Qatar PDPPL Compliance Guide
Everything you need to know about Qatar's Personal Data Privacy Protection Law — the first comprehensive data protection law passed in the GCC.
Jan 2017
In Force Since
QAR 5M
Maximum Penalty
All Sectors
Applies To
Overview
Law No. 13 of 2016 Concerning Personal Data Privacy Protection (the PDPPL) was published in Qatar's Official Gazette on 29 December 2016 and entered into force thirty days later, with a six-month transition period for existing processing. It was the first comprehensive data protection law enacted anywhere in the GCC — four years before Saudi Arabia's PDPL and five before the UAE's federal PDPA. The law applies to personal data processed electronically, obtained or collected electronically, or processed by a combination of electronic and traditional means. Enforcement sits with the National Cyber Governance and Assurance Affairs under the National Cyber Security Agency. Entities incorporated in the Qatar Financial Centre fall outside the PDPPL and under the separate QFC Data Protection Regulations 2021 instead.
Key Requirements
Consent Before Processing
Obtain the individual's consent before processing their personal data, except where the law provides another lawful basis. Consent must be capable of being withdrawn.
Consent for Cookies and Tracking
Websites must obtain consent before setting cookies or operating tracking technologies. A banner that fires analytics or advertising tags before the visitor chooses does not meet this bar.
Transparency and Purpose Limitation
Tell individuals what you collect and why, and use it only for the purpose disclosed. Repurposing data later requires a fresh basis.
Data Subject Rights
Provide access, correction, erasure and objection rights, and a route for individuals to exercise them.
Breach Notification
Notify the regulator of a personal data breach within 72 hours, and notify affected individuals where the breach is likely to cause them harm.
Heightened Protection for Sensitive Data and Children
Processing data of a special nature — health, ethnicity, religious belief, criminal records — requires explicit permission. Processing children's data requires the guardian's consent.
Penalties for Non-Compliance
The PDPPL is enforced through administrative fines. Unusually for the region, it carries no imprisonment provisions.
Administrative Fines
Up to QAR 1,000,000 for general violations of the law's obligations.
Aggravated Violations
Up to QAR 5,000,000 where the violation involves data of a special nature or the personal data of children.
No Criminal Track
Unlike Saudi Arabia's PDPL, the PDPPL provides for financial penalties only and does not carry imprisonment.
Corrective Orders
The regulator can require a controller to correct or stop non-compliant processing, independently of any fine.
How Arqam360 Helps
Consent Before the First Tag
The banner blocks analytics and advertising tags until the visitor chooses, so nothing fires before consent exists. That is the requirement most sites miss.
Bilingual by Default
Arabic and English consent, written natively rather than translated, with a right-to-left layout that is designed rather than mirrored.
Withdrawal and Audit Trail
A preference centre lets visitors withdraw consent at any time, and every decision is recorded with a timestamp so you can evidence it later.
Gulf Trackers Classified
Our classifier covers the payment, shipping and analytics services Gulf storefronts actually run — including regional providers most consent tools list as unknown.
Enforcement Timeline
PDPPL Published
Law No. 13 of 2016 published in the Official Gazette on 29 December — the GCC's first comprehensive data protection law.
Law Enters Into Force
The PDPPL takes effect thirty days after publication, with a six-month transition period for existing processing activities.
Guidelines Published
The ministry publishes fourteen guidelines for regulated organisations, plus separate guidance for individuals, turning the law's principles into operational expectations.
QFC Regime Separates
The QFC Data Protection Regulations 2021 come into force, replacing the 2005 rules and confirming a standalone regime for QFC-registered entities.
Check Your Qatar PDPPL Compliance
Scan your storefront free. See which trackers fire before consent, whether your banner blocks them, and what a regulator would see.
Run a Free ScanLast updated:
Sources
- 1.Law No. 13 of 2016 on Protecting Personal Data Privacy — official English text (NCSA Qatar)
- 2.Communications Regulatory Authority of Qatar — Data Protection Law No. 13 of 2016
- 3.DLA Piper, Data Protection Laws of the World — Qatar
- 4.Cooperation Council for the Arab States of the Gulf — official portal
- 5.Albesher, Alsaad & Alhussain (2026) — cookie consent usability and privacy compliance in Saudi Arabia, PeerJ Computer Science 12:e3701
Regulations
Compliance guides for GDPR, PDPL, and moreSaudi PDPL Compliance Guide
UAE PDPA Compliance Guide
Bahrain PDPL Compliance Guide
Jordan PDPL Compliance Guide
Kuwait Data Protection Compliance Guide
GCC Privacy Laws Overview
GDPR Compliance Guide
CCPA Compliance Guide
Qatar PDPPL FAQ
Common questions about Qatar's Personal Data Privacy Protection Law.
It was published on 29 December 2016 and entered into force thirty days later, in late January 2017, with a six-month transition period for processing already under way. It was the first comprehensive data protection law in the GCC.
Get Qatar PDPPL Compliant
Deploy a bilingual, consent-first banner in minutes. Free forever on one domain.