PDPPL compliance checklist for Qatar businesses

Published 2026-10-18 · 7 min read · Samtaro Security

Before you start: know your regime

Mainland Qatar businesses fall under the PDPPL, overseen by NCSA. Firms licensed in the Qatar Financial Centre follow the separate QFC Data Protection Regulations 2021. Selling into the EU can also bring in the GDPR.

1. Map what you collect

• List every place personal data enters: website forms, booking widgets, WhatsApp, Wi-Fi captive portals, loyalty apps, CCTV, HR files.
• For each, note the purpose, where it is stored, who can access it and which vendors touch it. NCSA publishes a Record of Processing Activities template.

2. Lawful purpose and consent

• For each purpose, decide whether you rely on consent or on processing necessary for a Lawful Purpose.
• Where you rely on consent, record it and make withdrawal easy.

3. Tell people before you process

• A privacy notice that names you, any processors, the purposes, and what is disclosed to whom.
• Linked next to every form and in the site footer. NCSA has a Privacy Notice guideline.

4. Keep only what you need

• Remove form fields you don't use. Set retention periods and delete on schedule.

5. Governance basics

• Review privacy before launching new processing; this is where a DPIA fits.
• Have a way to receive and answer access, correction and deletion requests.
• Train the staff who handle customer data.
• Audit compliance periodically and check that vendors follow your instructions.

6. Security

• HTTPS, security headers and MFA on admin accounts (website security checklist).
• Contracts requiring processors to tell you about breaches immediately.

7. Breach handling

• A plan for informing individuals and NCSA when a breach may cause serious damage. See GCC breach notification for timing.

8. Special-nature data and children

• Health, children's data, religious beliefs, marital relations, ethnic origin and criminal records need permission from the regulator before processing.
• Sites aimed at children need explicit guardian consent.

9. Direct marketing

• Prior consent for marketing by email, SMS or WhatsApp. Identify yourself, label the message as marketing, and include an opt-out.

10. Vendors and data sharing

• Work through NCSA's Personal Data Sharing Checklist for each vendor.

Want the website parts checked for you? Our free mini-scan covers the basics; the Full Scan Report covers items 3, 6 and 9 in detail.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.