Data Protection Audit In Qatar

New national Privacy Law in Qatar - countdown to compliance

With the new national Privacy Law (13 of 2016 Concerning Privacy and Protection of Personal Data) to be gazetted any day now in Qatar, a new era of compliance concerns has been ushered in. Once the Law is published in the Official Gazette, a six-month compliance grace period will begin in order to allow entities doing business in Qatar to revisit internal procedures and ensure that their data processing operations are in line with the new legal requirements the Law will present.

Many clients are already actively taking such steps towards compliance, or have at least begun to assess their current data processing activities to identify where such steps will need to be taken. The most efficient and comprehensive way to achieve this is by way of a data protection audit - which is also, in fact, now a legal requirement pursuant to the Law.

Data protection audits - not just best practice anymore

Article (11) of the Law sets out a list of actions that all data controllers are required to take in order to ensure compliance. Included amongst these is a requirement to conduct a "comprehensive audit and review about the extent of compliance" to ensure that a company's business policies and procedures are aligned with the new obligations of the Law. The Law does not, however, provide any further guidance as to how such an audit is to be conducted. Helpfully, however, we have already been very active in providing data protection audits to clients in many countries around the world and are increasingly receiving such support requests to assist our Qatar-based clients in complying with this new legal obligation.

What does a data protection audit involve?

In short, the point of a data protection audit is to conduct a comprehensive review and assessment of the types of personal data that a company uses in its day-to-day operations and the manner in which such data is used. A kick-off interview is conducted with the key point of contact for the company where such data sets are identified, along with each relevant department that is responsible for the use of the data. Typically, depending on the nature of the company, this would include Human Resources, Customer Service, Information Technology, Finance and Marketing. A key point of contact for each such department is identified (typically the department manager) and is interviewed by the auditor. The auditor determines exactly what kinds of personal...