Qatar PDPPL (Law No. 13 of 2016): an SME summary
Qatar's Personal Data Privacy Protection Law was issued on 3 November 2016. It applies to personal data processed electronically, or collected in preparation for electronic processing.
Last reviewed: 2026-10-18
Who regulates it
The law originally named a department of the Ministry of Transport and Communications as the "Competent Department". Oversight now sits with the National Cyber Security Agency (NCSA). In our summary, NCSA's privacy pages describe a role spanning guidance, audits, complaint handling and enforcement (NCSA: Personal Data Privacy). See also our article Who enforces Qatar's PDPPL?
Key obligations
| Topic | What the law expects (summary) |
|---|---|
| Consent and lawful purpose | Process personal data only with the individual's consent, unless processing is necessary to achieve a Lawful Purpose. |
| Individuals' rights | Individuals may withdraw consent, object, request erasure or correction, access their data and obtain a copy. |
| Fair processing and precautions | Process honestly and legitimately; take appropriate administrative, technical and financial precautions. |
| Notice before processing | Before processing, tell individuals who the controller is (and any processors), the Lawful Purposes, and describe the processing and disclosures. |
| Data quality and retention | Data must be relevant, adequate, accurate and up to date, and not kept longer than necessary. |
| Governance | Review privacy measures before new processing, train processors, run complaint and request handling, manage breaches, audit compliance and oversee processors. |
| Security | Controllers and processors must protect data against loss, damage, change, disclosure, access or misuse. Processors must tell controllers about breaches. |
| Breach notification | Inform the individual and the regulator of a breach that may cause serious damage to personal data or privacy. NCSA's guideline expects this within 72 hours of becoming aware (NCSA breach notification guideline). |
| Cross-border flows | Controllers must not restrict cross-border data flows unless the processing breaches the law or may cause serious damage. |
| Special-nature data | "Special nature" data (ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations, criminal offences) may only be processed with permission from the Competent Department. |
| Children's websites | Websites aimed at children: notice, explicit guardian consent, guardian access and deletion rights. |
| Direct marketing | Electronic direct marketing requires prior consent. Messages must identify the sender, say they are marketing, and include an easy way to opt out. |
We summarise topics rather than article numbers: our English source is an unofficial translation, and the Arabic text in the Official Gazette is authoritative.
Enforcement
NCSA's breach notification guideline states maximum penalties of up to QAR 1,000,000 per violation for failing to report a breach as required, and up to QAR 5,000,000 per violation for failing to put appropriate precautions in place (NCSA breach notification guideline). These are ceilings, not typical outcomes. The law also allows the regulator to issue binding decisions requiring a controller or processor to fix a breach. NCSA has published binding decisions after breach incidents, for example against an e-commerce company (Qatar Tribune, Mar 2025) and a sports-sector company (Qatar Tribune, Feb 2026).
What this means for a website
- Show a privacy notice before collecting data covering who you are, why you process data and who receives it (checklist).
- Don't load marketing cookies or pixels before consent (cookie consent in Qatar).
- Keep newsletter and WhatsApp marketing opt-ins separate and explicit.
- Take care with booking or enquiry forms that collect health or other special-nature details.
- Protect forms and admin panels with HTTPS, security headers and access control.
NCSA guidance worth downloading
NCSA publishes guidelines and templates, including a Privacy Notice guideline, Data Protection Self-Assessment checklist, Record of Processing Activities template, DPIA guideline, Personal Data Breach Notifications guideline, Electronic Communications for Direct Marketing guideline and, since May 2026, a Personal Data Sharing Checklist (NCSA guidance hub for regulated entities).
- Law No. 13 of 2016, unofficial English translation (CDP). The official version is published in Official Gazette No. 15 of 2016 (almeezan.qa).
- NCSA: Personal Data Privacy
- NCSA: Privacy guidance library
Find out what your website reveals
Run the free passive mini-scan in under a minute, or ask for a quote for the full report.