Qatar's data protection law: what the PDPPL requires in 2026
The GCC's first data protection law has been actively enforced since late 2024. Here is who it applies to, what it requires, how the regulator acts and how it sits beside the QFC's own regime.
The Gulf's first data protection law, now enforced
Qatar was the first GCC state to adopt a general data protection statute: Law No. 13 of 2016 on Protecting Personal Data Privacy, known as the PDPPL. It applies to the processing of personal data in Qatar by public and private organisations, including foreign companies that process the data of people in Qatar. It is administered by the National Cyber Security Agency (NCSA), through its National Cyber Governance and Assurance Affairs and the National Data Privacy Office (NDPO), which issues guidance, handles permissions and complaints, and enforces the law.
For years the PDPPL was regarded as a law on paper. That changed from late 2024, when the NDPO began issuing binding compliance decisions against named sectors, including information technology, e-commerce and contracting, typically ordering companies to fix specific failings within a fixed period such as 60 days. Enforcement is now a practical risk, not a theoretical one.
Onshore or QFC
Most companies
- Law No. 13 of 2016 and NCSA guidelines
- Enforced by the NDPO within the NCSA
- Applies to mainland and free zone processing in Qatar
- Fines up to QAR 1 million or QAR 5 million
QFC entities
- QFC Data Protection Regulations and Rules 2021
- Supervised by the QFC Data Protection Office
- Adequacy recognised with DIFC and ADGM
- QFC entities should assess both regimes where they overlap
Most foreign companies in Qatar sit under the PDPPL. A QFC entity is primarily governed by the QFC's own regulations, but where its processing touches the onshore regime both should be considered, and conflicts resolved with advice rather than assumption.
The obligations in practice
Lawful, transparent processing
Process personal data only for a legitimate purpose, with a lawful basis, after telling individuals what is collected and why.
Special-nature data
Data on health, religion, ethnicity, criminal records, marital status and children is treated as special in nature and needs additional safeguards, and in some cases permission from the regulator.
Security and breach notification
Appropriate technical and organisational safeguards, and notification of personal data breaches to the regulator and affected individuals in line with the NCSA's guidelines, which work to a 72-hour window.
Rights and records
Respond to requests for access, correction and erasure; keep records of processing; carry out impact assessments for higher-risk processing under the NCSA's framework.
Direct marketing
Electronic direct marketing needs prior consent and a working opt-out; it is one of the areas where fines apply.
Cross-border transfers
Transfers outside Qatar are permitted in principle, but controllers must not transfer data where the processing would breach the law or harm individuals, and should assess the risk before transferring.
What the regulator actually does
The PDPPL sets administrative fines in Articles 23 to 25. Breaches involving data security, breach notification and unauthorised direct marketing can attract fines of up to QAR 1 million; the most serious, including unlawful processing of special-nature data and failures in protecting children's data, up to QAR 5 million. These are maximums, set according to the violation, not a fixed scale.
In practice, the NDPO's approach so far has been corrective first: investigate a complaint or a breach, then issue a binding decision requiring specific remediation within a deadline, with fines for failure. Organisations can challenge NCSA decisions through Qatar's administrative and judicial appeal routes. The lesson from the published decisions is consistent: the companies ordered to act had either suffered a breach, ignored data subject requests or lacked basic governance. Having a privacy notice, a breach procedure, records and an owner of data protection is what keeps a company out of that list.
A group operating in Qatar, Saudi Arabia and Bahrain faces three data laws with different regulators, transfer rules and breach procedures. A single global policy rarely satisfies all three; local layers for each country, and mapped data flows between the entities, do.
What to put in place, in order
Most foreign companies in Qatar can reach a defensible PDPPL position in about three months. In the first month, map the personal data: what is collected, from whom, where it is stored, who has access and where it goes, including transfers to group systems abroad. In the second, write the documents: a privacy notice in Arabic and English, a record of processing, an internal data protection policy, processor clauses in supplier contracts, and an impact assessment for any higher-risk processing such as special-nature data or monitoring. In the third, make it work: a breach response plan tested against the 72-hour window, a procedure for data subject requests, marketing consent and opt-out checks, and a named owner of data protection.
None of this is exotic, and much of it can reuse work done for the EU's GDPR or Saudi Arabia's PDPL. The Qatar-specific layer is the regulator, the treatment of special-nature data, and the expectation that documents and notices exist in Arabic.
Where most companies are exposed
A company's website is usually its most visible processing activity, and the easiest for a regulator or a complainant to examine. Forms that collect personal data need a privacy notice at the point of collection; analytics and marketing cookies need a clear, honest consent mechanism; newsletters and promotional messages need prior consent and a working opt-out. Electronic direct marketing is one of the areas where the PDPPL's fines apply, and it is where complaints most often start.
The practical checks are simple. Does the site load analytics before the visitor agrees? Can a recipient unsubscribe in one step, and is the request honoured? Are contact form submissions stored securely and deleted when no longer needed? A company that can answer yes has removed the most common trigger for a complaint.
Questions we get asked first
What is Qatar's data protection law?
Law No. 13 of 2016 on Protecting Personal Data Privacy (PDPPL), the first general data protection law in the GCC, administered by the National Cyber Security Agency through the National Data Privacy Office.
What are the fines under the PDPPL?
Up to QAR 1 million for breaches such as security, breach notification and unauthorised direct marketing, and up to QAR 5 million for the most serious, such as unlawful processing of special-nature data or failures in protecting children's data.
Is the PDPPL actually enforced?
Yes. Since late 2024 the National Data Privacy Office has issued binding decisions against companies in sectors including IT, e-commerce and contracting, typically requiring remediation within a fixed period.
Does the PDPPL apply in the QFC?
QFC entities are primarily governed by the QFC Data Protection Regulations and Rules 2021, supervised by the QFC Data Protection Office. Where processing touches the onshore regime, both should be assessed.
Can personal data be transferred outside Qatar?
In principle yes, but a controller must not transfer data where the processing would breach the law or cause harm, and should assess the risk before transferring.
An old law with new teeth
Qatar's PDPPL has been on the books since 2016 and enforced in earnest since 2024. Know which regime you sit under, treat special-nature data and marketing with care, have a breach procedure that works within 72 hours, and answer data subject requests promptly. That is what the regulator's decisions reward.
Processing personal data in Qatar?
We map your data, identify the regime that applies, and put the documents and procedures in place that the regulator asks for.
Email us →Related reading
This article is general information, current as of 2026, and is not advice for any specific situation. Confirm current rules with the MOIC, the NBR or the relevant authority before acting.