QFC DPR
Qatar Financial Centre Data Protection Regulations 2021
Key Facts
Overview
The QFC DPR is the standalone data protection regulation for the Qatar Financial Centre, enacted in 2021 and effective from June 2022. It operates separately from Qatar's national PDPPL and is closely aligned with GDPR principles. The QFC has actively enforced the regulations, issuing fines for data breach violations. Penalties are cumulative per provision infringed at up to USD 1,500,000 each.
What This Means for Your Website
- Consent or another lawful basis is required before processing personal data of QFC users
- Cookie controls must be easily accessible to data subjects
- Controllers must demonstrate compliance under the accountability principle
- Data processors have direct compliance obligations
- Written contracts are required between controllers and processors
- Penalties accumulate per provision infringed, creating significant financial exposure
Key Requirements
The QFC Data Protection Office enforces the regulations with penalties up to USD 1,500,000 per provision infringed, applied cumulatively. The accountability principle requires controllers to actively demonstrate compliance. Cookie controls must be easily accessible. Written contracts between controllers and processors are mandatory, and processors have direct compliance obligations — not just contractual ones.
How ConsentStack Handles This
ConsentStack provides easily accessible cookie controls for QFC users, meeting the explicit requirement for accessible consent mechanisms and supporting the accountability principle through documented consent records.
Penalties
Up to USD 1,500,000 per provision infringed (cumulative).
Key Requirements
- Consent or other lawful basis required for processing
- Accountability principle: controllers must demonstrate compliance
- Direct compliance obligations on data processors
- Written contracts required between controllers and processors
- Cookie controls must be easily accessible to data subjects
- Data breach notification requirements
Notable Provisions
- Penalties cumulative per provision (up to USD 1.5M per provision, not capped)
- Cookie controls must be easily accessible
- Accountability principle explicitly incorporated
- Active enforcement — QFC has issued fines for data breach violations
Other Middle East & North Africa Regulations
Frequently Asked Questions
How do QFC penalties work?
Penalties are up to USD 1,500,000 per provision infringed, applied cumulatively. Multiple violations can result in total penalties far exceeding USD 1.5M.
Does the QFC DPR require specific cookie controls?
Yes. Cookie controls must be easily accessible to data subjects under the QFC regulations.
Is the QFC DPR separate from Qatar national law?
Yes. The QFC has its own standalone Data Protection Regulations, separate from Qatar's national PDPPL (Law 13/2016).
Stay compliant with QFC DPR
ConsentStack helps you implement Opt-in consent for Qatar Financial Centre (QFC) automatically.