Qatar

The Guideline covers the use of AI by a QCB-regulated entity and imposes mandatory duties, using 'must' throughout, rather than voluntary recommendations. An entity must receive QCB approval before launching a new AI system as a provider, before a material modification to one, and before signing a High-Risk AI purchase, licensing, or outsourcing agreement.

A regulated entity must maintain an AI system register and a defined AI strategy, adopt an AI governance policy, conduct risk assessments including bias testing for High-Risk AI, and provide human oversight of AI-driven decisions. A regulated entity must give a customer a mechanism to raise inquiries about an AI-driven decision and request a review of it, and must handle any resulting complaint through standard customer-complaint processes.

The Guideline states that, alongside the Qatar Central Bank Law, an entity must also comply with named secondary regulations, including the Personal Data Privacy Protection Law (Law No. 13 of 2016) where personal data is involved. No Qatar Central Bank notice or circular stating the day the Guideline came into force has been located.

Art. 14 requires the Controller to inform the Individual and the Competent Department of a breach of the Art. 13 security precautions, but only if the breach may cause serious damage to Personal Data or individual privacy, a materiality-gated duty whose statutory text fixes no notification timeline.

The National Cyber Governance and Assurance Affairs states in its breach-notification guideline that controllers must notify it and individuals of a personal data breach within 72 hours of becoming aware of the breach where the breach can cause serious damage to individuals. Art. 13 separately requires the Processor to "forthwith notify the Controller" of any breach or risk, an internal Processor-to-Controller duty distinct from the Controller's own duty to the Individual and Department.

These duties apply to any Personal Data breach, including one involving a biometric identifier, since Arts. 13-14 are not limited to Art. 16's special-nature categories.

Article 31(1) of the QFC Data Protection Regulations 2021 requires a Data Controller to notify a Personal Data Breach to the Data Protection Office without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Article 31(2) removes the duty where the Data Controller has determined that the breach is unlikely to result in a risk to the rights and legitimate interests of Data Subjects.

Article 31(6) requires the Data Controller to consider notifying affected Data Subjects, and Article 31(7) requires a Data Processor to notify the Data Controller without undue delay after becoming aware of a breach. Article 31(5) requires the Data Controller to document any Personal Data Breaches.

The Personal Data Privacy Protection Law (PDPPL), 27 articles, is Qatar's comprehensive personal-data statute, defining Controller, Processor, Individual, Personal Data, Cross-Border Data Flows, and other core terms in Chapter One.

Art. 1's Personal Data definition ("data of an individual whose identity is defined or can be reasonably defined") is broad and technology-neutral and plainly reaches a voiceprint or faceprint, so a biometric identifier is ordinary Personal Data bound by the PDPPL's ordinary duties even though it is absent from the Art. 16 special-nature list (see the Article 16 entry): the absence changes which heightened permission duty applies, not whether the PDPPL applies at all. Its structure is consent-and-purpose based.

The QFC Data Protection Regulations 2021 are the general personal-data regime of the Qatar Financial Centre (QFC), and the laws, rules and regulations of the State of Qatar on the matters they deal with do not apply in the QFC to the fullest extent the QFC Law permits. Article 7(1) applies them to the Processing of Personal Data by a Data Controller or Data Processor incorporated or registered in the QFC.

Article 8 sets the principles of lawfulness, fairness and transparency, specific purpose, data minimisation, accuracy and storage limitation, and Article 10(1) makes Processing lawful only if one of the listed bases applies, consent among them. Version 3 of the Regulations came into force on December 6, 2023.

Art. 15 bars the Controller from restricting cross-border data flow, unless the underlying processing already breaches the Law or would cause serious damage to the Personal Data or the Individual's privacy. Read plainly, this is a permissive default favoring cross-border flow rather than an adequacy gate.

Art. 15 applies to Personal Data generally, biometric identifiers included, since Art. 16's special-nature list narrows only which processing needs Competent Department permission, not what counts as Personal Data for this provision.

Article 23 of the QFC Data Protection Regulations 2021 allows a transfer of Personal Data to a Recipient in a jurisdiction outside the QFC if the Data Protection Office has decided that the jurisdiction has an adequate level of protection. Article 24 allows a transfer to a jurisdiction without that decision only if appropriate safeguards are provided, a listed derogation applies, the limited circumstances of paragraph (4) apply, or the transfer rests on an approved transfer mechanism.

The appropriate safeguards of Article 24(2) include a legally binding agreement between the parties that includes standard data protection clauses adopted by the Data Protection Office. Under Article 33(2)(I) the Data Protection Office may order the suspension of data transfers to a Recipient outside the QFC.

Article 5 of the Personal Data Privacy Protection Law lets an Individual at any time withdraw consent to the processing of their Personal Data, object to processing that is not necessary for the purposes of collection, ask for omission or erasure when the purpose of the processing has ceased or the justifications for keeping the Personal Data cease to exist, and ask for corrections accompanied by proof of accuracy.

Article 6 lets an Individual access and review their Personal Data against any Controller, including to be notified of the processing and its purposes and to obtain a copy after paying no more than the service charge. Article 7 leaves the controls and procedures for exercising these rights to a decision of the Minister, and Article 19 exempts a Controller from Articles 5 (items 1 to 3) and 6 in listed cases such as a legal obligation or an order of a competent court.

Articles 16 to 21 of the QFC Data Protection Regulations 2021 give a Data Subject the rights of access, rectification, erasure, objection, restriction of Processing and data portability against a Data Controller. Under Article 16(3) the Data Controller must give the Data Subject a copy of the Personal Data being processed when requested. Under Article 18(1) the Data Controller must erase Personal Data without undue delay on a request in the circumstances listed in Article 18(2).

Article 21(1) gives a Data Subject the right to receive Personal Data they provided in a structured, commonly used and machine-readable format where the Processing rests on consent or a contract and is carried out by automated means.

Art. 23 sets fines up to QAR 1,000,000 for violations of Arts. 4, 8, 9, 10, 11, 12, 14, 15, and 22. Art. 24 sets fines up to QAR 5,000,000 for violations of Art. 13, Art. 16(3) (special-nature data processing without permission), and Art. 17 (children's websites). Art. 25 extends liability to a legal person committing these "crimes" in its name, confirming these are framed as criminal offenses rather than purely civil or administrative fines.

Art. 26 gives an Individual a complaint route to the Competent Department, which can issue a binding rectification order for a proven serious complaint, with a grievance route to the Minister (60-day windows both ways, silence treated as implicit rejection). The PDPPL's own text names "the Competent Department" (within the Ministry of Transport and Communications) as enforcer.

Article 33 of the QFC Data Protection Regulations 2021 gives the Data Protection Office investigative powers, including to carry out data protection audits and to obtain access to premises and data processing equipment of a Data Controller or Data Processor. Article 33(2) gives it corrective powers, including to issue reprimands, to ban Processing and to impose a penalty under Article 36.

Article 34(1) gives every Data Subject, body, organisation or association the right to lodge a complaint with the Data Protection Office about an alleged infringement. Article 36(3) subjects an infringement of any provision of the Regulations, or non-compliance with an order of the Data Protection Office, to a maximum penalty of USD1,500,000.

Art. 16 lists ethnic origin, children's data, health, physical or psychological condition, religious creeds, marital relations, and criminal offenses as "Personal Data with Special Nature." Biometric data is not named; the Minister may add other categories by decision where misuse could cause serious damage (Art. 16, para. 2).

Processing special-nature data requires "permission from the Competent Department, as per the measures and controls determined by a decision issued by the Minister" (Art. 16, para. 3), and a violation carries the higher QAR 5,000,000 penalty tier under Art. 24. Qatar's PDPPL does not name biometric identifiers as a heightened category.

Article 12 of the QFC Data Protection Regulations 2021 prohibits the Processing of Sensitive Personal Data unless a listed condition applies, such as the explicit written consent of the Data Subject.

The Regulations define Sensitive Personal Data as Personal Data revealing or relating to race or ethnicity, political affiliation or opinions, religious or philosophical beliefs, trade-union or organisational membership, criminal records, health or sex life, and genetic and biometric data used to identify an individual.

Article 12(2) provides that paragraph (1) does not apply if the Data Controller has obtained a permit from the Data Protection Office to Process the relevant Personal Data and applies adequate safeguards in the Processing.

Article 3 punishes any person who intentionally and illegally accesses a website, information system, information network, or information technology technique, exceeds authorised access, or knowingly continues to visit or access it once aware the access is unauthorised, with imprisonment of up to three years and a fine of up to QAR 500,000, doubled where the access results in acquiring, disclosing, destroying, or republishing data.

Article 2 imposes the same base penalty, doubled on the same grounds, for unlawful access specifically to a website or information system belonging to a state authority, body, entity, or affiliated corporation. Article 4 separately punishes unlawfully capturing, intercepting, or spying on traffic data or data in transit through an information network or technology technique, with a lower ceiling of two years and QAR 100,000.

The Law does not define 'unauthorised' by reference to a technical access control. Article 1 of the promulgating Law provides that the Cybercrime Prevention Law comes into force, without stating a day. No gazette notice stating the day has been located.

Article 18 permits using a protected work without the author's authorisation for exclusively personal use (reproduction, translation, or quotation among other means), and for non-profit teaching illustration with source and author attribution. Article 20 lets the rightful owner of a copy of a computer program reproduce or adapt it, in a single copy, to the extent justified by the original purpose or for preservation, a right that lapses once possession of the program ceases to be lawful.

Article 21 permits reproduction of articles, short works, or extracts for teaching in non-commercial educational institutions, subject to conditions. Article 58 ties the Law's entry into force to the date of its publication in the Official Gazette, reported by WIPO Lex's bibliographic record for this version as 3 August 2002. Exceeding these exceptions is an ordinary infringement, punishable under article 48.

Article 3(3), read against article 2's list of originally protected works, protects a database as a derived work only 'if creative in the arrangement of selection of their subject matter', the same originality-in-selection standard the article applies to encyclopedia collections and folklore compilations; Qatar confers no separate sui generis database right beyond this compilation standard.

Article 4 excludes laws, legal provisions, administrative decisions, international treaties, and official documents from protection (though a creative compilation of such material is still protected), along with daily news and other news of a mere informatory nature, and ideas, procedures, operational methods, mathematical concepts, principles, and mere data, while any derivative expression of the latter category remains protectable.

A scraper copying data from a non-creatively-arranged database, or copying facts, ideas, or bare daily news, does not infringe a copyright interest in that material under this Law.

The Insurance Sector Cyber Security Regulation is addressed to the insurance sector in Qatar, which it says is required to comply with its requirements. An insurance company's board and senior management must oversee its technology risks. An insurance company must have its information systems audited at least once every year, or whenever a change may affect their security. An insurance company must submit a compliance report to QCB on an annual basis at a minimum.

An insurance company must obtain QCB's prior approval before entering into an outsourcing agreement. Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

The Technology Risk Instructions apply to all Financial Service Operators, meaning exchange houses, investment companies, finance houses and their relevant brokers operating in Qatar and regulated by the Qatar Central Bank. A Financial Service Operator is required to comply with the requirements defined in the Instructions. The board and executive management of a Financial Service Operator must ensure an Information Security program is in place.

A Financial Service Operator must define and establish a risk management framework to manage technology risks. A Financial Service Operator must report its compliance with the requirements of the Instructions. The Instructions list the Qatar Central Bank Law (Law No. 13 of 2012) among the Qatar laws a Financial Service Operator must comply with.

Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

The Technology Risks Regulation is addressed to banks in Qatar, which it says are required to comply with its requirements. A bank's board and senior management must oversee its technology risks. A bank must have its information systems audited at least once every year, or whenever a change may affect their security. A bank must submit a compliance report to QCB on an annual basis at a minimum. A bank must obtain QCB's prior approval before entering into an outsourcing agreement.

QCB's published sanctions part for banks provides that penalties are imposed for any violation of the instructions on Modern Technology and Electronic Banking Services Risks, the circular whose requirements this Regulation says it has enhanced.

Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

The Insurance Sector Cyber Security Regulation is addressed to the insurance sector in Qatar, which it says is required to comply with its requirements. An insurance company must establish an Incident Management Framework and an Incident Management Policy and procedures to protect, detect, evaluate and respond to cyber incidents. Critical incidents must be reported immediately to QCB or within 1 hour of identification of the incident.

An insurance company must test its predetermined escalation and response plan for security incidents on an annual basis. Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

The Technology Risk Instructions apply to all Financial Service Operators, meaning exchange houses, investment companies, finance houses and their relevant brokers operating in Qatar and regulated by the Qatar Central Bank. A Financial Service Operator must develop and maintain an information security incident management policy and plan with various levels of escalation and response.

A Financial Service Operator must communicate all incidents internally according to the escalation plan, ensuring QCB and NCSA are notified immediately based on the severity of the incident, and must notify the Ministry of Interior in the case of a cybercrime. A Financial Service Operator must ensure periodic exercising and simulation of its incident response plans relevant to critical business processes and key risks.

Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

The Technology Risks Regulation is addressed to banks in Qatar, which it says are required to comply with its requirements. A bank must establish an incident management framework and an Incident Management Policy and procedures to protect, detect, evaluate and respond to cyber incidents. All critical incidents must be reported to QCB and the relevant governmental authorities within 1 hour of identification.

A bank must test its predetermined escalation and response plan for security incidents on an annual basis. QCB's published sanctions part for banks provides that penalties are imposed for any violation of the instructions on Modern Technology and Electronic Banking Services Risks, the circular whose requirements this Regulation says it has enhanced.

Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.

The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.

Article 19 permits reproducing an article in a newspaper or periodical, or broadcasting or otherwise communicating to the public an article published in a newspaper or periodical on current political, economic, social, cultural, or religious topics (or a broadcast work of the same character), subject to clearly indicating the source and the author's name where known.

The permission does not apply where the author has explicitly reserved the right of reproduction or communication to the public, so a publisher can withdraw the exception for its own content by express reservation. Article 4(2) separately excludes daily news and other news of a mere informatory nature from copyright protection altogether, so a bare factual news item carries no copyright interest to begin with, independent of article 19's conditional permission for full articles.

Neighbouring rights under article 1's definitions protect performers, sound-recording producers, and broadcasting organisations, not a print or online news publisher as such, so no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive article 15 creates exists in Qatar. A reproduction that does not meet article 19's conditions, or that a publisher has reserved, is an ordinary infringement under article 48.