QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
• Notification to affected data subjects: Notify affected data subjects where the breach is likely to result in significant risk to the rights and freedoms of data subjects. • Documentation and record-keeping: Maintain records of the breach, causes and corrective measures taken. • Mitigation and corrective measures: Implement technical and organisational safeguards to pre - vent further breaches, including access controls, encryption, secure disposal and staff training. • Post-incident review: Update policies and proce - dures to prevent recurrence. Consequences and Regulatory Oversight Breaches can result in financial loss, reputational damage, legal liability or disruption to operations. Under the PDPPL and Cybercrimes Combating Law, the MCIT or DPO may investigate breaches, impose administrative fines or, in cases of deliberate miscon - duct, initiate criminal proceedings. 1.7 Regulators The CDPD at the MCIT is the key regulator in Qatar, and the NCSA is the competent department for administration and enforcement of the PDPPL. It is the key authority for conducting investigations regard - ing cybersecurity issues, implementing and examining issues related to national cyber-risks, and conduct - ing fieldwork solidifying resilience against cybercrimes and crises. All data breaches should be reported to the NCSA. In the QFC, the DPO is concerned with the data pro - tection framework. It is the institution charged with providing guidance on all data protection matters or complaints related to the QFC Regulations. The DPO is concerned with the protection of the rights of indi - viduals and ensuring implementation of protection measures for all QFC entities, firms or future investors. 1.8 Enforcement Proceedings and Fines The enforcement process is usually triggered by a complaint filed before the NCSA, which is the com - petent authority in the State of Qatar. The NCSA will commence an investigation process in order to verify the veracity of the complaint; thereafter, if warranted,
it will issue a judicial order binding the controller or processor in line with its powers under the law. The competent department, as listed in the PDPPL, will issue a rectification decision, ordering the violating entity to rectify the violation within a fixed period, as per Article 26 of the PDPPL. Previously it was under - stood that the competent department was the MCIT; however, recently the NCSA clarified that this depart - ment was not yet designated. The controller or pro - cessor has the right to file a “grievance” against such order to the relevant minister within 60 days from the date of notification. The decision issued by the min - ister related to such grievance shall be deemed final, according to Article 26 of the PDPPL. According to Article 29 of the PDPPL, the judicial officers and/or law enforcement officers designated by the NCSA have the power to document any offences and to seize any related materials, equipment or evidence in accord - ance with applicable procedure related to violations of the provisions of the law. Furthermore, in the QFC, if the DPO determines a con - travention or violation of the law by any data controller, a direction would be issued to the data controller to undertake the following, in compliance with Article 22 of the QFC Regulations: • to act or omit from performing any step; and • to refrain from processing any personal data speci - fied in the direction or to refrain from processing personal data for a purpose or in a manner speci - fied in the direction. 1.9 Enforcement Trends In the past 24 months in Qatar, there have been no widely reported, publicly available enforcement actions specifically under the PDPPL. Data protection enforcement in Qatar tends to be handled administra - tively by the competent authority rather than through public court judgments, and details of specific sanc - tions or enforcement decisions are generally not pub - lished publicly. Practical takeaways for organisations:
371 CHAMBERS.COM
Powered by FlippingBook