Law No. 13 of 2016 concerning Personal Data Privacy Protection — breach notification

The Law requires a controller to notify the supervisory department and the affected individual of a breach that would cause serious damage to the individual's personal data or privacy, and requires a processor that becomes aware of such a breach to notify its controller. The widely-cited 72-hour deadline comes from the regulator's guidelines rather than from the statutory text, which is why it is stated here as regulator expectation rather than as a statutory clock. Note the parallel regime the comprehensive-law entry flags: entities licensed in the Qatar Financial Centre follow the QFC Data Protection Regulations 2021 instead, which have their own separately drafted breach rules. Marked 'check': the operative source for timing is guidance, and the statutory article numbering was not confirmed against a primary text.