Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016) compliance software
Qatar's Personal Data Privacy Protection Law, article by article, grouped by the duty each creates — from lawful basis and individual rights to breach notification and cross-border flows.
- RegulatorNCSA — National Cyber Governance and Assurance Affairs (Compliance and Data Protection Department)
- InstrumentLaw No. 13 of 2016, in force since 2017
- Structure11 duty-based domains, 51 controls, each citing its article
- PenaltiesQAR 1,000,000 to QAR 5,000,000
What Qatar PDPPL requires
Who it applies to
- Any organisation processing personal data electronically in the State of Qatar
- Controllers and processors handling data of special nature — health, ethnic origin, children, religious beliefs, criminal records
- Website and application operators directed at children
- Organisations transferring personal data outside Qatar
Law No. 13 of 2016 Concerning Personal Data Privacy Protection was the first national data privacy law in the Gulf. It entered into force in 2017 and is administered by the National Cyber Governance and Assurance Affairs division of the National Cyber Security Agency, whose Compliance and Data Protection Department supervises compliance, investigates complaints, audits controllers and imposes penalties of up to QAR 5,000,000.
The law gives individuals the right to the protection of their personal data and places obligations on controllers and processors: a lawful basis and transparency for every processing purpose, honouring access, correction and erasure rights, security measures proportionate to the data, notification of breaches to the regulator and to affected individuals, controls on cross-border transfer, and special protection for data of special nature and for children.
GRCLens groups the law's articles by the duty each creates rather than by article number, because an assessor works 'do we handle subject access?' rather than 'are we compliant with Article 6?'. Each control cites its article, so the audit trail runs back to the text.
How GRCLens supports Qatar PDPPL
Qatar PDPPL runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Duties, not article numbers
Principles and lawful basis, individual rights, controller obligations, accountability, security and breach notification, cross-border flows, special-nature data, children and website operators, exemptions, direct marketing, complaints — each control cites the article it implements.
Registers that already exist
Processing activities, data subject requests and breach records live in the platform's registers and are reused by the Qatar NIA, ISO/IEC 27001 and ISO/IEC 42001 assessments in the same tenant.
Breach notification readiness
Breach records carry the detection time, the assessment of harm and the notifications made, so the regulator's questions can be answered from the record.
Arabic and English
Every control and its guidance in both languages, for the privacy officer and for the regulator.
Qatar PDPPL frequently asked questions
Who enforces the PDPPL?
The National Cyber Security Agency, through its National Cyber Governance and Assurance Affairs division and its Compliance and Data Protection Department, which monitors compliance, handles complaints, audits and imposes penalties.
Does the PDPPL apply to the Qatar Financial Centre?
The QFC has its own Data Protection Regulations administered by the QFC Data Protection Office. Entities established in the QFC should assess against those; the PDPPL applies to the State of Qatar generally.
Can the PDPPL be run alongside the Qatar NIA Policy?
Yes. Both are catalogue frameworks on the same control model, so security and breach controls that appear in both are assessed once and the evidence satisfies both.
One platform, many obligations
Talk to us about Qatar PDPPL
Security Solution Consultants provides Qatar PDPPL and privacy advisory alongside the platform, so you can combine tooling with hands-on expertise.