Qatar PDPPL

Overview

Qatar's PDPPL is the national data protection law enacted in 2016, applying throughout the country except within the Qatar Financial Centre (which has its own regulations). The law is notable for imposing only financial penalties without criminal sanctions — an unusual approach in the Middle East. The CDP published implementation guidelines in December 2020 to clarify requirements.

What This Means for Your Website

• Consent is required before processing personal data of Qatari visitors
• Special protections apply for sensitive data categories including children, health, and religion
• Direct electronic marketing is restricted and requires compliance with specific provisions
• The law does not apply within the QFC, which has its own data protection regulations
• Breach notification is required
• Cross-border data transfers are subject to restrictions

Key Requirements

The CDP enforces the law with financial penalties of QAR 1,000,000 to QAR 5,000,000. Unlike most Middle Eastern jurisdictions, there are no criminal penalties or imprisonment provisions. Data must be processed with transparency, fairness, and respect for human dignity. Special protections apply to sensitive data categories including children's data, health information, and religious data.

How ConsentStack Handles This

ConsentStack applies opt-in consent collection for Qatari visitors, supporting compliance with the PDPPL's consent requirements and restrictions on direct electronic marketing.