← Global Privacy Laws Research Library
Law No. 13 of 2016 on Protecting Personal Data Privacy
Law No. 13 of 2016 on Personal Data Privacy Protection: Qatar
Prepared by Shubhank Suman · Last reviewed
Current / in application
- Legal character
- National law
- Region
- Middle East
- Issued
- 3 November 2016
- Published
- Official Gazette No. 15, 29 December 2016
What it covers
The law governs personal data processed:
- electronically
- where collected/extracted for electronic processing
- through combined electronic/traditional processing.
It excludes specified purely personal/family processing and certain official statistical processing (Al Meezan)
The law identifies an "electronic website operator" among the regulated concepts, making it especially relevant to digital services (Al Meezan)
Why it matters
It establishes a relatively concise but broad national privacy framework covering:
- consent
- lawful purposes
- individual rights
- sensitive data
- controller obligations
- processor arrangements
- security
- complaints
- audits
- international transfers
- exemptions.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
Moderate/High.
It is not an AI law.
However, Article 8 is particularly useful for technology governance because it expressly requires consideration of controls in the design, modification and development of products, systems and services involving personal-data processing (Al Meezan)
Cybersecurity
High/Very High.
Article 13 is the principal security provision.
Applicability
Covered electronic and mixed processing within the law's scope, including website operators and organisations processing personal information.
Current validity
CURRENT / IN APPLICATION. (Al Meezan)
Read first
Articles 2–6 → Articles 8–13 → Article 16 → international transfer provisions → exemptions/enforcement.
Provisions / sections covered
Article 2: Scope
Covers electronic processing and specified mixed processing, subject to exclusions (Al Meezan)
Article 3: Privacy right
Recognises the individual's right to protection of personal-data privacy and requires processing to occur transparently, fairly and with respect for human dignity (Al Meezan)
Article 4: Consent / lawful processing
Processing generally requires individual consent unless processing is necessary for a legitimate purpose of the controller or recipient (Al Meezan)
Article 5: Individual rights
The individual can:
- withdraw consent
- object to unnecessary/excessive/discriminatory/unlawful processing
- request deletion/erasure in specified cases
- request correction (Al Meezan)
Article 6: Access
Individuals can access/review their personal data and request information concerning processing and inaccurate disclosure (Al Meezan)
Article 8: Controller obligations
The controller must:
- process honestly and lawfully
- consider privacy controls when designing/changing/developing products, systems and services involving personal-data processing
- adopt administrative, technical and financial precautions
- comply with prescribed privacy policies (Al Meezan)
This makes Article 8 particularly interesting for technology and AI systems.
Article 9: Information
Requires individuals to be informed before processing about specified matters including controller details and lawful purposes (Al Meezan)
Article 10: Data quality/retention
Requires collected data to be relevant, adequate, accurate, complete and current and not retained longer than necessary for legitimate purposes (Al Meezan)
Article 12: Controller/processor disclosure
Requires disclosure or transfer to processors to remain connected to lawful purposes and comply with the (Al Meezan)
Article 13: Security
Requires controllers and processors to take precautions protecting data against:
- loss
- damage
- alteration
- disclosure
- unauthorised access
- accidental or unlawful use (Al Meezan)
Article 16: Special personal data
Covers:
- racial origin
- children
- health
- physical/mental condition
- religious beliefs
- marital status
- criminal offences.
The Minister may add additional categories where misuse/disclosure could cause serious harm (Al Meezan)
Article 18: Exemptions
Permits specified exemptions for national-security, public-security, international-relations and economic/financial interests, subject to the statutory framework (Al Meezan)
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Children's data
- Erasure and deletion
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Retention
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.