QATAR Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company
fer, with prior permission from the competent authority and subject to any additional safeguards imposed. Qatar is yet to enter into mutual legal assistance trea - ties or bilateral treaties to ensure appropriate involve - ment of the authorities in countries where the data is stored. The PDPPL does not condition the legality of Cross-Border Data Flow on the existence of such treaties. 5.2 Government Notifications and Approvals Situations where a notification or approval would most likely be required to transfer data internationally or to carry out cross-border transfer would be in the con - text of QFC transfers. In principle, the QFC does not maintain a list of “adequate” jurisdictions. However, in certain circumstances, when the recipient in a country is not deemed to have an adequate level of protec - tion for personal data, this would essentially require obtaining a permit for the transfer and the data con - troller would apply certain safeguards in accordance with Article 10 (1)(a) of the QFC Regulations. 5.3 Data Localisation Requirements There is no general data localisation requirement or prior approval requirement for cross-border transfers under the PDPPL, except in the case of personal data of a special nature, which requires prior permission from the competent authority (Article 16). From an operational perspective, according to the Communications Regulatory Authority (Qatar’s tele - communications and digital services regulator), it is no longer necessary for data to be stored “on premises” or “locally”. Instead, organisations should implement security measures such as encryption, anonymisation and aggregation at predefined secure hubs (regions/ availability zones), which are more efficient than locali - sation. The Cloud Policy Framework (CPF) issued in June 2022 sets the roadmap for more concrete considera - tions relating to the above-mentioned circumstances and operations. According to the CPF, data residency shall no longer be a requirement as data classification schemes, security and encryption technologies now secure a high level of protection controls.
These are newly discussed concepts, but it is expect - ed that data localisation may be required for extremely sensitive data only, and that this would constitute one of the limitations to an organisation collecting or trans - ferring data in connection with foreign government data requests or foreign litigation proceedings. 5.4 Blocking Statutes Pursuant to Article 15 (3) of the QFC Regulations, a data subject has the right to require and obtain from the data controller – upon request, at reasonable intervals and without excessive delay or expense, as appropriate – the rectification, erasure or blocking of personal data, the processing of which does not com - ply with the law. 5.5 Recent Developments Under the PDPPL, cross-border transfers of personal data are permitted in principle. The PDPPL expressly recognises “Cross-Border Data Flow” and provides that a controller may not restrict the transfer of personal data outside the State unless the processing violates the Law or may cause seri - ous damage to the personal data or the individual’s privacy (Article 15). Accordingly, international transfers are allowed pro - vided that: • the processing serves a lawful purpose; • the controller complies with the PDPPL’s general data protection obligations (including security safe - guards and transparency); and • the transfer does not result in serious harm to per - sonal data or individual privacy. There have been no recent developments in the regu - lation of the international transfer of personal data. Under the law, it is not restricted. However, given that neighbouring countries have enacted amendments to supplement their own data protection laws, Qatar may follow suit by introducing updates to the PDPPL to align with regional and global standards.
376 CHAMBERS.COM
Powered by FlippingBook