Law No. 13 of 2016 concerning Personal Data Privacy Protection

The first comprehensive data-protection law in the GCC. It applies to personal data processed electronically, or obtained/collected/extracted by electronic means and then processed by a combination of electronic and traditional means, in Qatar — a territorial and medium-based test rather than a targeting test, so the trigger below is modeled on established presence only. Core duties: transparency, purpose limitation, consent for most processing, a mandated set of security controls, breach notification to the CDP and affected individuals, and prior CDP permission for processing data of 'special nature' (health, ethnicity, children's data, criminal records, physical/psychological condition, religious beliefs, marital relations). Note the parallel regime: entities licensed in the Qatar Financial Centre are subject instead to the QFC Data Protection Regulations 2021, a separate GDPR-aligned framework — check which applies before designing a program.