QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
• the right to object to certain types of processing; and • the right to withdraw consent at any time where processing is based on consent. In addition, the Telecommunications Law protects the confidentiality of communications and related data, subject only to lawful disclosure or interception. Organisations operating in Qatar and processing per - sonal data should focus on the following core compli - ance measures: • Identify and document processing activities: Map personal data flows, purposes of processing, categories of data subjects, and any third-party disclosures. • Establish a lawful basis for processing: Ensure that each processing activity is supported by valid con - sent or a recognised statutory exemption. • Implement transparency measures: Prepare and maintain clear privacy notices informing data sub - jects of how their data is processed. • Put in place data security controls: Adopt appropri - ate technical and organisational safeguards pro - portionate to the nature and sensitivity of the data. • Manage data subject rights: Implement procedures to receive, assess and respond to access, rectifica - tion, erasure and objection requests. • Control data retention: Define and apply retention periods and ensure secure deletion once data is no longer required. • Assess cross-border transfers: Review any trans - fers outside Qatar and ensure that legal require - ments and approvals are met. • Prepare for incidents and enforcement risk: Estab- lish internal escalation and response procedures for data breaches and cyber incidents. 1.3 Special Categories of Personal Data Under Qatari law, special categories of personal data – also referred to as sensitive personal data – include information relating to a person’s ethnic origin or race, physical or mental health, religious beliefs, relation - ships or marital status, criminal records and children. In the QFC, this definition additionally covers biom - etric data, genetic data and data relating to criminal convictions.
Processing of such data is generally prohibited unless prior approval is obtained from the MCIT or, in the QFC, a specific written permit from the Data Protec - tion Officer (DPO). To obtain this permit, the data controller must provide details of the processing, its purpose, the categories of data subjects affected, any intended recipients, cross-border transfers, and the safeguards implemented to ensure security. Sensitive personal data must be processed with explicit consent where no statutory exception applies, and organisations must implement enhanced security and confidentiality measures. The PDPPL and related regulations also require purpose limitation, data mini - misation, accuracy, and limited retention of such data. Processing data relating to minors requires additional care, typically involving parental or guardian consent, and full transparency regarding the processing pur - pose and safeguards. Processing data relating to criminal convictions or offences is strictly controlled, allowed only under statutory authority, under legal requirements or with explicit consent, and subject to strong safeguards to prevent unauthorised access or disclosure. In all cases, the processing of sensitive data carries heightened procedural and security obligations, and non-compliance may result in administrative, civil or criminal liability. 1.4 Processing of Personal Data for Research and Development Purposes Under the PDPPL, companies providing products or services used by healthcare providers may process personal data, including patient data, only where such processing is based on the data subject’s consent or is necessary to achieve a lawful purpose (Article 4). The PDPPL does not expressly regulate or define “anonymisation”. However, to the extent that data is processed in a manner that no longer allows identi - fication of an individual, such data would fall outside the scope of the PDPPL. Where patient data constitutes personal data of a spe - cial nature (including health data), processing – includ - ing for product development or scientific research
369 CHAMBERS.COM
Powered by FlippingBook