Meet Qatar PDPPL obligations with evidence you can show

The PDPPL is Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016, issued on 3 November 2016. It protects personal data that is processed electronically, or collected for electronic processing, and sets duties for controllers and processors on consent, transparency, data quality, security, breach notification, special nature data, children's data and direct marketing. It has 32 articles in 8 chapters and is now regulated by Qatar's National Cyber Security Agency.

Any controller or processor that processes personal data electronically, or collects it for electronic processing, in Qatar must comply with the PDPPL. This covers private companies, public bodies and international organisations handling data of individuals in Qatar. Personal data processed by individuals for private or family purposes, and data processed for official statistics, is outside its scope. Separate data protection rules apply inside the Qatar Financial Centre.

The PDPPL sets fines of up to QAR 5 million. Article 23 provides fines of up to QAR 1 million for breaching Articles 4, 8, 9, 10, 11, 12, 14, 15 and 22, covering consent, controller duties, breach notification, cross-border flows and direct marketing. Article 24 provides fines of up to QAR 5 million for breaching Article 13 security duties, special nature data rules and children's website rules. Article 25 adds up to QAR 1 million for legal persons.

Yes. Under Article 13, a processor must notify the controller immediately of any breach of security precautions or any risk threatening personal data. Under Article 14, the controller must inform the affected individual and the regulator of a breach where it may cause serious damage to personal data or individual privacy. The NCSA publishes guidance on how and when to notify, so check its current guidelines for timing.

You comply with the PDPPL by establishing a lawful basis or consent for processing, giving clear privacy notices, keeping data accurate and limited to what is needed, and honouring individuals' rights. You also need appropriate security precautions, processor oversight, internal complaint and breach handling, regular compliance audits and prior permission from the regulator before processing special nature data. NCSA guidelines explain each obligation in more detail.

The PDPPL shares many principles with GDPR, including consent, transparency, data minimisation, security, breach notification and rights to access, correction and erasure. It differs in scope and detail: it applies to electronically processed data, requires regulator permission for special nature data, has no data portability right in the law itself and caps fines at QAR 5 million. GDPR controls give a strong base, but Qatar-specific gaps remain.

No. The PDPPL is a law with legal obligations and fines, while ISO 27001 is a voluntary, certifiable information security standard. ISO 27001 controls help meet the PDPPL's security duty in Article 13, which requires precautions proportionate to the nature and importance of the data. They do not cover privacy specific duties such as consent, notices, individuals' rights, special nature data permissions or direct marketing rules.

Yes, on request. The PDPPL is mapped in OneClickComply's control library and available on request, rather than offered as a standard framework today. Once enabled, its articles link to shared controls, so evidence you collect for GDPR, ISO 27001 or SOC 2 also counts towards PDPPL. Our in-house audit team can advise on Qatar specific obligations, but OneClickComply does not certify compliance.