QatarPersonal Data Privacy Protection Law, breach notification
Law No. 13 of 2016, Arts. 13-14
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that is a Processor handling the personal data of an individual in Qatar, including a voiceprint or faceprint, must forthwith notify its Controller of any breach or risk of one, and a Controller must inform the affected individual and the Competent Department where a breach of security precautions may cause serious damage to the data or the individual's privacy; the National Cyber Governance and Assurance Affairs' guideline requires that notice within 72 hours of becoming aware of the breach.
These lines are LexLint's reading of the law's text. Also read by: National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2919/1.0~87ad685f-7efe-476e-89f3-d2ae1cfed459?mimetype=application/pdf&filename=NO.pdf
- Guidance body
- National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar)
- Open questions
- Must a Controller inform the Individual and the Competent Department of a breach that may cause damage short of the 'serious damage to Personal Data or individual privacy' that Article 14 names, as one passage of the Agency's breach guideline states?
What it makes you log
Logging duty
Articles 13 and 14 oblige the Processor to notify the Controller of a breach and the Controller to inform the Individual and the Competent Department of a breach that may cause serious damage. They are duties to notify and state no register, log or documentation of breaches. Article 11(5), which asks the Controller for internal systems for reporting a breach, sits outside the Articles this row cites. The two Articles carry no scope clause of their own, so no territorial hook is read here.
- Kind
- None
- As of
What this law does
Art. 14 requires the Controller to inform the Individual and the Competent Department of a breach of the Art. 13 security precautions, but only if the breach may cause serious damage to Personal Data or individual privacy, a materiality-gated duty whose statutory text fixes no notification timeline.
The National Cyber Governance and Assurance Affairs states in its breach-notification guideline that controllers must notify it and individuals of a personal data breach within 72 hours of becoming aware of the breach where the breach can cause serious damage to individuals. Art. 13 separately requires the Processor to "forthwith notify the Controller" of any breach or risk, an internal Processor-to-Controller duty distinct from the Controller's own duty to the Individual and Department.
These duties apply to any Personal Data breach, including one involving a biometric identifier, since Arts. 13-14 are not limited to Art. 16's special-nature categories.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .