Qatar

Law No. 13 of 2016 on the Protection of Personal Data Privacy defines its reach by the type of processing, not by where the company sits. Article 2 applies the law to personal data processed electronically, or obtained or collected in any other way in preparation for electronic processing, or processed by a mix of electronic and traditional means. It excludes data processed by individuals for personal or family purposes, and data processed to produce official statistics under Law No. 2 of 2011. There is no territorial-scope article, no threshold, no registration duty and no in-country representative duty anywhere in the 32 articles. Article 16 is the practical catch: data on ethnic origin, children, health or physical or mental condition, religious belief, marital relationship and criminal offences may not be processed at all without a permit from the competent department, under procedures to be set by a decision of the Minister. Because the statute has no extraterritoriality clause, whether it binds an offshore controller is a question of general Qatari law rather than a question the statute answers, and we could not find an official interpretation either way. Inside the Qatar Financial Centre a different rule applies: Article 2 of the QFC Data Protection Regulations 2021 disapplies State of Qatar law on these matters within the Centre.

Headline rating: sectoral. Overrides, each with its own rating: - All industries, general law — open. Article 15 of Law No. 13 of 2016 prohibits a controller from taking any decision or measure that would restrict the cross-border flow of personal data, unless the processing breaches the law or would cause serious harm to the data or to the individual's privacy. There is no approved-country list, no filing, and no contract requirement. Breaching Article 15 is punishable by a fine of up to one million Qatari riyals, so the duty runs in the opposite direction from most countries. - Banking, insurance, payments, securities and every other central-bank licensee — closed in practice. Clause 15.1 of the Qatar Central Bank Data Handling and Protection Regulation says a financial institution must not store or transfer personal data, personally identifiable information, sensitive personal information or sensitive financial information to a foreign jurisdiction unless it has received approval from the central bank. Clause 21.4 of the central bank's Cloud Computing Regulation, in force since 15 April 2024, says an entity must ensure that personally identifiable information and financial information is processed within Qatar only, and clause 21.5 requires the bank's approval before entering any cloud arrangement at all. - Payments specifically — closed for encryption keys. Clause 6.8 of the Information and Cyber Security Regulation for Payment Service Providers requires the key management system and private keys to be generated and stored outside the cloud, on premises in Qatar. - Insurance and banking specifically — a person-and-place rule as well. Both the Insurance Sector Cyber Security Regulation and the Technology Risks Regulation for Banks require the round-the-clock security operations centre to be on site or in Qatar. - Qatar Financial Centre — conditional, and outside the national law. Article 23 of the QFC Data Protection Regulations 2021 allows transfers to a jurisdiction the Centre's Data Protection Office has decided is adequate. Article 24 allows transfers elsewhere on standard clauses, binding corporate rules, a permit, or one of a short list of narrow exceptions. - Telecoms — no localisation rule found, checked 18 August 2026. The Communications Regulatory Authority's Communications Consumer Protection Policy and Regulation of 2 October 2024 covers customer data privacy but points back to the Telecommunications By-Law rather than imposing a storage location. - Government and public sector — no published localisation rule found, checked 18 August 2026, confidence low. The Cloud Policy Framework directs government bodies to the National Information Assurance Policy for classifying government data, and we could not obtain that policy from an official source. - Health, education, gambling and mapping — no localisation rule found in the national gazette, checked 18 August 2026, confidence low. Gambling is unlawful in Qatar, so no gaming regime exists to check. The national cloud policy pushes the other way from the banking rules. The Cloud Policy Framework published by the Communications Regulatory Authority on 7 June 2022 recommends that data residency should no longer be a requirement and that localisation be reserved for highly sensitive data. It is a policy document, not a binding instrument.

Three different models sit side by side. General law: unrestricted. Article 15 of Law No. 13 of 2016 does not merely permit cross-border flow, it forbids a controller from restricting it except where the processing breaches the law or would seriously harm the data or the individual's privacy. There is no blocklist and no allowlist to be populated, so there is nothing that can quietly fill up. Note that the exception is drafted as a duty on the controller, not as a power for the regulator to name countries. Central bank licensees: case-by-case government authorisation. Clause 15.1 of the Data Handling and Protection Regulation requires the bank's approval before storing or transferring personal data, personally identifiable information, sensitive personal information or sensitive financial information to a foreign jurisdiction. Clauses 15.2 to 15.4 add a due-diligence and adequacy assessment on the destination. Clause 21.5 of the Cloud Computing Regulation requires approval before entering a cloud arrangement, and clause 23 lets an entity apply for an exemption from any requirement, which the bank must approve and which must carry an expiry date. Neither regulation publishes a list of approved destinations or a public register of approvals. Qatar Financial Centre: allowlist plus safeguards. Article 23 lets the Data Protection Office decide that a jurisdiction is adequate, and requires it to publish those decisions. Article 24 covers everything else: standard data protection clauses adopted by the Data Protection Office, a legally binding arrangement between public bodies, binding corporate rules approved by the Office, another approved international mechanism, a permit from the Office, or one of seven narrow exceptions including explicit informed consent, contract necessity, legal obligation, vital interests, public interest and legal claims. There is also a residual route for one-off, small-volume, non-sensitive transfers backed by a documented assessment. We could not verify from an official source whether the Office has actually published an adequacy list.

The privacy law was written for the Ministry of Transport and Communications: the Ministry is the 'Ministry' and its administrative unit is the 'competent department'. Emiri Decision No. 1 of 2021, published on 24 March 2021, created the National Cyber Security Agency as a body with its own legal personality and budget reporting to the Prime Minister, and Article 3(21) gives it the job of implementing the laws, regulations and decisions relating to the protection of personal data privacy. Is it operational? Partly. The agency plainly exists and functions in its cybersecurity role: Decrees No. 11 and No. 38 of 2024 ratify cooperation memoranda it signed with foreign cybersecurity agencies. What we could not find is any published data protection decision, fine or guidance document from an official Qatari source. The agency's own website is a single-page application whose content is served from a host we could not reach, and the national services portal was returning a maintenance page when checked on 18 August 2026. On observable evidence this is a waking regulator, not an active one. A structural point that is easy to miss: the penalties in Articles 23 to 25 of the privacy law are criminal fines, not administrative ones. Article 29 of the law lets the Attorney-General, in agreement with the Minister, give Ministry staff the status of judicial officers so they can detect and record offences under it. That was done once, by Attorney-General Decision No. 106 of 2017, and it named exactly six people, among them digital-evidence specialists and a network security specialist, all at the Ministry of Transport and Communications. That ministry no longer holds the data protection function, and no equivalent appointment at the National Cyber Security Agency could be found, so the criminal-enforcement machinery for this law appears to have no named officers behind it today. Article 26 gives the competent department a separate, softer route: it can investigate a complaint and order a controller or processor to fix the breach within a set time, with an appeal to the Minister within sixty days and no further appeal after the Minister decides. Other regulators. The Qatar Central Bank supervises every licensed financial institution and enforces its own data, cloud and cyber regulations through its supervision function; its regulations state that breaches must be reported to it, to the National Cyber Security Agency and to the Ministry of Interior. The Communications Regulatory Authority regulates telecoms and is visibly active, publishing decisions and consultations through 2026. Inside the Qatar Financial Centre the Data Protection Office has its own powers under Part 6 of the QFC Data Protection Regulations, including permits, orders and penalties.

The ceiling. Article 10 of Law No. 13 of 2016 requires a controller to check that personal data is relevant, adequate, accurate, complete and up to date for the legitimate purpose, and not to keep it longer than necessary to achieve that purpose. Article 5(3) lets a person demand deletion once the purpose has ended or where there is no justification for the controller to keep it. No maximum period is stated anywhere in the statute. The floor. Article 21 of the cybercrime law, Law No. 14 of 2014, requires a service provider to keep subscriber information for one year, and to preserve information-technology data, traffic data or content information for ninety days, renewable, when the competent authority or the investigating and prosecuting bodies ask. Article 22 requires state organs, institutions, bodies and their subsidiary entities and companies to keep information-technology data and subscriber information for at least one hundred and twenty days and to hand it over on request. For financial institutions, clause 11.3 of the Qatar Central Bank Data Handling and Protection Regulation sets minimum periods of ten years for sensitive financial information and for personal data, personally identifiable information and sensitive personal information, and one year for technical information, with everything else left to the institution. Clause 11.4 requires longer where another law demands it. Ordinary company and tax record-keeping periods under Qatari commercial and tax law are additional and were not verified in this pass. What happens when they conflict. Nothing in the privacy law resolves a clash between a person's deletion request and a retention duty. In practice the specific retention rule wins, because Article 19 of the privacy law exempts a controller from the consent and rights provisions where it is performing a legal obligation or a court order. We could not find an official ruling or guidance saying so in terms.

Clock one, the general law. Article 13 of Law No. 13 of 2016 requires the processor to notify the controller of any failure of the protective measures, or of any risk threatening individuals' personal data, as soon as it becomes aware. Article 14 requires the controller to inform both the individual and the competent department of any such failure where it would cause serious harm to the personal data or to the individual's privacy. No hour count appears in the statute, and no implementing decision setting one could be found. Breaching Article 14 attracts a fine of up to one million Qatari riyals, about two hundred and seventy-five thousand United States dollars; breaching the security duty in Article 13 attracts up to five million riyals, about one and a third million dollars. Clock two, financial services. Clauses 16.1 to 16.3 of the Qatar Central Bank Data Handling and Protection Regulation require a financial institution to classify any data breach or data privacy breach as an incident, to report it under the bank's incident reporting guidelines, and to report it to the central bank and to the authorised agencies in Qatar, which the regulation names as the National Cyber Security Agency and the Ministry of Interior. The incident reporting guidelines themselves are not published on the bank's public site, so the actual hour count is not publicly verifiable. Clock three, the Qatar Financial Centre. Article 31 of the QFC Data Protection Regulations requires notification of a personal data breach, and DATA 9 of the QFC Data Protection Rules requires the notification to explain the delay if it is not made within seventy-two hours of becoming aware. The notification must describe the categories and approximate numbers of individuals and records affected, the likely consequences, and the measures taken. A fourth clock applies to the public sector. Article 22 of the cybercrime law requires state bodies to report promptly to the competent authority any offence under that law as soon as it is discovered, including any attempted unlawful interception or eavesdropping, and to supply all information needed to establish the facts.

1. The fines are criminal. Articles 23 to 25 of Law No. 13 of 2016 are drafted as penal provisions: a person is 'punished' with a fine of up to one million riyals for breaching the core duties, up to five million riyals for breaching the security duty, the sensitive-data permit duty or the children's website duty, and a company faces up to one million riyals where an offence is committed in its name and for its account without prejudice to the criminal liability of the individual responsible. That means prosecution, a criminal record and personal exposure for named individuals, not an administrative penalty notice. 2. Sensitive data needs a permit you cannot apply for. Article 16 forbids processing data on ethnic origin, children, health or physical or mental condition, religious belief, marital relationship or criminal offences without a permit from the competent department, under procedures to be fixed by a decision of the Minister. We found no such Minister's decision published in the official gazette. The prohibition is drafted as absolute and carries the five-million-riyal penalty, so the gap is a live commercial risk rather than a technicality. The Minister can also add new categories of sensitive data by decision at any time. 3. There is no defined age for a child. Article 17 imposes real duties on any website aimed at children: publish what children's data you collect and how you use it, obtain the express consent of the child's guardian by electronic or other suitable means, give the guardian a description and a copy of the data on request, delete or stop processing on the guardian's request, and never make participation in a game or a prize offer conditional on handing over more data than the activity needs. The definitions article does not define 'child'. Under general Qatari law the age of majority is eighteen, which is higher than the thirteen used by many global platforms. 4. Photographing people in public is now a crime. Law No. 11 of 2025, published on 4 August 2025, inserted Article 8 bis into the cybercrime law. Publishing or circulating photographs or video of people while they are in public places, without their knowledge or consent or outside the cases permitted by law, over the information network or by any information technology means, is punishable by up to one year in prison and a fine of up to one hundred thousand riyals, about twenty-seven thousand United States dollars, or both. This catches ordinary marketing footage, event photography and street-level product imagery. 5. The free zone is a different country for this purpose. Article 2 of the QFC Data Protection Regulations 2021 states that, to the fullest extent the QFC Law permits, the laws, rules and regulations of the State of Qatar on these matters do not apply inside the Centre. A group with entities on both sides of that line needs two compliance programmes, not one. 6. A bonus trap that runs backwards. Article 15 makes it an offence for a controller to restrict cross-border data flow. A well-meaning internal policy that blocks all offshore processing is, read literally, the thing the statute punishes.

Confirmed and already in force: Law No. 11 of 2025, dated 21 July 2025 and published in Official Gazette issue 20 of 4 August 2025, added the public-place photography offence to the cybercrime law. The Qatar Central Bank Cloud Computing Regulation has been in force since 15 April 2024 and the Data Handling and Protection Regulation was published on the bank's site in February 2025. Pending: the Communications Regulatory Authority has issued a Spam Regulation and has consulted on an amended draft, but the two live consultations on its site on 18 August 2026 concerned radio spectrum fees and postal licence fees, neither of which touches data. No amendment to Law No. 13 of 2016 has been gazetted since it was passed, and the law's card on the official legal portal shows no amendments. Dormant switches, which matter more than pending bills: - Article 16 lets the Minister add new categories of sensitive personal data by decision alone, and impose additional protective measures for them. Whole datasets could move into permit-only territory with no consultation. - Articles 7, 8(4), 16 and 18 all require decisions of the Minister that we could not find published. Issuing them would convert a broadly worded statute into a detailed compliance regime overnight. - Article 30 lets the Cabinet extend the compliance period 'for a similar period or periods' on the Minister's proposal, a power it has already used once. - Article 18 lets any competent government body disapply the consent rule, the notice rule, the cross-border flow rule and the children's rule for national security, public security, international relations, the State's economic or financial interests, or the prevention, detection or investigation of crime, keeping only an internal register of what it did. - Clause 23 of the central bank's Cloud Computing Regulation and clause 17 of its Data Handling and Protection Regulation make every exemption revocable and time-limited, so a bank's permission to process abroad can lapse or be withdrawn. - Under Article 23 of the QFC Data Protection Regulations, a jurisdiction can lose adequacy status at any time and the Data Protection Office simply issues an amended list.