Qatar's Data Privacy Law – No Further Council Of Ministers Extensions For Compliance

It is well over a year now since Qatar became the first GCC country to enact a specific national law relating to data protection. The government confirmed a formal extension of time to allow organisations additional time to comply with the new legislation until 29 January 2018. Whilst the supervising unit of the Ministry of Transport and Communications ('MoTC') is not yet fully operational, the extended period for businesses to put in place compliance arrangements is now officially over.

Introduction

Law No.13 of 2016 Concerning Personal Data Protection (the "DPL") was gazetted and became law in Qatar on 29 December 2016. The DPL incorporates concepts familiar from other international privacy frameworks and enshrines an individual's right to have their personal data protected.

As we noted at the time of the DPL's enactment, this new law establishes a framework for data privacy compliance in Qatar under the oversight of the MoTC. Its issuance represents an important first step for the protection of data privacy rights in Qatar. However, the DPL anticipates that further instructions and ministerial decisions will be issued to set out more detailed requirements and processes that will underpin the new regime. The supervisory unit of the MoTC that is responsible for oversight and all administrative processes connected with the implementation of the requirements is still 'under establishment' and not yet fully operational - it is anticipated that the unit and the necessary processes will not be in place until the last quarter of 2018.

For example, Article 16 of the DPL refers to personal data of a 'special nature' which is defined as 'any data relating to race, children, health, physical or psychological conditions, religious beliefs, marriage relationships or crimes'. The Minister of the MoTC may by 'decisions' add further categories of personal data of a special nature as well as 'impose further precautions to protect personal data of special data'. We await any such decisions and detail on systems and precautions required which are likely to impact, in particular, regulated sectors in Qatar, such as healthcare, financial services and education which have their own regulations that need to be suitably aligned.

Also awaited are the requirements relating to MoTC processes for the granting of 'permissions' by the MoTC for the processing of personal data of a special nature. Under the DPL, no such processing is permitted without such permission.

...