QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
• Personal data disclosed during due diligence must be adequate, relevant and not excessive , and must not be retained for longer than necessary for the relevant purpose (Article 10). The PDPPL does not contain specific provisions tai - lored to M&A due diligence; compliance is assessed under the general processing obligations. The PDPPL does not expressly regulate “change of control”. However, a change in ownership or control that results in a new entity determining the purposes and means of processing may constitute a change in • Personal data may continue to be processed only for lawful purposes consistent with the PDPPL (Article 4). • The controller must ensure that individuals are informed of the identity of the controller and the purposes of processing , and any material change to processing activities must be consistent with the information provided to individuals (Article 9). • Any transfer of personal data to a new controller must comply with the disclosure and safeguarding requirements of the PDPPL (Articles 12 and 13). The PDPPL requires controllers, prior to processing personal data, to inform individuals of: • the controller’s identity; • the lawful purposes of the processing; and • a description of the processing activities and levels of disclosure (Article 9). While the PDPPL does not mandate transaction-spe - cific notifications, any post-transaction change that affects these elements must remain compliant with the transparency requirements under Article 9. Please note that if the transaction involves personal data of a special nature (eg, health data, children’s data, religious beliefs, criminal data), such data may only be processed – including being disclosed or transferred in the context of an M&A or asset deal – the controller. In such cases:
with prior permission from the competent authority and subject to any additional safeguards imposed.
5. International Considerations 5.1 Restrictions on International Data Transfers
“Cross-Border Data Flow” is defined under the PDP - PL as accessing, viewing, retrieving, using or storing personal data without border constraints. The PDPPL provides that data controllers should not take meas - ures or adopt procedures that may restrict or prevent Cross-Border Data Flow, unless processing such data would violate the provisions of the PDPPL or cause gross damage to the data subject. More specifically, the PDPPL reserves the right for governmental bodies to decide that certain obliga - tions under the Law (including those relating to Cross- Border Data Flow) do not apply to certain categories of data they process, based on the following grounds: • national security; • international relations; • the economic or financial interests of the State; or • the prevention or investigation of criminal offences. A Cross-Border Data Flow may occur where the data exporter is: • performing a task pertaining to the public good; • executing a court order; • protecting the vital interests of the individual; • meeting the objectives of scientific research; or • collecting information to investigate a crime when requested by officials. The PDPPL does not prescribe specific transfer mech - anisms (such as adequacy determinations, standard contractual clauses or transfer impact assessments) for lawful Cross-Border Data Flow. Compliance is assessed by reference to adherence to the PDPPL’s general processing principles and safeguards. In addition, personal data of a special nature may only be processed, including through cross-border trans -
375 CHAMBERS.COM
Powered by FlippingBook