Qatar's Data Privacy Law – Ministry Grants Further Extension For Compliance

It is a year since Qatar became the first GCC country to enact a specific national law relating to data protection. The government has confirmed an extension to allow organisations additional time to comply with the new legislation, but for many businesses there remains a substantial exercise to complete in order to satisfy the new requirements.

Introduction

Law No.13 of 2016 Concerning Personal Data Protection (the "DPL") was gazetted and became law in Qatar on 29 December 2016. The DPL incorporates concepts familiar from other international privacy frameworks and enshrines an individual's right to have their personal data protected.

As we noted at the time of the DPL's enactment, this new law establishes a framework for data privacy compliance in Qatar under the oversight of the Ministry of Transport and Communications ("MoTC"). Its issuance represents an important first step for the protection of data privacy rights in Qatar. However, the DPL anticipates that further instructions and ministerial decisions will be issued to set out more detailed requirements and processes that will underpin the new regime.

For example, Article 16 of the DPL refers to personal data of a 'special nature' which is defined as 'any data relating to race, children, health, physical or psychological conditions, religious beliefs, marriage relationships or crimes'. The Minister of the MoTC may by 'decisions' add further categories of personal data of a special nature as well as 'impose further precautions to protect personal data of special data'. We await any such decisions and detail on systems and precautions required which are likely to impact, in particular, regulated sectors in Qatar, such as healthcare, financial services and education which have their own regulations that need to be suitably aligned.

Also awaited are the requirements relating to MoTC processes for the granting of 'permissions' by the MoTC for the processing of personal data of a special nature. Under the DPL, no such processing is permitted without such permission.

Significant Changes Required

For many businesses in Qatar, the changes required to comply with the DPL will be complex and extensive. Organisations will need not only to understand what the DPL requires but also to invest in and adopt new processes and system changes to ensure effective compliance, including building privacy protection into the design new products and services.

Drafting a privacy policy alone will not be...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT