New National Privacy Law In Qatar

The State of Qatar has announced that it has issued Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data (the Law). Once gazetted, the Law will officially be the first national level legal regime specifically governing data protection in the GCC. As such, it is expected to herald a new era of privacy-related compliance considerations for data controllers and processors in Qatar and the wider Middle East region, with neighbouring nations anticipated to follow suit in short order with their own national level privacy and data protection regimes.

We discuss the new Law (and its potential implications, from a compliance standpoint and otherwise) in further detail below. Please note that this article has been prepared on the basis of the approved draft Law, and the official Arabic version will be published in the Official Gazette shortly. Although we do not anticipate material changes to the Official Gazette version versus the approved draft Law, the observations set out herein are subject to verification in accordance with the Official Gazette once published in the coming weeks.

Data Protection in Qatar: Background and Existing Legal Landscape

In 2011, Qatar's Supreme Council of Information and Communication Technology (ictQATAR, as it was then known) released a draft privacy law - the Personal Information Privacy Protection Law - for public consultation. This was to eventually become the new Law - a first of its kind in the GCC.

Prior to the enactment of the Law, the legal landscape applicable to privacy and data protection in Qatar was relatively fragmented on a national level. Although the Qatar Financial Centre has a comprehensive specific framework governing data protection (which is broadly modelled on the EU Directive 95/46/EC) there was nothing comparable on a national level. Instead, national laws provided some privacy-related protections for individuals - but these tended to be either quite generic (e.g. a general right of privacy for individuals set out in the Constitution, and offences for privacy violations in the Penal Code and Cybercrime Prevention Law) or quite sector-specific (e.g. data protection obligations applicable to telecommunications operators in connection with safeguarding the privacy of their customer information). However, with the enactment of the Law, there is now a specific data protection and privacy regime that applies on a much wider national level.

The New Qatar Privacy Law

Application of the Law - Processing Personal Data, Rights of Controllers and Individuals

At a fundamental level, the Law sets out a number of new rules and requirements applicable to the processing of personal data of an identifiable individual, whether the processing is conducted by electronic or other means.

The general rule under the Law is that the personal data of an individual is to be processed in accordance with principles including those of...