QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Qatar introduced Law No 13 of 2016 on Protecting Personal Data Privacy (the “Personal Data Privacy Protection Law”, or PDPPL), which took effect in 2017. The PDPPL applies to personal data when it is elec - tronically processed, or obtained, gathered or extract - ed in preparation for electronic processing, or pro - cessed via a combination of electronic and traditional processing. The PDPPL aligns with, but is not as strin - gent as, the universal data protection principles that were established as the core of the European Union’s General Data Protection Regulation (GDPR). The PDPPL explicitly excludes personal data processed by individuals within a private or family scope. The PDPPL establishes key definitions central to its application: “Personal Data” is defined as data of an individual whose identity is defined or can be reason - ably defined whether through such personal data or through the combination of such data with any other data. “Personal Data Processing” encompasses a broad range of activities including gathering, receipt, registration, organisation, storage, preparation, mod - ification, retrieval, usage, disclosure, publication, transfer, withholding, destruction, erasure and cancel - lation. “Cross-Border Data Flow” means accessing, watching, retrieving, using or storing personal data without restrictions of the State’s borders. The Compliance and Data Protection Department (CDPD) attached to the Ministry of Communica - tions and Information Technology (MCIT) (previously known as the Ministry of Transport and Communi - cations) published guidelines concerning the PDPPL (the “PDPPL Guidelines”) in 2021, with the aim of providing a framework for data protection in Qatar. The National Cyber Security Agency (NCSA) has also issued the Guidelines for Secure Adoption and Usage of Artificial Intelligence, which provide guidance on how to securely deploy AI systems while complying with PDPPL requirements. The PDPPL was enacted after perusal of the Consti - tution and operates alongside several related laws.
The preamble to the PDPPL explicitly references the following foundational legislation: • the Telecommunications Law promulgated by Decree Law No 34 of 2006; • the Electronic Transactions and Commerce Law promulgated by Decree Law No 16 of 2010; • Law No 2 of 2011 on Official Statistics (as amend - ed by Law No 4 of 2015); and • the Cybercrimes Combating Law promulgated by Law No 14 of 2014. Qatar’s data protection and privacy regime is also composed of provisions relating to penalties in other laws, such as: • the Penal Code promulgated by Law No 11 of 2004; • the Trade Secrets Law promulgated by Law No 5 of 2005; • the Qatar Constitution; • the Labour Law promulgated by Law No 14 of 2004; and • the Qatar Banking Regulations issued by the Qatar Central Bank, governed by Law No 13 of 2012. While these laws supplement data protection and pri - vacy laws in Qatar, the PDPPL is the detailed frame - work for the protection of personal data in Qatar. Qatar operates a dual legal system for data protection. In addition to the “mainland” or “State” system and the PDPPL described above, there is a separate legal data privacy protection regime in the Qatar Financial Centre (QFC). The QFC is a business and financial hub in Qatar that provides a legal, regulatory and tax envi - ronment distinct from “mainland Qatar”. It operates under its own legal framework and has its own inde - pendent judiciary. The key data protection legislation for the QFC is the QFC Data Protection Regulations 2021 (the “QFC Regulations”). The Data Protection Office (DPO) is an independent institution of the QFC. It is charged with administering the QFC Regulations and all aspects of data protec - tion within the QFC. Entities operating within the QFC are subject to the QFC Regulations rather than the
367 CHAMBERS.COM
Powered by FlippingBook