QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
– requires prior permission from the competent authority, and may be subject to additional safeguards (Article 16). The PDPPL provides a limited exemption permitting processing for scientific research conduct - ed in the public interest, subject to the conditions and controls set out in the Law (Article 19). Qatar has not enacted legislation equivalent to the European Health Data Space Regulation, and there is no specific health-data governance framework com - parable to the EU regime. Accordingly, the European Health Data Space Regulation has no direct legal impact in Qatar, and life sciences companies operat - ing in Qatar must comply with the PDPPL rather than EU-style secondary use or data-sharing obligations. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Under the PDPPL, the use of personal data in AI systems must comply with the same personal data protection obligations that apply to any processing of personal data: lawful purpose, transparency, consent or necessity, data minimisation, and appropriate safe - guards against unauthorised access or misuse. These general principles are the core legal requirements for AI-related data processing under Qatari law. Qatar has not yet enacted a standalone AI data pro - tection law, but there are emerging policy and guid - ance developments that shape how AI systems han - dling personal data should operate: • The PDPPL’s framework itself requires controllers to process personal data only for lawful and speci - fied purposes and to respect data subject rights, which by extension applies to AI systems that use personal data. • Qatar’s national AI guidelines and policies (eg, the AI Guidelines for Developers issued by the MCIT) explicitly emphasise that organisations must respect personal data protection and pri - vacy obligations under the PDPPL when designing or deploying AI systems. These guidelines rein - force the need to ensure that personal data is not exposed or published without lawful basis and that users can flag privacy issues. • Sector-specific guidance, such as financial sec - tor AI guidelines, mirrors PDPPL principles by
requiring that AI systems only collect and process personal data necessary for their function and that individuals are informed about how their data is processed by AI. • Broader national initiatives (including Qatar’s regu - latory landscape for AI) are moving towards com - prehensive governance frameworks, with AI ethics and data protection principles layered on top of the PDPPL for responsible AI adoption across sectors. There is no risk-based classification, prohibited high- risk categories or binding AI regulation akin to the EU’s AI Act in Qatar’s PDPPL. Instead, all AI-related pro - cessing of personal data must simply align with the PDPPL’s core standards of lawful processing, trans - parency, purpose limitation and safeguards, with any higher-risk processing (such as sensitive personal data) requiring prior authority approval per Article 16 of the PDPPL. 1.6 Data Breach Requirement A personal data breach under Qatari law occurs when there is a breach of security leading to the unlawful or accidental alteration, destruction, loss or unauthorised disclosure of or access to personal data. Breaches may be deliberate or accidental, and can affect both individuals and organisations. Examples of breaches include: • theft or loss of IT equipment containing personal or sensitive data; • unauthorised access to customer or employee data; • leaving confidential files unattended; • inadequate disposal of documents containing per - sonal data; and • unauthorised disclosure or use of client data for personal gain. Requirements and actions for organisations: • Immediate containment and assessment: Iden - tify the nature, scope and potential impact of the breach. • Notification to the competent authority: Under the PDPPL, report serious breaches to the MCIT, or, in the QFC, to the DPO.
370 CHAMBERS.COM
Powered by FlippingBook