QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
1.2 Rights and Obligations Personal data must be processed lawfully, fairly and transparently, and only for specific, explicit and legiti - mate purposes. Processing must be limited to what is adequate, relevant and proportionate to the stated purpose, and data must be accurate, complete and kept up to date. As a general rule, processing requires the prior con - sent of the data subject, which must be informed and specific. Personal data may not be retained for longer than necessary to achieve the purpose of processing, subject to any mandatory legal retention obligations. Data controllers are required to implement appropri - ate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These secu - rity and confidentiality obligations are reinforced under the Telecommunications Law and the Cybercrimes Combating Law. The processing of sensitive personal data, such as health-related information, is subject to enhanced safeguards and typically requires explicit consent or express legal authorisation. The cross-border transfer of personal data outside Qatar is restricted unless the recipient jurisdiction ensures an adequate level of protection, approval is obtained from the competent authority, or a statutory exception applies. Data Subject Rights Under the PDPPL, data subjects are afforded a num - ber of core rights, including: • the right to be informed of the collection and pro - cessing of their personal data; • the right of access to personal data held about them; • the right to rectification of inaccurate or incomplete personal data; • the right to erasure of personal data where it is no longer necessary or is unlawfully processed, sub - ject to legal retention requirements;
PDPPL, creating a distinct regulatory environment for financial services and related businesses. Extraterritorial Reach The PDPPL does not contain explicit provisions regarding extraterritorial application. Unlike the EU’s GDPR, which expressly extends to controllers and processors outside the EU that offer goods or ser - vices to, or monitor the behaviour of, EU residents, the PDPPL is primarily focused on processing activities within Qatar. However, the law’s provisions regard - ing Cross-Border Data Flow indicate that controllers should not take any decision or measure that may limit cross-border data flow, unless the processing of such data is in breach of the law or may cause serious damage to personal data or to the individual’s privacy. Governmental exemptions under Article 18 of the PDPPL permit certain processing activities without compliance with specific provisions for purposes of national security, international relations, economic or financial interests of the State, and prevention or The PDPPL operates in conjunction with the Cyber - crimes Combating Law. The NCSA is responsible for enforcement of both cybersecurity and data protec - tion matters, and all data breaches should be reported to the NCSA. The NCSA’s Guidelines for Secure Adoption and Usage of Artificial Intelligence address critical risks such as privacy violations, AI bias, security vulner - abilities and compliance challenges, particularly in sectors where AI processes personal data (such as finance, healthcare and law enforcement). AI systems must comply with PDPPL requirements for data mini - misation, purpose limitation and lawful processing. AI models must incorporate auditability, traceability and documentation requirements. Additionally, the Qatar Central Bank has issued guidelines to ensure the ethical use of AI in the financial sector, mirroring PDPPL safeguards regarding data collection, pro - cessing purposes, transparency and explicit consent requirements. investigation of criminal offences. Interplay With Cyber and AI Laws
368 CHAMBERS.COM
Powered by FlippingBook