protect sensitive information, it is imperative that organizations take cognizance of this. Adhering to compliance requirements is not optional, it is mandatory. Not complying can result in hefty fees, loss of reputation, and loss of customers.
Don’t delay – a breach can happen any second. Ensure compliance with Wattlecorp.
