QatarQFC Data Protection Regulations 2021, breach notification
QFC Data Protection Regulations 2021, Art. 31
In force.
A breach notification rule binding public and private bodies.
What it requires
- An app that is a Data Controller subject to the QFC Regulations must notify the QFC Data Protection Office of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and legitimate interests of data subjects.
- A Data Processor must notify the Data Controller without undue delay after becoming aware of a breach, and a Data Controller must document every breach and consider notifying the affected data subjects.
These lines are LexLint's reading of the law's text.
What this law does
Article 31(1) of the QFC Data Protection Regulations 2021 requires a Data Controller to notify a Personal Data Breach to the Data Protection Office without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Article 31(2) removes the duty where the Data Controller has determined that the breach is unlikely to result in a risk to the rights and legitimate interests of Data Subjects.
Article 31(6) requires the Data Controller to consider notifying affected Data Subjects, and Article 31(7) requires a Data Processor to notify the Data Controller without undue delay after becoming aware of a breach. Article 31(5) requires the Data Controller to document any Personal Data Breaches.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .