QatarPersonal Data Privacy Protection Law, comprehensive regime
Law No. 13 of 2016, Chapter One
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Qatar, including a voiceprint, faceprint, or other biometric identifier, must have a lawful, consent-and-purpose-based basis for processing under the PDPPL; Qatar's special-nature-data list does not name biometric data as its own heightened category, but ordinary personal data duties still apply to it.
These lines are LexLint's reading of the law's text. Also read by: National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://ncsa.gov.qa/shared/document_library/94787172324409/33000/2904/1.0~ec44b72b-0d7a-4559-8889-2101cb82a698?mimetype=application/pdf&filename=1.pdf
- Guidance body
- National Cyber Governance and Assurance Affairs, National Cyber Security Agency (Qatar)
- Open questions
- Does the Law reach a Controller located outside Qatar that processes the Personal Data of Individuals in Qatar, given that Article 2 applies the Law 'to Personal Data when it is electronically processed' and the Law has no territorial scope clause?
What it makes you log
Logging duty
Chapter One holds the definitions (Article 1) and the scope clause (Article 2), which turns on electronic processing and on processing outside a private or family scope. It states no record, log or documentation duty. The record-bearing provisions sit in other Chapters: Article 11 (internal systems, reporting of breaches and compliance audits), Article 13 and Article 14 (breach duties) and Article 18 (a special record kept by the Competent Authority), none of which this row cites. Article 2 states no territorial test (establishment, targeting or residence), so no hook is read.
- Kind
- None
- As of
What this law does
The Personal Data Privacy Protection Law (PDPPL), 27 articles, is Qatar's comprehensive personal-data statute, defining Controller, Processor, Individual, Personal Data, Cross-Border Data Flows, and other core terms in Chapter One.
Art. 1's Personal Data definition ("data of an individual whose identity is defined or can be reasonably defined") is broad and technology-neutral and plainly reaches a voiceprint or faceprint, so a biometric identifier is ordinary Personal Data bound by the PDPPL's ordinary duties even though it is absent from the Art. 16 special-nature list (see the Article 16 entry): the absence changes which heightened permission duty applies, not whether the PDPPL applies at all. Its structure is consent-and-purpose based.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .