QatarPersonal Data Privacy Protection Law, cross-border data flow
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Qatar out of the country, including a voiceprint or faceprint, is not itself restricted by the Controller absent an underlying breach of the PDPPL or a risk of serious damage to the data or the individual's privacy; Qatar's PDPPL, read plainly, does not impose an adequacy or whitelist gate on outbound transfer the way the UAE's or Saudi Arabia's do.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a Controller's decision to keep Personal Data only on servers inside the State count as a 'decision or measure that may limit the Cross-Border Data Flow' under Article 15?
What it makes you log
Logging duty
Article 15 forbids a Controller from limiting cross-border data flow unless the processing breaches the Law or may cause serious damage. It states no record, log or documentation duty and no audit or access right. The Article carries no scope clause of its own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Art. 15 bars the Controller from restricting cross-border data flow, unless the underlying processing already breaches the Law or would cause serious damage to the Personal Data or the Individual's privacy. Read plainly, this is a permissive default favoring cross-border flow rather than an adequacy gate.
Art. 15 applies to Personal Data generally, biometric identifiers included, since Art. 16's special-nature list narrows only which processing needs Competent Department permission, not what counts as Personal Data for this provision.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .