---
title: "Qatar Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/qatar-data-protection-privacy-regulation/
source_html: /jurisdictions/qatar/index.html
description: "Qatar data protection and privacy regulation: 10 categories, 80 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…"
generated_at: 2026-11-07T14:58:19Z
content_sha256: 86697c9ff13ddfd6d35930f2f301f980e1ae3a4e9e98ffe70033a240a993fac4
generator: "fe-fleet/md-twin@1.0"
---
# Qatar Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed hybrid regime overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/qatar/), [World Payments](https://payments.gi/jurisdictions/qatar/), artificial-intelligence

Last updated 2026-11-04 · 10 categories · 80
claims · 34 sources in the cumulative register

Download report (PDF) Expand all

Qatar's data-protection enforcement posture has moved decisively from an awareness phase into a pattern of active, dated binding decisions.

Data collected 2026-11-01 · Data published 2026-11-04

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties, Enforcement & Redress (4 open gaps).

Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=QATAR)[Build Report](/reports/?j=QATAR)[Compare](/compare/?j=QATAR)

Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority National Cyber Security Agency (NCSA) - National Cyber Governance and Assurance Affai Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

3 Red categories 57 Sub-modules

80 Claims

12 Tier-1 sources

Traffic-light mix 7 amber 3 red
(sums to 10 rendered categories; click to filter)

3 categories flagged red

## Jurisdiction brief

Jurisdiction lead brief 835 Full executive summary 161

###### Latest update · 4 November 2026

#### Lead Signal

A sector-specific data-localisation layer affecting the financial industry is understood to have surfaced afresh in commentary on Qatar. A Qatar Central Bank Data Handling and Protection Regulation, issued in February 2025, is reported to require financial institutions supervised by the central bank to keep the primary storage and processing environment for personal, sensitive personal and sensitive financial information inside Qatar, with an offshore primary environment permitted only where the central bank gives explicit prior approval. This sits as a sector-specific overlay on top of the jurisdiction's general cross-border transfer rule under Article 15 of Law No. 13 of 2016, which already restricts the transfer of personal data outside Qatar where the receiving jurisdiction's processing would breach the Law or cause serious damage to the data subject, with the Compliance and Data Protection Department assessing the adequacy of the receiving jurisdiction on a case-by-case basis.

#### Other Developments

No other part of the privacy framework carried material movement in Qatar.

#### Cross-Monitor Connections

The same central-bank data-localisation requirement is being tracked in parallel from a payments-infrastructure perspective within world-payments, where it is read principally as an operational-resilience and hosting-architecture question for payment institutions. Readers interested in how supervised entities are adjusting their technical architecture in response should look there; this brief confines itself to the personal-data transfer and localisation dimension.

#### Outlook

The open question is how the central bank's sector-specific localisation requirement interacts procedurally with the general cross-border transfer assessment already performed by the Compliance and Data Protection Department under the 2016 Law — whether the two regimes are applied as parallel, independent tests or whether one is treated as satisfying the other for in-scope financial data. Clarity on the offshore-approval criteria under the central bank regulation would also help settle how much practical room suprevised institutions retain for offshore primary environments.

3 earlier updates not shown here.

###### Standing brief · as of 14 September 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

Qatar's data-protection enforcement posture has moved decisively from an awareness phase into a pattern of active, dated binding decisions. The National Data Privacy Office, operating within the National Cyber Security Agency, issued its most recent binding ruling in February 2026 against a sports-sector company, finding that it had failed to implement adequate technical, administrative and physical safeguards, a failure that contributed to a personal-data breach. This follows binding compliance rulings against an ICT-sector company in December 2024 and an e-commerce operator in March 2025, establishing a clear cadence of enforcement activity rather than an isolated action. Administrative fines under the PDPPL range from QAR 1,000,000 to QAR 5,000,000 depending on the article violated, and this fine range, together with the escalating cadence of binding decisions, is the clearest evidence available this cycle that Qatar's regulator has operationalised its enforcement powers rather than holding them in reserve.

The regulator itself has also been confirmed structurally this cycle: the National Data Privacy Office, sitting within the National Cyber Security Agency, is confirmed as the operative authority for PDPPL enforcement, having taken over this function from the Ministry of Transport and Communications' former Compliance and Data Protection Department.

#### Other Developments

Controller and processor obligations are being given concrete operational content through NDPO executive guidelines. Organisations are required to maintain a Personal Data Management System incorporating Data Protection Impact Assessments and Records of Processing Activities. NDPO guidelines further specify a 72-hour breach-notification window for personal-data incidents. Data processors are understood, per compliance-practitioner commentary, to carry joint and several liability with controllers for security failings, although no primary statutory citation for this specific liability position was located this cycle, so it is held at Assessed rather than High confidence.

Qatar's regulatory architecture remains structurally bifurcated between the mainland PDPPL/NDPO track and a separate QFC regime. The QFC operates its own Data Protection Regulations 2005, as amended, as a distinct data-protection framework for the QFC free zone, separate from the PDPPL/NDPO track that governs the rest of the jurisdiction. Whether the QFC's own regime carries distinct breach-notification or DPIA obligations from the NDPO guidelines described above has not been confirmed this cycle.

#### Cross-Monitor Connections

The expanding cohort of PDPPL-regulated controllers includes newly licensed payment-service providers whose customer-data handling falls within the Personal Data Management System obligation described above; the world-payments monitor tracks the licensing dimension of that expanding cohort directly, and this brief does not re-analyse the payments-licensing angle here.

#### Outlook

The cadence of NDPO binding decisions — December 2024, March 2025, February 2026 — suggests continued active enforcement is likely rather than a return to the earlier awareness-only posture, and organisations should expect further binding decisions to be issued on a broadly similar tempo. The structural bifurcation between the mainland PDPPL/NDPO regime and the QFC's own 2005 regulations remains an open question for cross-regime compliance mapping, and confirmation of whether QFC-specific breach-notification or DPIA obligations diverge from the NDPO's guidelines would be a material clarification to watch for in a future cycle.

Read full brief · 835 words

Standing brief, as of 4 November 2026.

#### Regulatory Status

The development of note in Qatar is a sector-specific data-localisation overlay reported in commentary dated 31 October 2026, describing a Qatar Central Bank Data Handling and Protection Regulation (issued February 2025) that requires central-bank-supervised financial institutions to keep the primary storage and processing environment for personal, sensitive personal and sensitive financial information inside Qatar, subject to an offshore exception requiring the central bank's explicit prior approval. This sits alongside the jurisdiction's general cross-border transfer restriction under Article 15 of Law No. 13 of 2016, which already governs transfers of personal data outside Qatar on a case-by-case adequacy basis assessed by the Compliance and Data Protection Department. The remainder of the privacy framework tracked for Qatar showed no material movement.

#### Outlook

How the sector-specific localisation requirement and the general transfer-restriction rule interact procedurally for financial-sector personal data is the detail most likely to clarify the practical compliance position for affected institutions going forward.

Read full brief · 161 words

Key regulatory facts for Qatar Regulatory Dimension Qatar Standing Position

Jurisdiction Qatar (QA)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 80 sourced findings)

Regulator & Framework Both primary instruments are identified and verifiably in force, but mainland secondary guidance (Tier-2) is thin and the dual-perimeter structure creates residual scoping ambiguity for firms operating across both.

Lawful Processing & Special Data Lawful bases, consent and special-category rules are confirmed for both regimes; pseudonymisation/anonymisation treatment is an unresolved gap.

Data Subject Rights QFC rights framework is well-documented and comprehensive; mainland rights detail and statutory response deadlines are thinly sourced.

Controller/Processor Duties Core accountability, security, ROPA and breach-notification duties are well-evidenced for the QFC; DPO-appointment obligation for firms is unresolved, and mainland retention/disposal rules were not located.

Primary Instruments Cited DataGuidance, Qatar Financial Centre, MOTC, Qatar Financial Centre Authority, Qatar Financial Centre Data Protection Office

Last Confirmed / Updated 2026-11-04 (34 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Qatar: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Both primary instruments are identified and verifiably in force, but mainland secondary guidance (Tier-2) is thin and the dual-perimeter structure creates residual scoping ambiguity for firms operating across both.

Primary framework Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data (mainland Qatar)

Supervisory authority [National Cyber Security Agency (NCSA) - National Cyber Governance and Assurance Affairs](https://www.motc.gov.qa/)

Traffic-light rationale — Amber Both primary instruments are identified and verifiably in force, but mainland secondary guidance (Tier-2) is thin and the dual-perimeter structure creates residual scoping ambiguity for firms operating across both.

#### Sub-modules (5)

#### Regulator And AuthorityAmber

Mainland: NCSA's National Cyber Governance and Assurance Affairs division is the supervisory authority for Law 13/2016. QFC free zone: the independent QFC Data Protection Office, under the QFC Authority, administers the QFC Data Protection Regulations 2021.

Claims (5):

- The National Cyber Governance and Assurance Affairs division of the National Cyber Security Agency (NCSA) is the supervisory authority for Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data in mainland Qatar.
- The QFC Data Protection Office is an independent institution of the Qatar Financial Centre charged with administering the QFC Data Protection Regulations 2021 and all aspects of data protection within the QFC.
- National Cyber Governance and Assurance Affairs (NCGAA) — NCGAA, a division of NCSA, acts as the competent authority for administering and enforcing the PDPPL on the mainland.
- Applies to all personal data electronically processed within Qatar's territory, excluding the Qatar Financial Centre Free Zone.
- National Cyber Security Agency (NCSA) / NCGAA — PDPPL via NCGAA's Compliance and Data Protection Department; NCSA clarified it (not MCIT) is the Art 26 'competent department'

#### Act And InstrumentsGreen

Mainland instrument: Law No. 13 of 2016, published in the Official Gazette 29 December 2016. QFC instrument: QFC Data Protection Regulations 2021 plus the Data Protection Rules 2021, which replaced the 2005 QFC Data Protection Regulation and Rules.

Claims (5):

- Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data was published in Qatar's Official Gazette on 29 December 2016 and became effective in 2017.
- The QFC Data Protection Regulations 2021, supported by the Data Protection Rules 2021, came into force on 19 June 2022, replacing the QFC Data Protection Regulations and Rules 2005.
- The QFC Data Protection Regulations 2021 came into force 19 June 2022, replacing the earlier QFC Data Protection Regulations 2005, and form a standalone GDPR-modelled regime for QFC-registered entities.
- QFC Data Protection Regulations and Rules 2021 came into force 19 June 2022, repealing the 2005 instruments.
- Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data — Law No. 13 of 2016 was published in Qatar's Official Gazette on 29 December 2016 and entered into effect in 2017, applying to personal data obtained or processed electronically, including through a mix of traditional and electronic methods.

#### Material ScopeGreen

Mainland Law 13/2016 covers only electronically processed personal data (or data gathered for electronic processing), excluding purely private/family processing and official surveys/statistics. QFC Regulations apply to Data Controllers/Processors incorporated or registered in the QFC.

Claims (3):

- Law No. 13 of 2016 applies only to personal data that is electronically processed, or gathered/extracted in preparation for electronic processing, and does not apply to private/family processing or data gathered for official surveys and statistics.
- The QFC Data Protection Regulations 2021 apply to a Data Controller or Data Processor incorporated or registered in the QFC.
- Law No. 13 of 2016 (PDPPL), Art 1 — personal data of an individual whose identity is defined or reasonably definable, obtained or extracted electronically, including via combined traditional/electronic processing

#### Territorial ScopeAmber

The QFC Commissioner interprets Article 7(2) as extending the Regulations to non-QFC-licensed firms that process personal data of data subjects in Qatar on an ongoing (non-occasional) basis, and QFC guidance confirms a non-QFC controller processing a QFC subsidiary's employee data for that subsidiary's benefit is itself caught. No equivalent explicit extraterritorial clause was located for mainland Law 13/2016 in the sources reviewed.

Claims (2):

- The QFC Data Protection Office interprets the Regulations as applying to non-QFC-licensed firms that process personal data of data subjects located in Qatar on an ongoing (more than occasional) basis, including non-QFC controllers processing data of a QFC subsidiary's employees.
- The QFC Data Protection Office interprets the QFC Data Protection Regulations 2021 as applying to non-QFC-licensed firms that process personal data of data subjects located in Qatar on an ongoing basis.

#### Regulator Registration And FilingAmber

QFC Data Controllers have no general obligation to register with the Data Protection Office. Mainland Law 13/2016 requires Competent Department permission before processing personal data of a 'special nature.'

Claims (2):

- QFC Data Controllers have no general obligation to register with the QFC Data Protection Office.
- Under mainland Law No. 13 of 2016, personal data of a special nature may only be processed after obtaining permission from the Competent Department, per measures determined by ministerial decision.

Qatar operates two entirely separate data-protection perimeters. Mainland Qatar is governed by Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data, supervised by the National Cyber Governance and Assurance Affairs division of the National Cyber Security Agency (NCSA), with implementation guidance historically issued via the Ministry of Transport and Communications (MOTC) Compliance and Data Protection Department. Separately, the Qatar Financial Centre (QFC) free zone operates the QFC Data Protection Regulations 2021 (in force since 19 June 2022, replacing the 2005 regime), administered by the independent QFC Data Protection Office (DPO) under the QFC Authority. The two regimes do not apply to each other's perimeter; QFC Law expressly disapplies mainland civil/regulatory law matters covered by the QFC Regulations within the QFC.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (17)
- [DataGuidance](https://www.dataguidance.com/jurisdiction/qatar-state) — The National Cyber Governance and Assurance Affairs division of the National Cyber Security Agency (NCSA) is the supervisory authority for Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data in mainland Qatar.
- [Qatar Financial Centre](https://www.qfc.qa/en/operating-with-qfc/data-protection) — The QFC Data Protection Office is an independent institution of the Qatar Financial Centre charged with administering the QFC Data Protection Regulations 2021 and all aspects of data protection within the QFC.
- [DataGuidance](https://www.dataguidance.com/jurisdiction/qatar-state) — Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data was published in Qatar's Official Gazette on 29 December 2016 and became effective in 2017.
- [Qatar Financial Centre](https://www.qfc.qa/en/operating-with-qfc/data-protection) — The QFC Data Protection Regulations 2021, supported by the Data Protection Rules 2021, came into force on 19 June 2022, replacing the QFC Data Protection Regulations and Rules 2005.
- [MOTC](https://www.motc.gov.qa/en/documents/document/qatar-issues-personal-data-privacy-law-5) — Law No. 13 of 2016 applies only to personal data that is electronically processed, or gathered/extracted in preparation for electronic processing, and does not apply to private/family processing or data gathered for official surveys and statistics.
- [Qatar Financial Centre Authority](https://www.qfc.qa/-/media/project/qfc/qfcwebsite/documentfiles/resource-center/data-protection/regulations-and-rules/qfc_data_protection_regulations_2021.pdf) — The QFC Data Protection Regulations 2021 apply to a Data Controller or Data Processor incorporated or registered in the QFC.
- [Qatar Financial Centre Data Protection Office](https://www.qfc.qa/-/media/project/qfc/qfcwebsite/documentfiles/resource-center/data-protection/regulations-and-rules/qfc-data-protection-regulations-and-rules-2021-guidance---v31.pdf) — The QFC Data Protection Office interprets the Regulations as applying to non-QFC-licensed firms that process personal data of data subjects located in Qatar on an ongoing (more than occasional) basis, including non-QFC controllers processing data of a QFC subsidiary's employees.
- [Qatar Financial Centre](https://www.qfc.qa/en/operating-with-qfc/data-protection/data-protection-for-data-controllers-and-data-processors) — QFC Data Controllers have no general obligation to register with the QFC Data Protection Office.
- [DataGuidance (unofficial translation)](https://www.dataguidance.com/sites/default/files/law_no._13_of_2016_on_protecting_personal_data_privacy_-_english.pdf) — Under mainland Law No. 13 of 2016, personal data of a special nature may only be processed after obtaining permission from the Competent Department, per measures determined by ministerial decision.
- [Mondaq](https://www.mondaq.com/data-protection/1317552/cross-border-personal-data-transfers-under-the-qatar-financial-centre-regulations) — National Cyber Governance and Assurance Affairs (NCGAA) — NCGAA, a division of NCSA, acts as the competent authority for administering and enforcing the PDPPL on the mainland.
- [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/qatar-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/qatar-data-privacy-laws/) — The QFC Data Protection Regulations 2021 came into force 19 June 2022, replacing the earlier QFC Data Protection Regulations 2005, and form a standalone GDPR-modelled regime for QFC-registered entities.
- [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/qatar](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/qatar) — Applies to all personal data electronically processed within Qatar's territory, excluding the Qatar Financial Centre Free Zone.
- [Mondaq](https://www.mondaq.com/data-protection/1317552/cross-border-personal-data-transfers-under-the-qatar-financial-centre-regulations) — QFC Data Protection Regulations and Rules 2021 came into force 19 June 2022, repealing the 2005 instruments.
- [DataProtection.gi](https://dataprotection.gi/jurisdictions/qatar/) — Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data — Law No. 13 of 2016 was published in Qatar's Official Gazette on 29 December 2016 and entered into effect in 2017, applying to personal data obtained or processed electronically, including through a mix of traditional and electronic methods.
- [DataProtection.gi](https://dataprotection.gi/jurisdictions/qatar/) — The QFC Data Protection Office interprets the QFC Data Protection Regulations 2021 as applying to non-QFC-licensed firms that process personal data of data subjects located in Qatar on an ongoing basis.
- [https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/qatar](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/qatar) — National Cyber Security Agency (NCSA) / NCGAA — PDPPL via NCGAA's Compliance and Data Protection Department; NCSA clarified it (not MCIT) is the Art 26 'competent department'
- [https://securiti.ai/qatar-personal-data-protection-law/](https://securiti.ai/qatar-personal-data-protection-law/) — Law No. 13 of 2016 (PDPPL), Art 1 — personal data of an individual whose identity is defined or reasonably definable, obtained or extracted electronically, including via combined traditional/electronic processing

### Qatar: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Lawful bases, consent and special-category rules are confirmed for both regimes; pseudonymisation/anonymisation treatment is an unresolved gap.

Primary framework Law No. 13 of 2016 (mainland); QFC Data Protection Regulations 2021, Articles 10-12 (QFC)

Supervisory authority [National Cyber Security Agency (NCSA)](https://www.motc.gov.qa/)

Traffic-light rationale — Amber Lawful bases, consent and special-category rules are confirmed for both regimes; pseudonymisation/anonymisation treatment is an unresolved gap.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 57 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

QFC rights framework is well-documented and comprehensive; mainland rights detail and statutory response deadlines are thinly sourced.

Primary framework QFC Data Protection Regulations 2021, Articles 16-22

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Amber QFC rights framework is well-documented and comprehensive; mainland rights detail and statutory response deadlines are thinly sourced.

#### Sub-modules (5)

#### Access RightGreen

QFC Article 16 establishes the right to access.

Claims (1):

- The QFC Data Protection Regulations 2021 grant data subjects a right to access their personal data (Article 16).

#### Rectification And ErasureGreen

QFC Articles 17-18 establish rights to rectification and erasure.

Claims (1):

- The QFC Data Protection Regulations 2021 grant data subjects rights to rectification (Article 17) and erasure (Article 18).

#### Restriction And ObjectionGreen

QFC Articles 19-20 establish rights to object (including opt-out from automated decision-making/profiling) and to restriction of processing.

Claims (1):

- The QFC Data Protection Regulations 2021 grant data subjects rights to object (Article 19), to restriction of processing (Article 20), and not to be subject to automated individual decision-making, including profiling.

#### Data PortabilityGreen

The QFC Regulations grant data subjects a right to data portability.

Claims (2):

- Data subjects under the QFC Data Protection Regulations 2021 are empowered with a right to data portability.
- QFC Data Protection Rules / QDPR 2021 Article 34 — In exercising the right to data portability, the Data Subject has the right to have personal data transmitted directly from one Data Controller to another, where technically feasible.

#### Deadlines And Response WindowsRed

QFC guidance references a 'without undue delay' standard for controller action on some data-subject requests, but a codified numeric response window (e.g., 30 days) was not confirmed in the sources reviewed for either regime, and no mainland deadline provision was located.

Claims (1):

- QFC Data Protection Regulations 2021 guidance references an obligation for controllers to provide personal data to a data subject without undue delay in response to certain requests.

The QFC Data Protection Regulations 2021 provide a full rights suite (access, rectification, erasure, objection, restriction, portability, and a right not to be subject to solely automated decision-making including profiling) at Articles 16-22. Mainland Law 13/2016's rights framework is less granularly documented in the sources reviewed beyond the consent-withdrawal right; a specific mainland statutory response-time deadline for subject requests was not located.

Sources and claims (6)
- [Qatar Financial Centre Authority](https://www.qfc.qa/-/media/project/qfc/qfcwebsite/documentfiles/resource-center/data-protection/regulations-and-rules/qfc_data_protection_regulations_2021.pdf) — The QFC Data Protection Regulations 2021 grant data subjects a right to access their personal data (Article 16).
- [Qatar Financial Centre Authority](https://www.qfc.qa/-/media/project/qfc/qfcwebsite/documentfiles/resource-center/data-protection/regulations-and-rules/qfc_data_protection_regulations_2021.pdf) — The QFC Data Protection Regulations 2021 grant data subjects rights to rectification (Article 17) and erasure (Article 18).
- [Qatar Financial Centre](https://www.qfc.qa/en/operating-with-qfc/data-protection/data-protection-for-individuals) — The QFC Data Protection Regulations 2021 grant data subjects rights to object (Article 19), to restriction of processing (Article 20), and not to be subject to automated individual decision-making, including profiling.
- [Qatar Financial Centre](https://www.qfc.qa/en/operating-with-qfc/data-protection/data-protection-for-individuals) — Data subjects under the QFC Data Protection Regulations 2021 are empowered with a right to data portability.
- [Qatar Financial Centre Authority](https://www.qfc.qa/-/media/project/qfc/qfcwebsite/documentfiles/resource-center/data-protection/regulations-and-rules/qfc_data_protection_regulations_2021.pdf) — QFC Data Protection Regulations 2021 guidance references an obligation for controllers to provide personal data to a data subject without undue delay in response to certain requests.
- [QFC Regulatory Authority](https://qfcra-en.thomsonreuters.com/sites/default/files/net_file_store/QFCA_CP2021-01_appendix_2_20210614_DATA_PROTECTION_RULES.pdf) — QFC Data Protection Rules / QDPR 2021 Article 34 — In exercising the right to data portability, the Data Subject has the right to have personal data transmitted directly from one Data Controller to another, where technically feasible.

### Qatar: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Core accountability, security, ROPA and breach-notification duties are well-evidenced for the QFC; DPO-appointment obligation for firms is unresolved, and mainland retention/disposal rules were not located.

Primary framework QFC Data Protection Regulations 2021, Articles 25-31

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Amber Core accountability, security, ROPA and breach-notification duties are well-evidenced for the QFC; DPO-appointment obligation for firms is unresolved, and mainland retention/disposal rules were not located.

Periodic update · new data 2026-10-11

#### Controller/Processor Duties

Qatar's controller and processor duties framework under Law No. (13) of 2016 on Protecting Personal Data Privacy centres this cycle on a confirmed breach-notification obligation and a documented enforcement outcome tied to that same set of duties. Under PDPPL Articles 13 and 14, a data processor is required to immediately notify the controller upon becoming aware of a personal-data breach, and the controller is in turn required to notify the National Cyber Governance and Assurance Affairs department within 72 hours of becoming aware of the breach. This is a specific, dated obligation with an exact deadline rather than an open-ended duty, and it sits at the core of Qatar's controller/processor accountability structure.

The practical weight of this obligation is reinforced by enforcement history. In February 2026, the National Cyber Security Agency's National Data Privacy Office issued Binding Decision No. 3 of 2025 against a Qatari sports-sector company, finding violations of PDPPL Articles 8(3), 13 and 14 on the basis that the company had failed to implement adequate security measures. Article 8(3) concerns the general duty to implement appropriate security measures, while Articles 13 and 14 concern the breach-notification duty itself; a single enforcement decision citing all three articles together indicates that the regulator is prepared to find that inadequate security measures and inadequate breach-handling can be charged as related violations arising from the same underlying facts, rather than treating the security-measures duty and the notification duty as entirely separate compliance tracks. This decision predates the current cycle's recency window, having been issued in February 2026, but is carried forward here as background because it is the clearest available evidence of how Qatar's National Data Privacy Office approaches controller/processor accountability in practice, as distinct from the text of the statute alone.

The combination of a specific, time-bound breach-notification deadline and at least one documented enforcement decision applying that same provision set is a meaningfully different picture from a purely paper regime: it indicates Qatar's controller/processor duties framework has moved into an active-enforcement phase, at least with respect to breach-notification and security-measures failures, rather than remaining an untested statutory structure. This is the kind of structural, architecture-level observation that matters more than the specific sports-sector company involved: the significance lies in the demonstrated willingness of the National Data Privacy Office to issue binding decisions under these provisions, not in the identity of the sanctioned entity.

#### Outlook

The 72-hour controller-to-regulator breach-notification deadline under PDPPL Articles 13 and 14 is a settled, in-force obligation and no change to its substantive terms is indicated by current evidence. The more significant open question is whether the February 2026 Binding Decision No. 3 of 2025 represents an isolated enforcement action or the beginning of a more sustained enforcement pattern under the same provision set; further binding decisions citing Articles 8(3), 13 or 14, should they be issued, would be the clearest signal of a sustained active-enforcement trajectory in this domain. A documentation gap also remains around whether a formal data-protection-officer appointment threshold exists under either the PDPPL or the separate QFC Data Protection Regulations and Rules 2021, which was not located from a primary source this cycle and would be a relevant addition to the controller/processor duties picture if confirmed in a future cycle.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 84 words · 13 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Transfer mechanisms, adequacy-list governance, and SCC/BCR uptake are well-evidenced for the QFC; adequacy received from other regimes and a formal TIA requirement are unconfirmed gaps.

Primary framework QFC Data Protection Regulations 2021, Articles 23-24

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Amber Transfer mechanisms, adequacy-list governance, and SCC/BCR uptake are well-evidenced for the QFC; adequacy received from other regimes and a formal TIA requirement are unconfirmed gaps.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 120 words · 12 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾

Only the financial-sector overlay (QFC) and a limited employment-data example are evidenced; health, credit, education, and insurance sub-modules are unpopulated.

Primary framework QFC Data Protection Regulations 2021 (financial free-zone overlay)

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Red Only the financial-sector overlay (QFC) and a limited employment-data example are evidenced; health, credit, education, and insurance sub-modules are unpopulated.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 86 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾

Only direct marketing is evidenced; the remaining five sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) are unpopulated gaps.

Primary framework Law No. 13 of 2016 (mainland) - direct marketing provision only

Supervisory authority [National Cyber Security Agency (NCSA)](https://www.motc.gov.qa/)

Traffic-light rationale — Red Only direct marketing is evidenced; the remaining five sub-modules (cookies, dark patterns, opt-out signals, clean rooms, cross-context advertising) are unpopulated gaps.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 42 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Profiling/ADM restriction is confirmed for the QFC; AI risk-assessment, biometric, genetic, and surveillance-carveout sub-modules are largely unconfirmed or absent.

Primary framework QFC Data Protection Regulations 2021, Article 19 (right to object, including to automated decision-making)

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Amber Profiling/ADM restriction is confirmed for the QFC; AI risk-assessment, biometric, genetic, and surveillance-carveout sub-modules are largely unconfirmed or absent.

Periodic update · new data 2026-10-25

#### Algorithmic, Biometric & Surveillance Governance

Qatar's approach to AI governance in the personal-data context runs through the National Cyber Security Agency's Guidelines for Secure Adoption and Usage of Artificial Intelligence rather than through a standalone AI statute. These guidelines require that AI systems processing personal data comply with the Personal Data Privacy Protection Law's existing requirements on data minimisation, purpose limitation and lawful bases for processing, and layer onto that an additional expectation that such systems incorporate auditability, traceability and documentation. The guidance is confirmed to exist and to state these requirements, though it is supervisory guidance rather than enacted legislation, meaning the obligations it describes do not independently carry statutory force distinct from the PDPPL provisions they reference.

The structural significance of this approach is that Qatar has not created a parallel AI-specific data-protection regime; instead, the NCSA has extended the interpretive reach of the 2016 Personal Data Privacy Protection Law to cover AI-driven processing by reference to the law's existing core principles. For entities deploying AI systems that process personal data in Qatar, this means the operative legal obligations remain anchored in the PDPPL itself, with the Guidelines functioning as the regulator's stated expectation of how those existing obligations apply to an AI processing context, plus an additional auditability and traceability expectation that is not itself drawn directly from the PDPPL's text.

This extension-by-guidance pattern is notable because it avoids the legislative delay associated with drafting and enacting standalone AI legislation, allowing the NCSA to signal expectations for AI-driven personal-data processing without waiting for a dedicated statutory framework. Whether Qatar will in time move toward binding AI-specific data-protection rules, or will continue to rely on guidance-level extension of the PDPPL's existing principles, is not resolved by the material available. The guidance itself does not specify enforcement consequences distinct from the PDPPL's own enforcement and penalty architecture, so questions about how a breach of the auditability or traceability expectations specifically would be treated by the NCSA remain open.

#### Outlook

The guidance-based approach to AI governance leaves open whether Qatar intends a standalone AI-specific data-protection instrument in the medium term, or will continue developing this area through NCSA guidance that extends the PDPPL's reach. Entities operating AI systems that process personal data in Qatar should expect the NCSA's stated auditability, traceability and documentation expectations to remain the operative benchmark for compliance posture, absent a change to this guidance-led approach becoming apparent in future cycles.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 79 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾

Only the mainland parental-consent rule for children's websites is evidenced; the remaining four sub-modules are unpopulated gaps.

Primary framework Law No. 13 of 2016, Article 17 (mainland)

Supervisory authority [National Cyber Security Agency (NCSA)](https://www.motc.gov.qa/)

Traffic-light rationale — Red Only the mainland parental-consent rule for children's websites is evidenced; the remaining four sub-modules are unpopulated gaps.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 55 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Qatar: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Regulator powers, penalties, and enforcement activity are well-evidenced for the QFC; recent (180-day) developments, regulator funding/capacity, and collective-redress mechanisms are unconfirmed gaps.

Primary framework QFC Data Protection Regulations 2021, Articles 33-36

Supervisory authority [QFC Data Protection Office](https://www.qfc.qa/)

Traffic-light rationale — Amber Regulator powers, penalties, and enforcement activity are well-evidenced for the QFC; recent (180-day) developments, regulator funding/capacity, and collective-redress mechanisms are unconfirmed gaps.

Periodic update · new data 2026-10-25

#### Enforcement & Redress

Qatar's National Cyber Security Agency, acting through its Compliance and Data Protection Department, is reported to have become substantially more active in enforcement since 2024, with three documented enforcement actions identified across the ICT, e-commerce and construction sectors. This characterisation is drawn from secondary commentary rather than from a confirmed, directly sourced NCSA enforcement register, and should be read with that provenance in mind: the underlying actions themselves have not been independently verified from a primary regulatory source, so the trend is reported rather than confirmed.

Alongside this reported enforcement uptick, the NCSA engaged in a more directly evidenced public-facing activity on 6 September 2026, when it reaffirmed the Personal Data Privacy Protection Law's core personal-data-privacy-protection principles through a dedicated awareness initiative. This is a lower-materiality development than the enforcement-trend commentary, but it is sourced to contemporaneous Tier-2 reporting and confirms that the regulator continued to engage publicly with the statute's framework in the period covered.

Read together, the two developments describe a regulator that is simultaneously reported to be escalating its enforcement posture across a widening range of sectors, while also continuing to invest in public education about the underlying law's principles. The sectoral spread reported for the enforcement actions, touching ICT, e-commerce and construction, suggests that NCSA enforcement attention is not confined to a single sector type, though the absence of a primary enforcement register means the specific facts, penalties and legal bases of the three reported actions cannot be set out here.

The redress side of this module, meaning the mechanisms by which an individual affected by a PDPPL breach can seek a remedy, was not independently confirmed from primary sources, and no finding is made on that point.

#### Outlook

Whether the reported enforcement increase since 2024 is sustained or represents a cluster of several actions concentrated in a shorter period remains an open question pending the availability of a primary NCSA enforcement log. The 6 September 2026 awareness reaffirmation is confirmed and suggests continued regulator engagement with public understanding of the PDPPL's principles, a pattern that may recur in future reporting periods as the NCSA continues to build out its compliance and enforcement function.

Periodic update · new data 2026-10-18

#### Enforcement & Redress

Qatar's National Cyber Security Agency, acting through its Compliance and Data Protection Department, is reported to have become substantially more active in enforcement since 2024, with three documented enforcement actions identified across the ICT, e-commerce and construction sectors. This characterisation is drawn from secondary commentary rather than from a confirmed, directly sourced NCSA enforcement register, and should be read with that provenance in mind: the underlying actions themselves have not been independently verified from a primary regulatory source this cycle, so the trend is reported rather than confirmed.

Alongside this reported enforcement uptick, the NCSA engaged in a more directly evidenced public-facing activity on 6 September 2026, when it reaffirmed the Personal Data Privacy Protection Law's core personal-data-privacy-protection principles through a dedicated awareness initiative. This is a lower-materiality development than the enforcement-trend commentary, but it is sourced to contemporaneous Tier-2 reporting and confirms that the regulator continued to engage publicly with the statute's framework in the period covered.

Read together, the two developments describe a regulator that is simultaneously reported to be escalating its enforcement posture across a widening range of sectors, while also continuing to invest in public education about the underlying law's principles. The sectoral spread reported for the enforcement actions, touching ICT, e-commerce and construction, suggests that NCSA enforcement attention is not confined to a single sector type, though the absence of a primary enforcement register means the specific facts, penalties and legal bases of the three reported actions cannot be set out here.

The redress side of this module, meaning the mechanisms by which an individual affected by a PDPPL breach can seek a remedy, was not independently confirmed from primary sources this cycle, and no finding is made on that point.

#### Outlook

Whether the reported enforcement increase since 2024 is sustained or represents a cluster of several actions concentrated in a shorter period remains an open question pending the availability of a primary NCSA enforcement log. The 6 September 2026 awareness reaffirmation is confirmed and suggests continued regulator engagement with public understanding of the PDPPL's principles, a pattern that may recur in future reporting periods as the NCSA continues to build out its compliance and enforcement function.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 168 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted

Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions

Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties