Qatar

Law No. 13 of 2016 on the Protection of Personal Data Privacy defines its reach by the type of work being done. It does not define it by where the company sits. Article 2 covers personal data handled electronically. It also covers data obtained or collected any other way in preparation for electronic handling. And it covers data handled by a mix of electronic and traditional means. It does not cover data used by individuals for personal or family purposes. It also does not cover data used to produce official statistics under Law No. 2 of 2011. None of the 32 articles says which territory the law applies to. There is no threshold, no duty to register and no duty to appoint someone in the country. Article 16 is the practical catch. Some data may not be handled at all without a permit from the competent department. That covers ethnic origin, children, health or physical or mental condition, religious belief, marital relationship and criminal offences. The procedures for that permit are to be set by a decision of the Minister. The law has no clause about reaching outside Qatar. So whether it binds a company based abroad is a question of general Qatari law. The law itself does not answer it, and we found no official interpretation either way. Inside the Qatar Financial Centre a different rule applies. Article 2 of the QFC Data Protection Regulations 2021 switches off State of Qatar law on these matters within the Centre.

Overall rating: it depends on your industry. Here are the exceptions, each with its own rating. - All industries, general law: open. Article 15 of Law No. 13 of 2016 bans a company from taking any decision or step that would restrict personal data flowing across the border. The only exceptions are where the use of the data breaks the law, or would seriously harm the data or the person's privacy. There is no approved-country list, no filing and no contract requirement. Breaking Article 15 carries a fine of up to one million Qatari riyals. So the duty runs the opposite way from most countries. - Banking, insurance, payments, securities and every other central-bank licensee: closed. Clause 15.1 of the Qatar Central Bank Data Handling and Protection Regulation covers financial institutions. They must not store or send personal data, personally identifiable information, sensitive personal information or sensitive financial information to another country. They may only do so with the central bank's approval. Clause 21.4 of the central bank's Cloud Computing Regulation has been in force since 15 April 2024. It says personally identifiable information and financial information must be handled within Qatar only. Clause 21.5 requires the bank's approval before you enter any cloud arrangement at all. - Payments, specifically: closed for encryption keys. Clause 6.8 of the Information and Cyber Security Regulation for Payment Service Providers applies. The key management system and private keys must be created and stored outside the cloud, on premises in Qatar. - Insurance and banking, specifically: a people-and-place rule as well. Two rules apply here: the Insurance Sector Cyber Security Regulation and the Technology Risks Regulation for Banks. Both require the round-the-clock security operations centre to be on site or in Qatar. - Qatar Financial Centre: conditional, and outside the national law. Article 23 of the QFC Data Protection Regulations 2021 allows transfers to a country the Centre's Data Protection Office has officially decided is safe enough. Article 24 allows transfers elsewhere on standard clauses, group-wide rules, a permit, or one of a short list of narrow exceptions. - Telecoms: we found no rule forcing data to stay in the country, checked 18 August 2026. The Communications Regulatory Authority issued its Communications Consumer Protection Policy and Regulation on 2 October 2024. It covers customer data privacy but points back to the Telecommunications By-Law. It sets no storage location. - Government and public sector: we found no published rule forcing data to stay in the country, checked 18 August 2026, confidence low. The Cloud Policy Framework points government bodies to the National Information Assurance Policy for classifying government data. We could not get that policy from an official source. - Health, education, gambling and mapping: we searched the national gazette on 18 August 2026 and found no rule forcing data to stay in the country. Confidence low. Gambling is unlawful in Qatar, so there are no gaming rules to check. The national cloud policy pushes the other way from the banking rules. The Communications Regulatory Authority published its Cloud Policy Framework on 7 June 2022. It recommends dropping the requirement that data stay in the country. It says data should only be kept inside Qatar when it is highly sensitive. But it is a policy document, not a binding law.

Three different models sit side by side. General law: no restrictions. Article 15 of Law No. 13 of 2016 does more than allow data to cross the border. It bans a company from restricting it. The only exceptions are where the use of the data breaks the law, or would seriously harm the data or the person's privacy. There is no list of banned countries and no list of approved ones. So there is nothing here that can quietly fill up. The exception is written as a duty on the company. It is not a power for the regulator to name countries. Central bank licensees: government permission, case by case. Clause 15.1 of the Data Handling and Protection Regulation requires the bank's approval first. That applies before you store or send personal data, personally identifiable information, sensitive personal information or sensitive financial information to another country. Clauses 15.2 to 15.4 add checks on the destination and on how safe it is. Clause 21.5 of the Cloud Computing Regulation requires approval before you enter a cloud arrangement. Clause 23 lets a firm apply to be excused from any requirement. The bank must approve that, and the excuse must carry an expiry date. Neither regulation publishes a list of approved countries or a public register of approvals. Qatar Financial Centre: approved countries plus safeguards. Article 23 lets the Data Protection Office decide that a country is safe enough. It must publish those decisions. Article 24 covers everything else. You have six options. Standard data protection clauses adopted by the Data Protection Office. A legally binding arrangement between public bodies. Group-wide rules approved by the Office. Another approved international method. A permit from the Office. Or one of seven narrow exceptions. Those exceptions include explicit informed consent, need to perform a contract, a legal duty, vital interests, public interest and legal claims. There is also a fallback route for one-off transfers of small amounts of non-sensitive data, backed by a written assessment. We could not check from an official source whether the Office has actually published a list of approved countries.

The privacy law was written for the Ministry of Transport and Communications. The Ministry is the 'Ministry' and its administrative unit is the 'competent department'. Emiri Decision No. 1 of 2021 was published on 24 March 2021. It created the National Cyber Security Agency as a body with its own legal identity and budget. The agency reports to the Prime Minister. Article 3(21) gives it the job of applying the laws, rules and decisions on personal data privacy. Is it working? Partly. The agency clearly exists and functions on cyber security. Decrees No. 11 and No. 38 of 2024 ratify cooperation agreements it signed with foreign cybersecurity agencies. What we could not find is any published data protection decision, fine or guidance from an official Qatari source. The agency's website serves its content from a host we could not reach. The national services portal was showing a maintenance page when we checked on 18 August 2026. On the evidence we can see, this regulator is waking up rather than active. One structural point is easy to miss. The penalties in Articles 23 to 25 of the privacy law are criminal fines, not administrative ones. Article 29 lets the Attorney-General, agreeing with the Minister, give Ministry staff the status of judicial officers. They can then detect and record offences under the law. That was done once, by Attorney-General Decision No. 106 of 2017. It named exactly six people, including digital-evidence specialists and a network security specialist. All six sat at the Ministry of Transport and Communications. That ministry no longer holds the data protection job. We found no equivalent appointment at the National Cyber Security Agency. So the criminal enforcement machinery for this law appears to have no named officers behind it today. Article 26 gives the competent department a separate, softer route. It can investigate a complaint and order a company or its supplier to fix the breach within a set time. You can appeal to the Minister within sixty days. Once the Minister decides, there is no further appeal. Other regulators. The Qatar Central Bank supervises every licensed financial institution. It enforces its own data, cloud and cyber rules through its supervision teams. Its rules say breaches must be reported to it, to the National Cyber Security Agency and to the Ministry of Interior. The Communications Regulatory Authority regulates telecoms and is visibly active. It published decisions and consultations through 2026. Inside the Qatar Financial Centre, the Data Protection Office has its own powers under Part 6 of the QFC Data Protection Regulations. Those include permits, orders and penalties.

The maximum. Article 10 of Law No. 13 of 2016 says you must check that personal data is relevant, adequate, accurate, complete and up to date for the purpose you hold it for. You must not keep it longer than you need it for that purpose. Article 5(3) lets a person demand deletion once the purpose has ended. The same applies where you have no justification for keeping the data. The law states no maximum period anywhere. The minimum. Article 21 of the cybercrime law, Law No. 14 of 2014, requires a service provider to keep subscriber information for one year. It must also preserve information-technology data, traffic data or content information for ninety days, renewable. That applies when the competent authority or the investigating and prosecuting bodies ask. Article 22 covers state organs, institutions, bodies and their subsidiaries and companies. They must keep information-technology data and subscriber information for at least one hundred and twenty days, and hand it over on request. For financial institutions, clause 11.3 of the Qatar Central Bank Data Handling and Protection Regulation sets minimum periods. They are ten years for sensitive financial information, and for personal data, personally identifiable information and sensitive personal information. Technical information is one year. Everything else is left to the institution. Clause 11.4 requires longer where another law demands it. Ordinary company and tax record-keeping periods under Qatari commercial and tax law apply on top. We did not check those. What happens when they clash. Nothing in the privacy law settles a clash between a deletion request and a duty to keep data. The specific duty to keep the record wins. Article 19 of the privacy law helps here. It excuses you from the consent and rights rules when you are carrying out a legal duty or a court order. We could not find an official ruling or guidance saying this in so many words.

Clock one, the general law. Article 13 of Law No. 13 of 2016 covers suppliers. A supplier must tell the company it works for about any failure of the security measures. The same applies to any risk threatening people's personal data. It must do so as soon as it knows. Article 14 requires the company itself to tell both the person and the competent department about any such failure. That duty applies where the failure would cause serious harm to the data or to the person's privacy. No hour count appears in the law. We found no decision setting one. Breaking Article 14 carries a fine of up to one million Qatari riyals, about two hundred and seventy-five thousand United States dollars. Breaking the security duty in Article 13 carries up to five million riyals, about one and a third million dollars. Clock two, financial services. Clauses 16.1 to 16.3 of the Qatar Central Bank Data Handling and Protection Regulation apply to financial institutions. They must treat any data breach or data privacy breach as an incident. They must report it under the bank's incident reporting guidelines. They must report it to the central bank and to the authorised agencies in Qatar. The regulation names those as the National Cyber Security Agency and the Ministry of Interior. The incident reporting guidelines are not on the bank's public site. So the actual hour count cannot be checked publicly. Clock three, the Qatar Financial Centre. Article 31 of the QFC Data Protection Regulations requires you to report a personal data breach. DATA 9 of the QFC Data Protection Rules adds a deadline. A report made more than seventy-two hours after you became aware must explain the delay. The report must describe the types and rough numbers of people and records affected, the likely consequences, and what you have done about it. A fourth clock applies to the public sector. Article 22 of the cybercrime law covers state bodies. They must report any offence under that law to the competent authority as soon as they discover it. That includes any attempted unlawful interception or eavesdropping. They must supply all the information needed to establish the facts.

1. The fines are criminal. Articles 23 to 25 of Law No. 13 of 2016 are written as criminal penalties. A person is 'punished' with a fine of up to one million riyals for breaking the core duties. The fine rises to five million riyals for breaking the security duty, the sensitive-data permit duty or the children's website duty. A company faces up to one million riyals where an offence is committed in its name and for its account. That does not remove the criminal liability of the individual responsible. So this means prosecution, a criminal record and personal exposure for named people. It is not an administrative penalty notice. 2. Sensitive data needs a permit you cannot apply for. Article 16 bans handling data on ethnic origin, children, health or physical or mental condition, religious belief, marital relationship or criminal offences. You need a permit from the competent department first. The procedure is to be fixed by a decision of the Minister. We found no such decision published in the official gazette. The ban is written as absolute and carries the five-million-riyal penalty. So the gap is a live commercial risk, not a technicality. The Minister can also add new types of sensitive data by decision at any time. 3. There is no defined age for a child. Article 17 places real duties on any website aimed at children. Publish what children's data you collect and how you use it. Get the express consent of the child's guardian, electronically or by another suitable means. Give the guardian a description and a copy of the data on request. Delete the data or stop using it if the guardian asks. Never make joining a game or a prize offer conditional on handing over more data than the activity needs. The definitions article does not define 'child'. Under general Qatari law the age of majority is eighteen. That is higher than the thirteen many global platforms use. 4. Photographing people in public is now a crime. Law No. 11 of 2025 was published on 4 August 2025. It added Article 8 bis to the cybercrime law. It is now an offence to publish or share photographs or video of people while they are in public places. That applies where they did not know or did not agree, and outside the cases the law allows. It covers publishing over the internet or by any information technology means. The penalty is up to one year in prison, a fine of up to one hundred thousand riyals, or both. That fine is about twenty-seven thousand United States dollars. This catches ordinary marketing footage, event photography and street-level product images. 5. The free zone is a different country for this purpose. Article 2 of the QFC Data Protection Regulations 2021 is clear. As far as the QFC Law permits, the laws, rules and regulations of the State of Qatar on these matters do not apply inside the Centre. A group with companies on both sides of that line needs two compliance programmes, not one. 6. A bonus trap that runs backwards. Article 15 makes it an offence for a company to restrict data flowing across the border. A well-meaning internal policy that blocks all use of data abroad is, read literally, the thing the law punishes.

Confirmed and already in force. Law No. 11 of 2025 is dated 21 July 2025. It was published in Official Gazette issue 20 of 4 August 2025. It added the public-place photography offence to the cybercrime law. The Qatar Central Bank Cloud Computing Regulation has been in force since 15 April 2024. The Data Handling and Protection Regulation was published on the bank's site in February 2025. Pending. The Communications Regulatory Authority has issued a Spam Regulation and consulted on an amended draft. But the two live consultations on its site on 18 August 2026 were about radio spectrum fees and postal licence fees. Neither touches data. No change to Law No. 13 of 2016 has been gazetted since it was passed. The law's card on the official legal portal shows no amendments. Powers that already exist and could be switched on. These matter more than pending bills. - Article 16 lets the Minister add new types of sensitive personal data by decision alone, and set extra protective measures for them. Whole datasets could move into permit-only territory with no consultation. - Articles 7, 8(4), 16 and 18 all call for decisions of the Minister that we could not find published. Issuing them would turn a broadly worded law into a detailed set of rules overnight. - Article 30 lets the Cabinet extend the compliance period 'for a similar period or periods' on the Minister's proposal. It has already used that power once. - Article 18 lets any competent government body switch off the consent rule, the notice rule, the cross-border flow rule and the children's rule. The grounds are national security, public security, international relations, the State's economic or financial interests, or preventing, detecting or investigating crime. The body only has to keep an internal record of what it did. - Clause 23 of the central bank's Cloud Computing Regulation and clause 17 of its Data Handling and Protection Regulation make every exemption time-limited and revocable. A bank's permission to handle data abroad can lapse or be withdrawn. - Under Article 23 of the QFC Data Protection Regulations, a country can lose its safe-enough status at any time. The Data Protection Office simply issues an updated list.