Processes personal data, in Qatar

Decision No. 5 of 2008 Establishing the Qatar Credit Bureau, Arts. 3 and 5-9, and Instructions to Banks Part IX, items 5 and 6 · Read the law's page

• If you are a bank, a financial institution or a company licensed to grant facilities, forward or installment sales or Ijara, provide the Qatar Credit Bureau with credit information or any necessary data according to QCB policies, and report on the status of all credit facilities and related returned cheques and keep them updated.
• If you are a bank, obtain a credit report on a customer from the Qatar Credit Bureau before entering into any credit relation or renewing or rescheduling a facility, and update the credit reports of all your customers via the Bureau every three months.
• If you handle credit information at a bank, a financial institution or the Bureau, keep the data private and secret and do not release it, even after your service ends, except where the law authorizes release.
• Do not exchange credit data between users except through the Qatar Credit Bureau, do not use it to influence a customer's reputation or goodwill or to commit fraud, and do not use it in any publication or marketing material.

Law No. 13 of 2016, Art. 15 · Read the law's page

• An app transferring the personal data of an individual in Qatar out of the country, including a voiceprint or faceprint, is not itself restricted by the Controller absent an underlying breach of the PDPPL or a risk of serious damage to the data or the individual's privacy; Qatar's PDPPL, read plainly, does not impose an adequacy or whitelist gate on outbound transfer the way the UAE's or Saudi Arabia's do.

Law No. 13 of 2016, Art. 16 · Read the law's page

• An app processing a data category the PDPPL treats as special in nature (ethnic origin, children's data, health, physical or psychological condition, religious creeds, marital relations, or criminal offenses) about an individual in Qatar must obtain permission from the Competent Department; Qatar's PDPPL does not currently name biometric data as its own special-nature category, so an app processing a voiceprint or faceprint should not assume this permission requirement applies without a further check of any ministerial decision that may have added it.

Law No. 13 of 2016, Arts. 13-14 · Read the law's page

• An app that is a Processor handling the personal data of an individual in Qatar, including a voiceprint or faceprint, must forthwith notify its Controller of any breach or risk of one, and a Controller must inform the affected individual and the Competent Department where a breach of security precautions may cause serious damage to the data or the individual's privacy; the National Cyber Governance and Assurance Affairs' guideline requires that notice within 72 hours of becoming aware of the breach.

Law No. 13 of 2016, Arts. 23-26 · Read the law's page

• An app processing the personal data of an individual in Qatar, including a voiceprint or faceprint, must answer to the Competent Department's complaint-and-rectification process rather than a private civil suit from the individual; a violation of the special-nature-data permission requirement or the children's-website provisions carries the higher QAR 5,000,000 fine tier, and these violations are framed as criminal offenses reaching a responsible legal person.

Law No. 13 of 2016, Arts. 5-6 · Read the law's page

• An app that is a Controller of the personal data of an individual in Qatar, including a voiceprint or faceprint, must let that individual withdraw consent at any time, object to processing that is not necessary for the purposes of collection, request erasure once those purposes cease, and request corrections accompanied by proof of accuracy.
• A Controller must let an individual access and review their personal data, tell them that it is processed and for what purposes, and give them a copy for no more than the service charge.

Law No. 13 of 2016, Chapter One · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Qatar, including a voiceprint, faceprint, or other biometric identifier, must have a lawful, consent-and-purpose-based basis for processing under the PDPPL; Qatar's special-nature-data list does not name biometric data as its own heightened category, but ordinary personal data duties still apply to it.

QFC Data Protection Regulations 2021, Art. 12 · Read the law's page

• An app that is a Data Controller subject to the QFC Regulations and processes sensitive personal data, including genetic or biometric data used to identify an individual such as a voiceprint or faceprint, must not process it unless a condition of Article 12(1) applies, such as the explicit written consent of the data subject.
• A Data Controller that cannot rely on a condition of Article 12(1) may instead obtain a permit from the QFC Data Protection Office to process the data and must apply adequate safeguards in the processing.

QFC Data Protection Regulations 2021, Art. 31 · Read the law's page

• An app that is a Data Controller subject to the QFC Regulations must notify the QFC Data Protection Office of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and legitimate interests of data subjects.
• A Data Processor must notify the Data Controller without undue delay after becoming aware of a breach, and a Data Controller must document every breach and consider notifying the affected data subjects.

QFC Data Protection Regulations 2021, Arts. 16-21 · Read the law's page

• An app that is a Data Controller subject to the QFC Regulations must confirm to a data subject on request whether their personal data is processed, give them access to it and a copy, and rectify inaccurate personal data without undue delay.
• A Data Controller must erase personal data without undue delay on request in the circumstances of Article 18(2), honor objections and requests to restrict processing under Articles 19 and 20, and provide portable data in a structured, commonly used and machine-readable format under Article 21.

QFC Data Protection Regulations 2021, Arts. 23-24 · Read the law's page

• An app that is a Data Controller or Data Processor subject to the QFC Regulations and transfers personal data to a recipient outside the QFC must rely on an adequacy decision of the QFC Data Protection Office, or on appropriate safeguards, a listed derogation or an approved transfer mechanism under Article 24.

QFC Data Protection Regulations 2021, Arts. 33-36 · Read the law's page

• An app that is a Data Controller or Data Processor subject to the QFC Regulations must supply information the QFC Data Protection Office orders it to provide, and allow audits and access to premises and processing equipment.
• An infringement of any provision of the Regulations, or non-compliance with an order of the Data Protection Office, is subject to a maximum penalty of USD1,500,000.

QFC Data Protection Regulations 2021, Arts. 6-10 · Read the law's page

• An app that is a Data Controller or Data Processor incorporated or registered in the QFC must process personal data lawfully, fairly and transparently, only for specific, explicit and legitimate purposes, in amounts adequate, relevant and limited to what is necessary, and only where one of the lawful bases of Article 10(1) applies.
• A Data Controller or Data Processor outside the QFC that, as part of ongoing arrangements, processes personal data through a Data Controller or Data Processor incorporated or registered in the QFC is bound by the Regulations to the extent of that processing.