QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
In practice therefore, organisations in Qatar that han - dle non-personal data rely on sector-specific rules and contracts (eg, cloud service agreements, telecom or banking security standards) and any applicable gov - ernment data policies when sharing or using such data, but there is no overarching legal regime specifi - cally governing non-personal data at present. 3.2 Interaction of Data Regulation and Data Protection The PDPPL is closely linked to other Qatari laws regulating cybersecurity and digital transactions. The NCSA enforces cybersecurity laws and plays a role in ensuring personal data protection in AI applications and IoT services. The Telecommunications Law and Cybercrime Law impose additional restrictions on electronic data processing and cybersecurity threats. 3.3 Rights and Obligations Under Applicable Data Regulation Under the PDPPL, the statutory rights and obliga - tions apply only to personal data. The PDPPL does not regulate non-personal data, and therefore does not establish rights or obligations relating to the use, sharing, portability, interoperability, switching, termi - nation, FRAND access or mandatory data sharing in respect of non-personal data. In relation to personal data, the PDPPL grants indi - viduals core rights, including the right to be informed of processing and its purposes, the right to access and obtain a copy of their personal data, the right to request correction of inaccurate data, the right to object to processing where it is not necessary for a lawful purpose, the right to withdraw consent, and the right to request erasure where the purpose for pro - cessing has ceased or no longer exists. The PDPPL does not provide for data portability, interoperability, switching rights, FRAND access, or mandatory data sharing between organisations. From an obligations perspective, controllers must ensure that personal data is processed for a lawful purpose, based on either consent or necessity, and in a manner that is fair, proportionate, and limited to what is required. Controllers must comply with trans - parency requirements, maintain data accuracy and relevance, avoid excessive retention, and implement
appropriate administrative, technical and financial safeguards to protect personal data. Controllers are also required to manage and report serious personal data breaches and to obtain prior permission from the competent authority where processing involves personal data of a special nature. In addition to the PDPPL itself, the competent author - ity has issued non-binding implementation guidelines to support compliance. The PDPPL Guidelines pro - vide practical guidance, templates and checklists to assist organisations in operationalising PDPPL requirements, including governance measures, secu - rity controls, transparency practices and handling of data subject rights. While not legally binding, they are relevant in demonstrating good-faith compliance with the PDPPL. Accordingly, key action items for organisations include identifying whether data processed constitutes per - sonal data, defining and documenting lawful purposes, implementing consent and transparency mechanisms, putting in place appropriate security and governance measures, establishing procedures to respond to data subject rights requests, limiting retention periods, and seeking prior approval where required for processing sensitive personal data. 3.4 Regulators and Enforcement See 1.7 Regulators . According to the PDPPL Guidelines, controllers may use “cookies” on an individual’s web browser to target direct advertisement messages towards the individ - ual. Such cookies should be deployed only after the individual has “opted in” – ie, has clicked “accept” to allow such direct marketing cookies to be deployed on the individual’s browser. Controllers may collect individuals’ email addresses on a web page of the controller’s website. The con - troller must make it clear, on the web page, that if the individual provides their email address in that instance they are providing their consent towards receiving 4. Sectoral Topics 4.1 Use of Cookies
373 CHAMBERS.COM
Powered by FlippingBook