QatarPersonal Data Privacy Protection Law, enforcement and penalties
Law No. 13 of 2016, Arts. 23-26
In force since .
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Qatar, including a voiceprint or faceprint, must answer to the Competent Department's complaint-and-rectification process rather than a private civil suit from the individual; a violation of the special-nature-data permission requirement or the children's-website provisions carries the higher QAR 5,000,000 fine tier, and these violations are framed as criminal offenses reaching a responsible legal person.
These lines are LexLint's reading of the law's text. Also read by: National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://ncsa.gov.qa/shared/document_library/94787172324409/33000/6112/1.0~e7cd131d-b28b-4078-b281-11f66a16342b?mimetype=application/pdf&filename=qidqx.pdf
- Guidance body
- National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar)
- Open questions
- Is the penalty for a legal person that violates Article 13, 16(3) or 17 capped by Article 25 at 'One million QR' or by Article 24 at 'five million QR'?
What it makes you log
Logging duty
Articles 23 to 25 set the fine tiers and Article 26 gives the Individual a complaint to the Competent Department, which may investigate it and issue a binding decision, with a grievance to the Minister. None of these Articles requires a record or log, or names a record the regulator may demand. Article 29, which lets Ministry employees detect and prove offences, sits outside the Articles this row cites. No territorial hook is read.
- Kind
- None
- As of
What this law does
Art. 23 sets fines up to QAR 1,000,000 for violations of Arts. 4, 8, 9, 10, 11, 12, 14, 15, and 22. Art. 24 sets fines up to QAR 5,000,000 for violations of Art. 13, Art. 16(3) (special-nature data processing without permission), and Art. 17 (children's websites). Art. 25 extends liability to a legal person committing these "crimes" in its name, confirming these are framed as criminal offenses rather than purely civil or administrative fines.
Art. 26 gives an Individual a complaint route to the Competent Department, which can issue a binding rectification order for a proven serious complaint, with a grievance route to the Minister (60-day windows both ways, silence treated as implicit rejection). The PDPPL's own text names "the Competent Department" (within the Ministry of Transport and Communications) as enforcer.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .