Qatar was the first GCC state with a standalone data protection law. Law No. 13 of 2016 came into force on 29 January 2017, and fines reach QAR 5 million. In February 2026 the National Cyber Security Agency publicised a binding decision against a sports company after a data breach, a sign that enforcement is active. This guide covers what the law and its guidelines require.
The law and the regulator
The Protection of Personal Data Privacy Law (PDPPL) is Law No. 13 of 2016. It came into force on 29 January 2017, and the compliance deadline was extended to 29 January 2018. Qatar was the first GCC state to adopt a standalone data protection law.
Enforcement now sits with the National Data Privacy Office within the National Cyber Security Agency (NCSA). The law was previously overseen by the Compliance and Data Protection Department of the Ministry of Transport and Communications, so older guidance may refer to that department.
The 2020 regulator guidelines
In November 2020 the regulator issued 14 guidelines that turn the short text of the law into working requirements. They add a 72-hour breach notification rule, data protection impact assessments, records of processing and a 30-day response time for data subject requests. Treat the guidelines as part of the law in practice. The reported fine for failing to carry out a required DPIA is QAR 1 million, which shows the regulator expects them to be followed.
| Requirement | Source | Detail |
|---|---|---|
| Notice before processing | PDPPL | Tell individuals before processing starts |
| Breach notification | Guidelines and Article 14 | Regulator and individuals within 72 hours where serious damage is possible |
| DPIA | Guidelines | Failure reported at QAR 1 million |
| Records of processing | Guidelines | Written record of processing activities |
| Data subject requests | Guidelines | Respond within 30 days |
| Security measures | Article 13 | Technical and organisational safeguards |
Special nature data needs approval
The PDPPL treats some personal data as special nature data, including health, religion and children's data. Processing it needs authorisation from the regulator, so a clinic app, a faith-based service or an education product aimed at children must seek approval before it goes live. Children's data also needs explicit parental consent. Your privacy policy should say which special nature data you process and confirm that the required approval has been obtained.
Individual rights and marketing
Individuals can review their data, ask for it to be altered or deleted, withdraw their approval, and object to processing that is unnecessary or discriminatory. Under the guidelines, requests should be answered within 30 days. Direct marketing needs the person's prior approval and must identify the sender. Keep a record of each approval and make opting out simple.
Enforcement in 2026
On 2 February 2026, The Peninsula reported that the NCSA had issued Binding Decision No. 3 of 2025 against a sports company following a data breach. The decision cited Article 13 of the PDPPL, which covers security measures. The case shows that Qatar's regulator acts on breaches and looks at whether reasonable safeguards were in place. Encryption, access control, logging and staff confidentiality are the controls most worth documenting.
How Qatar compares in the GCC
Qatar's 72-hour breach window matches several neighbours, which helps regional teams run one process. The comparison below uses figures from each country's own law or regulations. The penalty models differ more than the deadlines: Saudi Arabia doubles fines for repeat offences, Bahrain relies on criminal penalties and Oman sets its highest stated fine for transfer violations.
| Country | Breach notice | Maximum fine reported |
|---|---|---|
| Qatar | 72 hours (guidelines) | QAR 5 million |
| Saudi Arabia | 72 hours to SDAIA | SAR 5 million, doubled for repeats |
| Bahrain | 72 hours to PDPA (Resolution No. 43 of 2022) | Criminal fines BHD 1,000 to 20,000 |
| Oman | 72 hours to MTCIT | OMR 500,000 for transfer violations |
Getting compliant
Start by listing any special nature data and applying for approval, then put the 72-hour breach plan and the 30-day request process in writing. Keep your DPIAs on file, since a missing assessment carries its own reported fine. For a quick review of your Qatar privacy notice, XDQ xAgents (https://xagents.xdqlabs.com) checks it against PDPPL items such as notice, consent withdrawal and breach commitments. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
Who enforces Qatar's data protection law?
The National Data Privacy Office within the National Cyber Security Agency (NCSA). The law was previously overseen by the Compliance and Data Protection Department of the Ministry of Transport and Communications.
How fast must a breach be reported in Qatar?
Regulator guidelines issued in November 2020 require the controller to notify the regulator and affected individuals within 72 hours where a breach may cause serious damage to their privacy. Article 14 of the PDPPL also deals with breach notification.
What are the fines under Qatar's PDPPL?
Fines go up to QAR 5 million. Failure to carry out a required data protection impact assessment is reported to attract a fine of QAR 1 million. The NCSA also issues binding decisions after breaches.
Do I need approval to process health data in Qatar?
Yes. Health, religion and children's data are special nature data under the PDPPL, and processing them requires regulator authorisation. Children's data also needs explicit parental consent. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Squire Patton Boggs: Qatar's new Protection of Personal Data Privacy Law, Squire Patton Boggs, 2017
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- The Peninsula: NCSA issues binding decision after data breach (2 February 2026), The Peninsula, 2026
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
