QatarPersonal Data Privacy Protection Law, special-nature personal data
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app processing a data category the PDPPL treats as special in nature (ethnic origin, children's data, health, physical or psychological condition, religious creeds, marital relations, or criminal offenses) about an individual in Qatar must obtain permission from the Competent Department; Qatar's PDPPL does not currently name biometric data as its own special-nature category, so an app processing a voiceprint or faceprint should not assume this permission requirement applies without a further check of any ministerial decision that may have added it.
These lines are LexLint's reading of the law's text. Also read by: National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2923/1.0~5c715dfb-d7e1-415d-9a52-ce088168c29c?mimetype=application/pdf&filename=Specia.pdf
- Guidance body
- National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar)
- Open questions
- Does a voiceprint or faceprint count as Personal Data related to 'physical or psychological condition' under Article 16, or is it of a special nature only if the Minister adds 'other types of Personal Data of a special nature'?
What it makes you log
Logging duty
Article 16 lists the special-nature categories, lets the Minister add categories and additional precautions, and requires the Competent Department's permission before processing. It states no record, log or documentation duty. The Article carries no scope clause of its own, so no territorial hook is read.
- Kind
- None
- As of
What this law does
Art. 16 lists ethnic origin, children's data, health, physical or psychological condition, religious creeds, marital relations, and criminal offenses as "Personal Data with Special Nature." Biometric data is not named; the Minister may add other categories by decision where misuse could cause serious damage (Art. 16, para. 2).
Processing special-nature data requires "permission from the Competent Department, as per the measures and controls determined by a decision issued by the Minister" (Art. 16, para. 3), and a violation carries the higher QAR 5,000,000 penalty tier under Art. 24. Qatar's PDPPL does not name biometric identifiers as a heightened category.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .