Duty LXD-1379
Processes biometric data, in Qatar
Personal Data Privacy Protection Law, cross-border data flowin force1 line
Law No. 13 of 2016, Art. 15 · Read the law's page
- An app transferring the personal data of an individual in Qatar out of the country, including a voiceprint or faceprint, is not itself restricted by the Controller absent an underlying breach of the PDPPL or a risk of serious damage to the data or the individual's privacy; Qatar's PDPPL, read plainly, does not impose an adequacy or whitelist gate on outbound transfer the way the UAE's or Saudi Arabia's do.
Personal Data Privacy Protection Law, breach notificationin force1 line
Law No. 13 of 2016, Arts. 13-14 · Read the law's page
- An app that is a Processor handling the personal data of an individual in Qatar, including a voiceprint or faceprint, must forthwith notify its Controller of any breach or risk of one, and a Controller must inform the affected individual and the Competent Department where a breach of security precautions may cause serious damage to the data or the individual's privacy; the National Cyber Governance and Assurance Affairs' guideline requires that notice within 72 hours of becoming aware of the breach.
Personal Data Privacy Protection Law, comprehensive regimein force1 line
Law No. 13 of 2016, Chapter One · Read the law's page
- An app that collects, uses, or discloses the personal data of an individual in Qatar, including a voiceprint, faceprint, or other biometric identifier, must have a lawful, consent-and-purpose-based basis for processing under the PDPPL; Qatar's special-nature-data list does not name biometric data as its own heightened category, but ordinary personal data duties still apply to it.
QFC Data Protection Regulations 2021, sensitive personal datain force2 lines
QFC Data Protection Regulations 2021, Art. 12 · Read the law's page
- An app that is a Data Controller subject to the QFC Regulations and processes sensitive personal data, including genetic or biometric data used to identify an individual such as a voiceprint or faceprint, must not process it unless a condition of Article 12(1) applies, such as the explicit written consent of the data subject.
- A Data Controller that cannot rely on a condition of Article 12(1) may instead obtain a permit from the QFC Data Protection Office to process the data and must apply adequate safeguards in the processing.