WEBVTT
00:00:21.359 --> 00:00:31.440
Hello and welcome back to the International Data Protection Regulation Podcast, where we explore privacy laws around the world and how they shape our digital lives.
00:00:31.600 --> 00:00:32.159
I'm Dr.
00:00:32.240 --> 00:00:37.679
Maria Maloney, and today I'm joined again by my wonderful co-host, Katie Birch.
00:00:38.159 --> 00:00:39.039
Thanks, Maria.
00:00:39.200 --> 00:00:41.679
Hi everyone, it's great to be back.
00:00:42.399 --> 00:00:44.880
In today's episode, we're focusing on Qatar.
00:00:45.200 --> 00:00:54.079
I hope I said that right, a jurisdiction that was one of the first in the Gulf region to introduce a comprehensive national data protection law.
00:00:54.320 --> 00:00:56.719
The law, which is called Law No.
00:00:56.960 --> 00:01:11.359
13 of 2016, concerning personal data privacy protection, reflects many global privacy principles while also responding to Qatar's own governance and cybersecurity context.
00:01:11.599 --> 00:01:26.799
Together, Katie and I will walk through how Qatar defines personal data, what rights individuals have, what obligations fall on organizations, and how these rules may indirectly shape emerging AI systems.
00:01:27.359 --> 00:01:29.280
So I'll get straight to the point.
00:01:29.439 --> 00:01:31.280
The first question goes to you, Katie.
00:01:31.680 --> 00:01:37.920
To start us off, what is the core data protection legislation in Qatar and when was it introduced?
00:01:38.319 --> 00:01:39.439
Thank you, Maria.
00:01:39.760 --> 00:01:49.599
So the primary legislation in Qatar is, as you said, law number 13 of 2016 concerning personal data privacy protection.
00:01:49.760 --> 00:01:52.640
It's often abbreviated to the PDPPL.
00:01:52.959 --> 00:02:05.359
It was issued on the 3rd of November 2016, and Qatar was actually the first nation within the Gulf Cooperation Council to implement a dedicated national privacy law.
00:02:05.599 --> 00:02:17.840
The law established a comprehensive framework for the protection of individuals' privacy rights by regulating how personal data is collected, processed, and stored by individuals and organizations.
00:02:18.719 --> 00:02:21.919
It has strict requirements for data controllers.
00:02:22.240 --> 00:02:26.000
They have to process data fairly and transparently.
00:02:26.319 --> 00:02:32.560
They have specific protections for special category data, which we'll go to later.
00:02:33.360 --> 00:02:45.520
They have their authority, the NCSA, and they have also given out a lot of guidelines to kind of help companies with the practical implementation of it, which is quite good.
00:02:59.919 --> 00:03:04.879
Additionally they have touched into AI a little bit, which I suppose we'll talk about later too.
00:03:04.960 --> 00:03:16.719
But in 2021, the Ministry of Communications and Information Technology released some regulatory guidelines about the use of AI and the development of AI.
00:03:16.960 --> 00:03:21.039
Yeah, that's just the general outlook on what it looks like.
00:03:21.120 --> 00:03:21.840
So I'll move on.
00:03:22.800 --> 00:03:23.120
Yeah.
00:03:23.680 --> 00:03:25.599
They seem fairly advanced, like you say.
00:03:25.680 --> 00:03:36.719
They were in 2020 sixteen, even before the GDPR, they have their national data protection law um you know uh rolled out across the country, which is which is good.
00:03:37.039 --> 00:03:40.879
Yeah, I would agree they're quite on on top of things there.
00:03:41.599 --> 00:03:51.520
So my question for yourself, Maria, will be How does Qatar's law define personal data and does it include sensitive categories?
00:03:52.080 --> 00:03:52.800
Thanks, Katie.
00:03:53.039 --> 00:04:03.439
So in Qatar, the law defines personal data as any information relating to a natural person whose identity is clearly identified or can be reasonably identified.
00:04:03.520 --> 00:04:08.639
And I think what they mean by that is kind of can be inferred from information by putting information together.
00:04:08.879 --> 00:04:30.959
This identification can occur either directly through data itself, uh such as your name or your like an ID that you have, your national ID number, your passport, or like I said, by combining information with any other details or data points that could then, when they're combined, uh kind of identify you as who you are.
00:04:31.199 --> 00:04:44.240
The legislation does include a specific, more rigorous category known as personal data of a special nature, and that would be Qatar's equivalent of what we call special category data or sensitive data.
00:04:44.480 --> 00:04:54.560
And this includes categories such as ethnic origin, interestingly, children's data, physical or mental health information, and religious creeds.
00:04:55.040 --> 00:05:08.399
Another interesting thing is that it can also extend to include your marital status or your marital relations, like for example, if you got married, that that would then become personal data of a special nature.
00:05:08.480 --> 00:05:15.680
And as well, if you you know if you obtained a criminal record, that would also be you know contained within that category.
00:05:16.240 --> 00:05:29.199
Because then the reason why they have this category, as just like in the GDPR, is because the misuse of this special nature of data is considered in Qatar more likely to cause serious damage to an individual.
00:05:29.360 --> 00:05:33.360
It cannot be processed as freely as the standard personal data.
00:05:33.519 --> 00:05:47.199
And under Article 16 of the law, any organization wishing to process this, these kind of sensitive categories must first obtain explicit permission from the National Cybersecurity Agency or the NCSA.
00:05:48.000 --> 00:05:59.519
Um and once permission is received, organizations or what we call you know data controllers, which is also the same term that is in the GDPR, must implement additional safeguards for this type of data.
00:05:59.680 --> 00:06:06.000
So this type of data is considered special, you know, as it needs special treatment under the law.
00:06:06.160 --> 00:06:19.439
This makes Qatar's approach particularly strict as it shifts from like what we have in the GPR self-compliance almost to a more like permit-based model for sensitive data.
00:06:19.839 --> 00:06:35.680
The Minister of Transport and Communication may also um they they reserve the right to add other types of data to this category if it is deemed that the misuse of this type of data would cause serious damage to the individual.
00:06:35.839 --> 00:06:42.639
So um it's the Minister of Transport and Communication that can expand that category, you know, in the future.
00:06:43.360 --> 00:06:49.519
So, yeah, so I mean they take personal data and special category data very seriously.
00:06:49.680 --> 00:07:03.920
And we we see as well with the NCSA, the National Cybersecurity Agency, that you know, you actually have if you want to process personal uh special category data or what we call under the GPR special category data, you actually have to get permission to process that data.
00:07:04.079 --> 00:07:05.120
So that's interesting.
00:07:06.000 --> 00:07:06.720
That is different.
00:07:07.120 --> 00:07:08.000
Yeah, it's different.
00:07:08.160 --> 00:07:08.560
Yeah.
00:07:09.680 --> 00:07:17.439
So moving on, Katie, to question three what lawful basis does Qatar rely on for personal processing personal data?
00:07:17.680 --> 00:07:23.759
Is it consent central like we saw with uh various other legislation in the Gulf region?
00:07:24.160 --> 00:07:26.079
Or is it similar to the GDPR?
00:07:26.399 --> 00:07:27.360
Thanks, Maria.
00:07:28.319 --> 00:07:29.839
It is consent central.
00:07:29.920 --> 00:07:30.879
I would say yes.
00:07:31.120 --> 00:07:36.399
It consent seems to be the core, the core of lawful processing.
00:07:36.639 --> 00:07:50.480
Article 4 of the PDPPL says that the controller shall process personal data only after obtaining the consent of the individual, unless there is a certain lawful purpose.
00:07:50.879 --> 00:07:54.399
Individuals have the right to withdraw their consent at any time.
00:07:54.720 --> 00:08:03.680
And I mean, as per usual, the process for withdrawing consent needs to be as easy as the process of doing it, so that's quite good.
00:08:04.319 --> 00:08:17.360
But so I'm just gonna go back to those lawful purposes because the other these are more exceptions to consent, so situations where you can process data without consent.
00:08:17.680 --> 00:08:20.800
Um, and they're set out in chapter five of the act.
00:08:20.959 --> 00:08:22.480
I'm just gonna go through them here.
00:08:22.560 --> 00:08:30.480
So we have legal obligations where they're required by Qatari laws or court order to process data.
00:08:30.800 --> 00:08:49.279
I also just want to mention here that I feel I'm not sure if contractual necessity would come under legal obligation because they haven't explicitly listed contract as a reason in the same way GDPR has.
00:08:50.240 --> 00:08:58.399
So I assume to the extent that a contract is legally enforceable, it would come under this lawful purpose.
00:08:58.799 --> 00:09:18.320
They have public interest where processing is necessary for a task carried out in the public interest, or vital interest, or as usual, they have where processing serves a legitimate business purpose, they have scientific research carried out in the public interest and investigating a crime.
00:09:18.960 --> 00:09:29.440
And as you just touched on, they do have structural require requirements for the law for processing sensitive data lawfully, and the bar is much higher.
00:09:29.759 --> 00:09:36.080
For these categories, having a lawful basis like legitimate interest is not enough.
00:09:36.320 --> 00:09:44.000
They do need the explicit permission of the National Cybersecurity Agency, and they do need explicit consent.
00:09:44.799 --> 00:09:57.519
Okay, and we saw as well there that um you know that sensitive or uh the data, personal data of a of a sensitive nature with it, that extends to uh your criminal record.
00:09:57.759 --> 00:10:04.720
So, yeah, so you would have to get permission uh from the from the National Cybersecurity Agency to process that data.
00:10:04.879 --> 00:10:10.399
But like you say, it is very much consent-driven as opposed to the GDPR.
00:10:10.480 --> 00:10:10.799
Yeah.
00:10:11.200 --> 00:10:14.080
It is consent at the forefront for sure.
00:10:14.399 --> 00:10:15.039
Yeah.
00:10:15.440 --> 00:10:19.600
Um so go on to question four for yourself.
00:10:19.840 --> 00:10:22.000
And it's about the data subject rights.
00:10:22.159 --> 00:10:27.919
So, what rights does the law provide to the individual and how do they compare to the GDPR?
00:10:28.320 --> 00:11:01.519
Well, again, I think if you know the data subject rights in the GDPR, you will be, you know, I think you'll feel quite comfortable with the data subject rights in uh uh Qatar's law number 13, um, because it grants individuals a specific set of rights, uh, it and it has the same philosophy as the GDPR, you know, kind of fundamentally protection of individuals' fundamental rights, like in the GDPR, uh, although the scope um in Qatar is somewhat narrower and more focused on the core principles of transparency and control.
00:11:02.320 --> 00:11:07.679
The law explicitly provides individuals with the following rights regarding their personal information.
00:11:07.840 --> 00:11:13.759
So you have what we call the right to withdraw consent, and that's again similar to what we see in the GDPR.
00:11:14.080 --> 00:11:29.519
You have the right to object to processing if you think that the processing is outside the original purpose for which you gave your data, or it has become excessive, or it's been used in a discriminatory or illegal way.
00:11:30.159 --> 00:11:46.240
Um, you also have the right to erasure, which is Qatar's version of the right to be forgotten, allowing individuals to request the deletion of their data once the purpose for the processing has ended, or if the if the data can be proven to be collected unfairly.
00:11:46.480 --> 00:12:01.679
Uh, it also has you know a right to access and review, so the individual can uh view their data, their store data, and verify that it's accurate and update that, you know, if again, so the next right would be the right correction.
00:12:01.840 --> 00:12:08.320
So if you review your data and you see that it's inaccurate, you actually have the right to update that data as well.
00:12:08.480 --> 00:12:10.879
So, again, very similar to the GDPR.
00:12:11.200 --> 00:12:13.039
You have the right to be notified as well.
00:12:13.120 --> 00:12:22.960
So the individuals must be informed of the processing activities, the purposes behind them, and any instances where their inaccurate data has been disclosed to third parties.
00:12:23.120 --> 00:12:23.440
Okay.
00:12:24.080 --> 00:12:33.759
Um, so overall, like again, you'd be comfortable coming from the GDPR and going to the Qatari set of data subject rights.
00:12:33.919 --> 00:12:48.720
In terms of the right to portability, there's no it's not explicitly mentioned in the 2016 law in Qatar, but they don't really provide uh kind of protection for automated decision making either, like they do in the GDPR.
00:12:49.200 --> 00:12:58.480
And as well, it's kind of generally understood that the response time is 30 days, whereas it's more specific explicit in the in the GDPR.
00:12:59.039 --> 00:13:06.159
And of course, like we said, you know, personal sensitive category data is needs it needs a uh a permit.
00:13:06.240 --> 00:13:10.879
So they're the kind of the differences between the GDPR and um and Qatar.
00:13:11.440 --> 00:13:13.440
But again, you know, very similar.
00:13:13.759 --> 00:13:16.720
So moving on then to question five, Katie.
00:13:17.200 --> 00:13:22.159
What are the main organizational obligations under the PBPPL?
00:13:23.360 --> 00:13:24.639
Thanks, Maria.
00:13:24.960 --> 00:13:37.279
So organizations who are as per usual uh or as normal anyways, referred to as controllers, are bound by a set of strict operational and technical obligations.
00:13:37.759 --> 00:13:43.840
They're designed to shift the burden of protection from individuals to the controller themselves.
00:13:45.279 --> 00:13:53.919
So there's a few specific conditions directly from the act, and then there's a few kind of expansions that are found within the guidelines.
00:13:55.039 --> 00:14:16.559
So what we find in the act is they need to review privacy protection measures before entering new processing operations, which I suppose is expanded on in the guidelines, which talks about the need for DPIOs before starting any processing activity.
00:14:16.799 --> 00:14:22.000
They have a couple of guidelines about you know how to assess that risk and how to carry it out.
00:14:22.320 --> 00:14:29.120
But when they engage protesters, they need to make sure that they're going to be responsible for their data protection obligations.
00:14:29.360 --> 00:14:31.279
So again, we've seen that.
00:14:32.960 --> 00:14:37.600
So they're also responsible for training and raising awareness on data protection.
00:14:37.840 --> 00:14:43.919
They need to develop their internal systems to receive and investigate complaints and any rights requests.
00:14:45.200 --> 00:14:49.279
They need to develop internal systems for management of personal data.
00:14:49.519 --> 00:14:55.919
So they basically need a formal framework to manage the data lifecycles and document compliance.
00:14:56.720 --> 00:15:03.600
There's no explicit requirement for a DPO, it's more of a may, but it's still recommended.
00:15:03.679 --> 00:15:08.559
I mean, to to coordinate and carry out all of these requirements at the end of the day.
00:15:08.879 --> 00:15:15.120
They need to use their appropriate technologies to enable individuals to exercise their rights.
00:15:16.480 --> 00:15:22.559
So that just reminds me of like the web forms and stuff.
00:15:23.360 --> 00:15:26.080
But we would have in privacy engines, yeah.
00:15:26.879 --> 00:15:34.240
So facilitating, facilitating data subjects, you know, having ability to access their rights or request information.
00:15:34.639 --> 00:15:34.960
Yeah.
00:15:36.159 --> 00:15:48.879
And they also need to conduct audit, ongoing audits and reviews of their compliance with the requirements, and need to verify protesters' compliance, taking appropriate precautions to protect personal data.
00:15:48.960 --> 00:15:54.240
So I mean, a data sharing agreement wouldn't be out of the question there.
00:15:54.320 --> 00:15:56.960
Like, you know, some of the things don't explicitly say it.
00:15:57.039 --> 00:16:10.559
As I said, the guidelines go a lot more into it, but you know, it's a mat it's a kind of a question of it'll make your life easier to abide by those requirements.
00:16:10.960 --> 00:16:11.519
Absolutely.
00:16:11.600 --> 00:16:27.440
So it's kind of a standard approach that we see, you know, we've seen with the GDPR kind of you know, assessments of of third parties, vendors, uh, making sure you have a contract in place to ensure that you are protected if there's a breach that happens with the processor and so on.
00:16:27.600 --> 00:16:27.840
Yeah.
00:16:28.159 --> 00:16:29.360
Yeah, for sure.
00:16:29.919 --> 00:16:37.840
So they also have their notifications obligations, their transparency obligations, which we know quite well.
00:16:38.000 --> 00:16:43.919
Um so they all would align quite similarly to the GDPR, basically.
00:16:45.279 --> 00:16:45.840
Yeah.
00:16:46.159 --> 00:16:52.240
They also have their principles um like of data minimization and accuracy.
00:16:52.720 --> 00:16:57.440
They have their bridge reporting, but we're going to talk about that a bit a bit more later.
00:16:57.600 --> 00:17:11.519
But yeah, so a lot of it is GDPR related, and you don't need a DPO, but I mean it's easier to be compliant with one, especially if you're handling handling a lot of data.
00:17:11.839 --> 00:17:16.079
So we'll move on now to kind of what I was touching on there at the end of that.
00:17:16.240 --> 00:17:24.799
But um, Maria, could you tell us a bit about their breach notification requirements and what is expected in practice?
00:17:25.279 --> 00:17:26.240
Absolutely, yeah.
00:17:26.319 --> 00:17:32.480
So um in Qatar, the PDPPL explicitly requires breach notification.
00:17:32.720 --> 00:17:40.559
And as of 2026, the regulatory expectations are strictly enforced by the NCSA or the National Cybersecurity Agency.
00:17:40.640 --> 00:17:51.119
So we've seen guidelines as well in 2026 and uh you know uh in in the recent past that makes it makes things more specific about the law.
00:17:51.440 --> 00:18:00.079
So unlike some jurisdictions where every minor leak must be reported, so we've seen that more and more with a GDPR.
00:18:00.240 --> 00:18:04.720
It seems like we you know you always have to report uh breaches with the GDPR.
00:18:04.880 --> 00:18:19.599
Qatar's law and more specifically Article 14 of the law triggers the notification requirement only if the breach is likely to cause what they call serious damage to the personal data or the privacy of the individuals.
00:18:19.839 --> 00:18:32.400
So how they interpret serious damage or how the regulators interpret serious damage usually means either something like identity theft or fraudulent use of personal data in some way.
00:18:32.799 --> 00:18:44.799
Uh, finance the potential of financial loss, financial loss for the individuals, or if there was unauthorized access to bank accounts of the individual and so on, that would be seen as serious damage.
00:18:45.119 --> 00:18:53.119
Physical or psychological harm as well, um, particularly involving sensitive data like health or children's data.
00:18:53.279 --> 00:19:11.440
And again, we saw that in the uh the Kingdom of Saudi Arabia's law, do you remember um particular sensitive, you know, quite protective of the individual, you know, would be considered quite, you know, psychological harm would be considered serious damage to the individual.
00:19:11.680 --> 00:19:22.160
And as well, reputational damage would be, you know, a sign where if there's a significant loss of privacy, that would be seen as serious damage as well.
00:19:22.319 --> 00:19:27.119
So that's quite interesting, the interpretation of what they see as serious damage.
00:19:27.200 --> 00:19:37.759
And we've seen that quite a lot in the in the Gulf region, where you know the culture kind of impacts the you know how they interpret the law, which is which is an interesting thing.
00:19:38.000 --> 00:20:00.480
Um, in terms of the the like the 70 72-hour rule that we see in the GDPR, the original law back in 2016 was somewhat vague on timing, but supplement, like I said, supplemental guidelines issued by the regulator have introduced a clear 72-hour window after 2020 uh 2016.
00:20:00.880 --> 00:20:10.079
So the organization must notify the NCSA or the National Cybersecurity Agency within 72 hours of becoming aware of the breach.
00:20:10.559 --> 00:20:18.640
And it must notify affected individuals within 72 hours as well if the serious damage threshold is met.
00:20:19.200 --> 00:20:27.279
And this ensures that individuals can take immediate steps, such as changing passwords or freezing credit cards and so on, to protect themselves.
00:20:27.519 --> 00:20:38.000
So, in practice, the Guitari Qatari regulator expects a high level of accountability and proactivity when it comes to breach reporting.
00:20:38.160 --> 00:20:40.400
They expect kind of internal management.
00:20:40.480 --> 00:20:50.480
So organizations are expected to have an internal personal data management system, as you mentioned previously, Katie, that can detect and try out breaches very quickly.
00:20:50.640 --> 00:20:58.400
If an organization cannot prove that they have the tools to detect a breach, they can be fined, even if they eventually report it.
00:20:58.480 --> 00:21:04.240
Like if they if their processes are seen to be inadequate, then they can be fined.
00:21:04.480 --> 00:21:17.440
Transparency is also a very big thing when notifying individuals, the organization must use clear, non-technical language to explain what happened, what data was lost, and what steps the individual should take to protect themselves.
00:21:17.599 --> 00:21:26.880
If the breach happens with the processor or a third party, they are legally required to notify the main organization or what they call the data controller immediately.
00:21:27.039 --> 00:21:32.640
So, you know, the things can be put in place to protect the individual and to notify the regulator.
00:21:33.200 --> 00:21:40.960
So, in terms of penalties, the expectation for reporting is backed up by significant financial deterrence.
00:21:41.119 --> 00:21:53.839
Uh failure to report a breach causes serious that can cause serious damage to individuals, can result in a fine of up to a million Qatari real, which is about$275,000.
00:21:54.480 --> 00:22:06.319
So and if the breach happened because the company failed to put appropriate Precautions in place, that fine can actually rise up to five million Qatar in Ryan.
00:22:06.799 --> 00:22:09.279
You know, so that's a significant increase.
00:22:09.440 --> 00:22:11.599
You know, that's over a million dollars as well.
00:22:12.480 --> 00:22:16.000
So yeah, they they take breach very seriously.
00:22:16.480 --> 00:22:23.839
And overall, I think from looking at everything that we've looked at so far, we can say that Qatar takes data protection quite seriously as well.
00:22:26.559 --> 00:22:29.200
Moving on with it for question seven, Katie.
00:22:29.680 --> 00:22:38.240
And we're moving through these quite quickly this week because I think we're getting good at we're getting more experienced at questions and answers.
00:22:38.480 --> 00:22:43.680
Um who enforces Qatar's national data protection law and what penalties exist?
00:22:43.839 --> 00:22:48.160
So again, I've touched on that in the previous question, but let's look into it in more detail now.
00:22:49.119 --> 00:22:51.200
Yeah, um thanks, Maria.
00:22:51.359 --> 00:23:10.079
So as we said, they have kind of the overseeing authority, the National Cybersecurity Agency, but they also have a national data protection office within the cybersecurity agency that's focused on data protection specifically.
00:23:10.799 --> 00:23:30.880
So the agency itself has the power to conduct investigations, audits, and give orders, but the office give uh you know decisions, more so to say they give decisions on the uh on the organizations, you know, following the investigations and stuff.
00:23:31.119 --> 00:23:40.480
So the the PD PPL uh carries some of the steepest financial penalties in the region.
00:23:40.960 --> 00:24:00.559
Um you had failure to report a breach, which uh you already mentioned, but uh a fine for lack of proper safeguards could be up to five million uh Hictorian Reales, which is one million three hundred and seventy thousand dollar equival equivalent.
00:24:00.960 --> 00:24:01.519
Wow.
00:24:02.079 --> 00:24:02.720
Yeah.
00:24:03.359 --> 00:24:15.759
So it's significant, and also the reputational damage of you know having a fine and and a decision made against you because you you didn't have technical measures in place, you know.
00:24:15.920 --> 00:24:21.920
I feel like sometimes the reputational damage can be worse, especially for big companies.
00:24:22.319 --> 00:24:24.079
I agree, yeah, yeah.
00:24:24.559 --> 00:24:28.960
So yeah, they also it's interesting there as well.
00:24:29.039 --> 00:24:37.200
So processing sensitive data without a permit can bring can get you the same kind of uh time over a million dollars.
00:24:37.440 --> 00:24:38.400
That's interesting.
00:24:39.599 --> 00:24:46.319
It is, yeah, especially like like I don't know what the process of going through that would be, you know.
00:24:46.480 --> 00:24:57.119
Like I wonder how much leeway companies who were already processing sensitive data had between the introduction of the act and the permit process.
00:24:58.240 --> 00:24:59.680
Yeah, that's true, yeah.
00:25:00.400 --> 00:25:00.960
I don't know.
00:25:01.200 --> 00:25:03.359
But especially in the medical industry, you know.
00:25:03.599 --> 00:25:04.720
Yeah, yeah.
00:25:06.000 --> 00:25:12.079
Um, even religious organizations for marriages and stuff, prisons, you know, there's loads.
00:25:12.480 --> 00:25:20.880
So I'll just touch touch on uh an enforcement decision uh as we did last week.
00:25:21.039 --> 00:25:22.559
We found that quite helpful.
00:25:24.079 --> 00:25:25.039
Oh yeah, that's true.
00:25:25.119 --> 00:25:25.359
Yeah.
00:25:26.480 --> 00:25:38.960
So they don't seem to give the names of the company uh involved whenever they publish enforcement decisions, which is interesting, like kind of choice and transparency.
00:25:40.000 --> 00:25:59.759
But so basically the NDPO issued a ruling uh for a company in the ICT sector around its compliance program, which was prompted by an investigation following a formal complaint submitted by a data subject related to a request.
00:26:01.920 --> 00:26:04.720
So we've seen that that's kind of a pattern, you know.
00:26:04.880 --> 00:26:28.480
One one request that wasn't fulfilled to a satisfactory nature has led to investigations in two jurisdictions so far that we've seen that then highlighted bigger deficiencies in their privacy programs, and they got decisions from the authority saying this is not adequate.
00:26:28.960 --> 00:26:34.240
Um so I find more about their privacy programs than it was about the data subject access request.
00:26:34.480 --> 00:26:34.640
Yeah.
00:26:34.880 --> 00:26:35.200
Yeah.
00:26:35.519 --> 00:26:36.319
Exactly.
00:26:36.640 --> 00:26:53.200
In this case, for the ND NDPO decision, the company apparently, well, according to the the source, their their level of cooperation with the authority helped their case.
00:26:53.279 --> 00:27:00.640
That was apparently a note, a note that they commented on that they had they were quite forthcoming and you know cooperative.
00:27:01.279 --> 00:27:23.920
So that's another point to remember, I think, that like even though there is those fines, that once the authority is kind of at your doorstep to cooperate them and be transparent with them rather than kind of developing a defensive mentality around God, I'm gonna get a fine, you know.
00:27:24.240 --> 00:27:27.039
Yeah, and I think I think that's an a natural response as well.
00:27:27.200 --> 00:27:29.119
And you know, we've seen that with the GDPR.
00:27:29.440 --> 00:27:47.200
People are quite defensive, of course, and you know, they want to hide things and stuff, but I think the more you cooperate, the more the uh you know the authorities or the regulator sees that you're willing to cooperate and you're open to change, the less you know hard or or strict they're gonna be when it comes to finding you.
00:27:48.240 --> 00:27:49.519
Yeah, for sure.
00:27:49.759 --> 00:27:53.039
That I mean that that's evidence there anyway.
00:27:53.279 --> 00:28:12.160
Yeah, so we'll move on to question eight for yourself, Maria.
00:28:12.319 --> 00:28:18.640
So, what does Qatar's law say about cross-border transfers of personal data?
00:28:19.279 --> 00:28:20.000
Thanks, Katie.
00:28:20.240 --> 00:28:31.119
Well, this is interesting actually, because Qatar's approach to cross-border transfers under the PDPPL is unique compared to other international frameworks like the GPR.
00:28:31.519 --> 00:28:41.519
While most laws start by prohibiting trans transfers unless specific safeguards are met, Qatar's law begins with kind of a principle of openness.
00:28:41.680 --> 00:28:54.480
Um, under Article 15, the law establishes a general rule that a data controller should not take measures or adopt procedures that may curb transfer transborder data flows.
00:28:54.640 --> 00:28:57.039
So they're kind of almost encouraging it there.
00:28:57.279 --> 00:29:07.279
Um, this means that by default, the law supports the international exchange of data to facilitate global business and technological innovation.
00:29:07.519 --> 00:29:10.720
So that's a different kind of perspective that we see from the GDPR.
00:29:10.799 --> 00:29:14.480
The GDPR would be like take the individual's uh personal data.
00:29:14.640 --> 00:29:22.799
If you can't provide the same level of protection when transferring the data, then you're not allowed to transfer it at all.
00:29:23.039 --> 00:29:31.519
Whereas here it's saying, you know, business and innovation shouldn't be hindered by stopping the transfer of personal data internationally.
00:29:31.839 --> 00:29:34.480
Uh, this freedom, however, is not absolute.
00:29:34.640 --> 00:29:45.200
The controller or the regulator is empowered to restrict or block data or the transfer of data if the transfer would violate the provisions of the PDPPL.
00:29:45.680 --> 00:29:54.480
Or the processing of that data in the destination country is likely to cause gross damage to the individual or their personal data.
00:29:54.640 --> 00:29:57.119
So there are kind of restrictions on that.
00:29:57.359 --> 00:30:09.039
Um, while the law itself is permissive, the National Cybersecurity Agency has issued guidelines that clarify how organizations should handle these transfers in a professional setting.
00:30:09.279 --> 00:30:13.119
Um, again, they go back to kind of explicit consent.
00:30:13.279 --> 00:30:21.680
For many high-risk transfers, obtaining the individual's clear and explicit consent remains the safest gold standard kind of thing for compliance.
00:30:21.759 --> 00:30:34.079
So that's like they're pointing back to, you know, even though it is a permissive type of approach to transfers, you still have to get explicit consent from the individual who's dating the processing.
00:30:34.240 --> 00:30:37.279
Again, they kind of look at contractual safeguards.
00:30:37.440 --> 00:30:48.720
Um, in practice, the regulator expects kind of written contracts between the Qatari entity or the exporter of the data and the international recipient who would be the importer.
00:30:48.960 --> 00:30:56.160
These contracts must ensure that the recipient would provide a level of protection at least equivalent to the Qatar's law.
00:30:56.319 --> 00:31:01.599
And again, very similar there to the GDPR, their idea of adequacy.
00:31:02.400 --> 00:31:08.720
And as well, DPIAs or data protection impact assessments can be undertaken as well in such scenarios.
00:31:08.960 --> 00:31:20.400
Um, for a university or a tech company, the NCSA typically requires DPI a DPIA to be done before starting any kind of large-scale international transfer.
00:31:20.640 --> 00:31:34.799
You must document that you have analysed the risk, the risks of the destination country and implement mitigation measures, like for example, you know, um sending data encrypted when transferring and so on.
00:31:34.960 --> 00:31:45.119
So the law provides the government with the right to restrict transfers for specific reasons such as national security, international relations, or the economic interest of the state.
00:31:45.359 --> 00:31:54.400
In 2026, this often means that certain sovereign data related to citizens or critical infrastructure may be required to stay within Qatar's borders.
00:31:54.480 --> 00:32:05.519
And again, we're seeing that happen quite a lot across the globe, kind of data sovereignty, keeping it within your borders, um, just for safety, for national safety.
00:32:05.759 --> 00:32:13.440
Uh, and this is this is this isn't a practice that we've we've known to be called like data sovereignty or data localization.
00:32:14.160 --> 00:32:34.240
So, you know, it it looks like they're kind of on the same path as many countries in in across the globe in terms of protecting personal data, protecting the citizens' data, and protecting the national security uh by keeping the data within their own kind of uh borders.
00:32:35.440 --> 00:32:37.680
So question nine, Katie.
00:32:38.799 --> 00:32:44.000
How is sensitive personal data treated differently under the Qatar law?
00:32:45.039 --> 00:32:46.319
Thanks, Maria.
00:32:46.480 --> 00:32:52.880
So it sensitive personal data is treated more strictly under Qatar's law.
00:32:53.119 --> 00:33:09.680
It I know we've defined this in the past and previously, but I'm just gonna go over the definition again, which is data related to ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations, and criminal offenses.
00:33:10.000 --> 00:33:15.039
So you need to get the permission of the authority if you're gonna protest this data.
00:33:15.279 --> 00:33:26.559
To get the permission, they also need to have it paired with a purpose of processing, explicit consent or parental consent if it's a minor's data.
00:33:27.359 --> 00:33:40.240
And they can also uh two, sorry, two of the reasons under which they can process sensitive data is if the data has been manifestly made public or if it's for an employment obligation.
00:33:40.319 --> 00:33:47.519
So we've seen that again with the GDPR, but they also need to carry out a DPIA to assess the risks and mitigate them.
00:33:47.759 --> 00:34:00.079
And in most cases, organizations are going to need to obtain the explicit consent before processing this type of data, and they're always going to need to implement enhanced safeguards to prevent misuse or harm.
00:34:00.400 --> 00:34:13.360
So it really reflects the principle that sensitive data carries greater risk for individuals, and they'll need to put in stronger conditions on accountability when they're handling this kind of data.
00:34:13.679 --> 00:34:31.280
The guidelines uh from the Ministry of Communications, the guidelines on AI, which we'll talk about later, also mentioned that the definition of personal data with a special nature should be interpreted broadly.
00:34:31.599 --> 00:34:45.519
They mentioned that and explicitly, which is you know, it's good when they say, you know, this is a strict textual interpretation, or you want to you want to understand this in a broad sense.
00:34:45.679 --> 00:34:46.559
So yeah.
00:34:46.880 --> 00:34:49.119
Yeah, because it encompasses more basically.
00:34:49.280 --> 00:34:50.400
It protects more.
00:34:50.559 --> 00:34:51.199
Yeah.
00:34:52.320 --> 00:34:58.159
So yeah, I'll I'll move on to my next question for yourself, Maria.
00:34:58.559 --> 00:35:03.920
How does the law address online privacy, marketing, and children's data?
00:35:04.239 --> 00:35:20.880
So again, the PD PPL contains robust provisions specifically targeting online environments, the commercial use of data for marketing and the protection of children, which I really like, you know, um, who are afforded a heightened level of care under the law.
00:35:21.039 --> 00:35:30.800
And I I really like that idea that um children, because they're so vulnerable, we're seeing more and more how the online environment can damage children.
00:35:30.960 --> 00:35:35.679
So putting extra protections in place for children, I think, is a really good idea.
00:35:36.159 --> 00:35:42.880
The law is primarily designed for the digital age, applying to all personal data that is processed electronically.
00:35:43.039 --> 00:35:52.400
In 2026, the regulator or the NCS, the NCSA expects any organization with a digital presence to adhere to privacy by design.
00:35:52.800 --> 00:36:00.320
And we see that with the GDPR, we've seen that with a lot of other uh legislations that we've looked at in this series as well.
00:36:00.480 --> 00:36:18.400
And this means that websites and apps must have accessible privacy notices, clear, non-technical explanations of what data is being collected via cookies and tracking pixels and so on, and for what purpose the data is being collected.
00:36:18.639 --> 00:36:39.840
Um, technical mess mechanisms, technical mechanisms that allow users to exercise their rights, such as buttons to request data deletion or to withdraw consent directly through the interface, are also recommended, and that makes withdrawing consent much easier if you have those things in place already.
00:36:40.480 --> 00:36:52.559
With regard to direct marketing, Qatar takes a very firm stance against direct marketing by electronic channels like email and SMS and automated calls.
00:36:52.800 --> 00:37:03.519
Under Article 22, organizations are strictly prohibited from sending marketing materials unless they have obtained the individual's prior explicit consent.
00:37:03.760 --> 00:37:17.840
The opt-out requirement, every marketing communication must include the sender's identity and a clear, valid address or link that allows the recipient to opt out or stop future communications immediately.
00:37:17.920 --> 00:37:20.000
So that's very similar to the QPR.
00:37:20.159 --> 00:37:29.119
Thankfully, we're now seeing lots of emails where you can literally just decide, you know, the top of the email, you can unsubscribe, which makes it really easy.
00:37:29.440 --> 00:37:33.760
Um and as well, they they will not accept implied consent.
00:37:34.000 --> 00:37:47.519
Like, unlike some jurisdictions that allowed that allow soft opt-ins for uh existing customers, the Tatari regulator generally expects a high opt-in for any electronic marketing activity.
00:37:47.679 --> 00:37:50.239
So that's quite you know that's quite strict as well.
00:37:51.280 --> 00:37:59.840
Now, when it comes to children, children are specifically identified as special nature, special nature category, so special category data.
00:38:00.000 --> 00:38:07.679
This means that the law treats their data with the same level of sensitivity as health or religious information, which is great.
00:38:08.239 --> 00:38:11.360
So they require the guardian's consent.
00:38:11.679 --> 00:38:21.119
Any website or service targeting children must obtain the explicit consent of the child's parent or legal guardian before processing any of the child's data.
00:38:21.360 --> 00:38:29.360
Operators are expected to take reasonable steps to verify that the person providing consent is indeed the legal guardian.
00:38:29.599 --> 00:38:41.679
And upon a request, a website operator must provide a guardian with a full description of the data being processed, a reason for the processing, and a copy of the actual data collected about the child.
00:38:42.000 --> 00:38:43.519
So that is really good.
00:38:43.920 --> 00:38:50.719
You know, all the data that have been collected about their child can be provided to them upon request.
00:38:51.119 --> 00:38:52.079
You know, it's great.
00:38:52.960 --> 00:39:06.000
Um so yeah, like we're seeing more and more that like um this uh this data protection law, the PDPPL, has teeth, you know, it's it's you know, it takes the protection of data very seriously.
00:39:07.119 --> 00:39:13.039
So now, Katie, we're going to look at kind of more of the AI angle in terms of data protection.
00:39:13.440 --> 00:39:18.800
So, does Qatar currently have AI-specific legislation?
00:39:18.880 --> 00:39:24.079
And what does the PDPPL apply to in terms of AI systems?
00:39:24.559 --> 00:39:25.840
Uh thanks, Maria.
00:39:25.920 --> 00:39:28.800
So this is a somewhat interesting question.
00:39:28.880 --> 00:39:42.000
So, right now, when we're recording this, they don't have a standalone AI law like the EU AI Act, but they do have soft law for AI through the national AI strategy and the guidelines.
00:39:42.639 --> 00:39:50.239
And as usual, you know, the PDPPL is going to apply to AI to the extent that people are using personal data.
00:39:50.400 --> 00:40:08.320
So where AI models or AI developers are using personal data, they're still subject to transparency, data minimization, accuracy, storage limitation, purpose limitation, and accountability, you know, and I feel like that makes a significant positive impact.
00:40:09.280 --> 00:40:10.480
I totally agree.
00:40:11.199 --> 00:40:31.599
And then again, not just that, but in the absence of you know, hard law, the Ministry of Communications and Information Technology has released principles and guidelines for ethical development and deployment of AI, and likewise principles and guidelines for the ethical use of AI.
00:40:31.760 --> 00:40:40.079
So they're not statutes, but they're could the best practice for if you're doing if you're if you're developing or using AI in Qatar.
00:40:41.119 --> 00:40:44.559
So I find these quite interesting and nice.
00:40:44.719 --> 00:41:12.159
So the development and deployment principles are do no harm, ensure system robustness and security, reduce bias and avoid discrimination, protect the environment, safeguard privacy, promote transparency, develop a human-centered approach, and assign the ultimate accountability to humans.
00:41:13.039 --> 00:41:13.840
That's really good.
00:41:15.440 --> 00:41:24.159
It's nice to know they're similar to the EU AI act principles as well, you know, just with the AI and so on.
00:41:25.119 --> 00:41:26.000
That's really good.
00:41:30.159 --> 00:41:33.679
But they also have principles for use of these systems.
00:41:34.719 --> 00:41:40.719
For anyone who's using them, it's kind of targeted to even mention students, you know, like you know, students.
00:41:40.880 --> 00:41:48.480
There's a big debate about whether students in college should be using AI, and I suppose the ultimate answer is you can't stop them, so you may as well give them guidelines.
00:41:48.880 --> 00:41:50.480
Absolutely totally great.
00:41:51.039 --> 00:42:05.199
So the principles for the use of AI is minimize bias and promote fairness, safeguard personal and organizational data, understand the AI's capabilities and limitations.
00:42:06.960 --> 00:42:25.280
Um, assume accountability, and this one it's entitled Assume Accountability, but it's explained as you need to gain an understanding and practice informed decision making and consider the ethical implications when you're using this technology.
00:42:26.159 --> 00:42:28.320
And there's two more principles.
00:42:28.480 --> 00:42:34.639
So the last two are comply with relevant laws and ensure the well-being of individuals and society.
00:42:35.360 --> 00:42:36.320
I like those.
00:42:36.559 --> 00:42:46.079
Especially, I like the idea of assuming accountability because like you really have to assume accountability when you're using AI.
00:42:46.320 --> 00:42:52.239
You can ask AI a question and you can take it as verbatim, there is a response.
00:42:52.559 --> 00:42:59.039
But like if it comes out as garbage, then you're responsible for that garbage if you proliferate that garbage.
00:42:59.119 --> 00:42:59.840
Do you know what I mean?
00:42:59.920 --> 00:43:10.800
So you have to really kind of take ownership of what you're ready to get behind when it comes to responses from things like ChatGPT and so on.
00:43:11.199 --> 00:43:17.599
So I really like that idea of assume accountability because at the end of the day, you can't blame an AI system.
00:43:18.000 --> 00:43:22.000
You know, you have to blame yourself for the leading AI system.
00:43:23.039 --> 00:43:27.039
I I personally really like to understand its limitations.
00:43:27.360 --> 00:43:27.599
Yeah.
00:43:27.840 --> 00:43:31.440
You know, I think that's a crucial, like they're all very good.
00:43:31.519 --> 00:43:33.039
Like, I I yeah.
00:43:33.440 --> 00:43:34.880
They're very well thought out, I think.
00:43:34.960 --> 00:43:35.360
Yeah.
00:43:35.519 --> 00:43:36.000
Yeah.
00:43:36.320 --> 00:43:36.960
Yeah.
00:43:37.360 --> 00:43:42.400
And because that leads that that kind of blends with assume accountability.
00:43:42.559 --> 00:43:47.119
So understand its limitations, they kind of go hand in hand together, you know.
00:43:47.360 --> 00:43:56.000
So if you if you understand their limitations, then you know you have to be ready to assume accountability, you know, if you're gonna use it.
00:43:56.960 --> 00:43:59.519
Um I think you like to hear this too then.
00:44:00.320 --> 00:44:16.960
On assume accountability and four use of our International Court and Dispute Resolution Center, which you've got a direction on practice guidelines for the use of artificial intelligence and court proceedings.
00:44:17.119 --> 00:44:32.639
And the reason why they did this was down from the judgment on uh related to the Qatar Financial Center Court where somebody referenced court law that did not exist.
00:44:36.719 --> 00:44:46.159
But this is beyond a mere research or on its it's uh you know, it's merely professional, it's it's professional negligence, you know.
00:44:48.559 --> 00:45:01.440
Um and the lawyer was found to be in contempt of court for first of argument that was based on AI that's hallucination, basically.
00:45:01.679 --> 00:45:03.599
Yeah, the hallucination, yeah.
00:45:03.920 --> 00:45:06.480
So these guys are on it.
00:45:07.280 --> 00:45:24.639
Yeah, it's funny as well because I was just on LinkedIn today as well, and I saw a friend, a post from a friend who said that the Pope has actually uh come out and said and asked priests not to use AI when creating sermons, would you believe?
00:45:25.199 --> 00:45:26.239
That's mental.
00:45:26.480 --> 00:45:28.000
Yeah, really interesting.
00:45:28.079 --> 00:45:30.239
So everybody's using AI now.
00:45:30.800 --> 00:45:32.719
Yeah, even the priests.
00:45:33.440 --> 00:45:40.000
So yeah, maybe these guidelines I like, I like the use guidelines they can apply, you know.
00:45:40.320 --> 00:45:40.800
Absolutely.
00:45:41.199 --> 00:45:44.400
If you take them into account and you really consider them, yeah, yeah.
00:45:45.519 --> 00:45:49.599
So we'll we'll move on to our final question here for yourself, Maria.
00:45:49.920 --> 00:45:57.760
Looking ahead, do you expect Qatar's privacy framework to evolve in response to AI and global trends?
00:45:58.320 --> 00:45:59.039
Thanks, Katie.
00:45:59.280 --> 00:46:04.320
Well, this is the last question, and my answer to that is I think it has to.
00:46:04.719 --> 00:46:11.599
You know, like every every country, we have to accept AI is going to be in our future.
00:46:11.920 --> 00:46:36.639
Qatar's privacy framework is expected to undergo a significant shift from passive compliance to proactive AI governance, and we're seeing that all over the place lately, where you know, we have the the GDPR era was you know quite passive compliance, writing documents, writing policies, demonstrating that you've done, you know, you've looked into things and you have documentation to show.
00:46:36.880 --> 00:46:44.000
Whereas now with the AI, um in the AI era, evidence is key to compliance.
00:46:44.159 --> 00:46:51.840
You can no longer just write a policy, you really have to show uh the auditors that you're actually doing what you say you're doing.
00:46:52.079 --> 00:46:55.679
So, like they said in Qatar, proactive AI governance.
00:46:56.000 --> 00:47:00.079
So the PDPPL remains the core statute.
00:47:00.639 --> 00:47:15.599
Uh, there are several clear trends that indicate how the framework is evolving to keep pace with global movements like the EU AI Act and the surge in agentic AI, which is like everybody's talking about agentic AI at the moment.
00:47:15.840 --> 00:47:27.039
For the past few years, Qatar has relied on soft law, as you have mentioned, Katie, in the form of ethical AI guidelines issued by the Ministry of Communication and Information Technology.
00:47:27.199 --> 00:47:34.239
However, as of early 2026, there is a clear move towards making these principles legally binding.
00:47:34.480 --> 00:47:51.840
Experts expect an amendment to the PDPPL or a new executive decree that formally mandates algorithmic auditing and bias assessments for high-risk AI systems used in public services, healthcare, and finance.
00:47:52.079 --> 00:48:02.320
This would move Qatar from simply suggesting ethical AI to requiring it, with the National Cybersecurity Agency acting as a primary enforcer.
00:48:02.800 --> 00:48:18.239
In 2026, Qatar is doubling down on data localization that we referenced earlier about data sovereignty and making sure that certain types of personal data and sensitive data stay within the borders of Qatar.
00:48:18.639 --> 00:48:36.880
As the country builds out its own infrastructure, like the recently expanded Oracle and Asia Cloud region in Doha, the government is increasingly requiring that sensitive data about Qatari citizens and critical national infrastructure stays within the country's borders.
00:48:37.119 --> 00:48:51.760
This mirrors global trends in sovereign clouds, where nations want to ensure that AI models are trained on local data that never leaves their jurisdiction, protecting against foreign surveillance and ensuring cultural alignment.
00:48:52.079 --> 00:48:55.039
We are seeing a trend of regional convergence.
00:48:55.199 --> 00:49:09.039
Countries like Saudi Arabia and Oman have recently updated their laws to be even more GDPR compliant or GDPR-like, sorry, introducing mandatory data protection officers and stricter portability rights.
00:49:09.360 --> 00:49:21.360
Qatar is likely to update its 2016 law to include missing modern rights like data portability and a more explicit right to contest automated decision making.
00:49:22.079 --> 00:49:33.519
This would ensure that Qatar remains a GDPR-aligned pioneer in the region, facilitating smoother trade and data flows between Europe and Qatar.
00:49:33.920 --> 00:49:38.480
The regulator is now moving beyond just policies on paper.
00:49:38.639 --> 00:49:43.920
The NCSA's 2026 agenda places a massive emphasis on technical enforcement.
00:49:44.159 --> 00:49:52.159
Organizations will soon be expected to prove that they are using synthetic data or differential privacy when training AI models.
00:49:52.400 --> 00:50:05.039
I think that's that's kind of where it's going in terms of data protection and AI, then again, very closely aligned with AI compliance, as we're seeing with the GDPR as well.
00:50:05.360 --> 00:50:21.519
So the kind of the data protection law would be fundamental and it would, you know, any kind of laws that you would see coming in in terms of AI would have to kind of sit on top of that data protection law, again, similar to Europe.
00:50:23.119 --> 00:50:26.719
So that kind of concludes our podcast for today.
00:50:26.880 --> 00:50:28.639
I think we've been quite efficient.
00:50:28.800 --> 00:50:33.039
Uh, usually we take an hour, but we we definitely are within the hour this time.
00:50:33.519 --> 00:50:41.440
So this is the end of today's episode on Qatar's personal data privacy objection law, law number 13 of 2016.
00:50:41.679 --> 00:50:53.519
Katie and I have explored the foundations of Qatar's national privacy regime, the rights and uh the rights it provides, how it may increasingly intersect with AI governance as technology evolves.
00:50:53.760 --> 00:50:58.239
But again, there's a lot more to be learned, a lot more to understand about the law.
00:50:58.400 --> 00:51:02.480
So I would encourage you all to go and read the law and interpret the law.
00:51:02.719 --> 00:51:08.559
Um so thanks for listening, and um until next time.
00:51:09.199 --> 00:51:10.400
Thanks everyone.
00:51:10.639 --> 00:51:11.599
Take care.
00:00:21.359 --> 00:00:31.440
Hello and welcome back to the International Data Protection Regulation Podcast, where we explore privacy laws around the world and how they shape our digital lives.
00:00:31.600 --> 00:00:32.159
I'm Dr.
00:00:32.240 --> 00:00:37.679
Maria Maloney, and today I'm joined again by my wonderful co-host, Katie Birch.
00:00:38.159 --> 00:00:39.039
Thanks, Maria.
00:00:39.200 --> 00:00:41.679
Hi everyone, it's great to be back.
00:00:42.399 --> 00:00:44.880
In today's episode, we're focusing on Qatar.
00:00:45.200 --> 00:00:54.079
I hope I said that right, a jurisdiction that was one of the first in the Gulf region to introduce a comprehensive national data protection law.
00:00:54.320 --> 00:00:56.719
The law, which is called Law No.
00:00:56.960 --> 00:01:11.359
13 of 2016, concerning personal data privacy protection, reflects many global privacy principles while also responding to Qatar's own governance and cybersecurity context.
00:01:11.599 --> 00:01:26.799
Together, Katie and I will walk through how Qatar defines personal data, what rights individuals have, what obligations fall on organizations, and how these rules may indirectly shape emerging AI systems.
00:01:27.359 --> 00:01:29.280
So I'll get straight to the point.
00:01:29.439 --> 00:01:31.280
The first question goes to you, Katie.
00:01:31.680 --> 00:01:37.920
To start us off, what is the core data protection legislation in Qatar and when was it introduced?
00:01:38.319 --> 00:01:39.439
Thank you, Maria.
00:01:39.760 --> 00:01:49.599
So the primary legislation in Qatar is, as you said, law number 13 of 2016 concerning personal data privacy protection.
00:01:49.760 --> 00:01:52.640
It's often abbreviated to the PDPPL.
00:01:52.959 --> 00:02:05.359
It was issued on the 3rd of November 2016, and Qatar was actually the first nation within the Gulf Cooperation Council to implement a dedicated national privacy law.
00:02:05.599 --> 00:02:17.840
The law established a comprehensive framework for the protection of individuals' privacy rights by regulating how personal data is collected, processed, and stored by individuals and organizations.
00:02:18.719 --> 00:02:21.919
It has strict requirements for data controllers.
00:02:22.240 --> 00:02:26.000
They have to process data fairly and transparently.
00:02:26.319 --> 00:02:32.560
They have specific protections for special category data, which we'll go to later.
00:02:33.360 --> 00:02:45.520
They have their authority, the NCSA, and they have also given out a lot of guidelines to kind of help companies with the practical implementation of it, which is quite good.
00:02:59.919 --> 00:03:04.879
Additionally they have touched into AI a little bit, which I suppose we'll talk about later too.
00:03:04.960 --> 00:03:16.719
But in 2021, the Ministry of Communications and Information Technology released some regulatory guidelines about the use of AI and the development of AI.
00:03:16.960 --> 00:03:21.039
Yeah, that's just the general outlook on what it looks like.
00:03:21.120 --> 00:03:21.840
So I'll move on.
00:03:22.800 --> 00:03:23.120
Yeah.
00:03:23.680 --> 00:03:25.599
They seem fairly advanced, like you say.
00:03:25.680 --> 00:03:36.719
They were in 2020 sixteen, even before the GDPR, they have their national data protection law um you know uh rolled out across the country, which is which is good.
00:03:37.039 --> 00:03:40.879
Yeah, I would agree they're quite on on top of things there.
00:03:41.599 --> 00:03:51.520
So my question for yourself, Maria, will be How does Qatar's law define personal data and does it include sensitive categories?
00:03:52.080 --> 00:03:52.800
Thanks, Katie.
00:03:53.039 --> 00:04:03.439
So in Qatar, the law defines personal data as any information relating to a natural person whose identity is clearly identified or can be reasonably identified.
00:04:03.520 --> 00:04:08.639
And I think what they mean by that is kind of can be inferred from information by putting information together.
00:04:08.879 --> 00:04:30.959
This identification can occur either directly through data itself, uh such as your name or your like an ID that you have, your national ID number, your passport, or like I said, by combining information with any other details or data points that could then, when they're combined, uh kind of identify you as who you are.
00:04:31.199 --> 00:04:44.240
The legislation does include a specific, more rigorous category known as personal data of a special nature, and that would be Qatar's equivalent of what we call special category data or sensitive data.
00:04:44.480 --> 00:04:54.560
And this includes categories such as ethnic origin, interestingly, children's data, physical or mental health information, and religious creeds.
00:04:55.040 --> 00:05:08.399
Another interesting thing is that it can also extend to include your marital status or your marital relations, like for example, if you got married, that that would then become personal data of a special nature.
00:05:08.480 --> 00:05:15.680
And as well, if you you know if you obtained a criminal record, that would also be you know contained within that category.
00:05:16.240 --> 00:05:29.199
Because then the reason why they have this category, as just like in the GDPR, is because the misuse of this special nature of data is considered in Qatar more likely to cause serious damage to an individual.
00:05:29.360 --> 00:05:33.360
It cannot be processed as freely as the standard personal data.
00:05:33.519 --> 00:05:47.199
And under Article 16 of the law, any organization wishing to process this, these kind of sensitive categories must first obtain explicit permission from the National Cybersecurity Agency or the NCSA.
00:05:48.000 --> 00:05:59.519
Um and once permission is received, organizations or what we call you know data controllers, which is also the same term that is in the GDPR, must implement additional safeguards for this type of data.
00:05:59.680 --> 00:06:06.000
So this type of data is considered special, you know, as it needs special treatment under the law.
00:06:06.160 --> 00:06:19.439
This makes Qatar's approach particularly strict as it shifts from like what we have in the GPR self-compliance almost to a more like permit-based model for sensitive data.
00:06:19.839 --> 00:06:35.680
The Minister of Transport and Communication may also um they they reserve the right to add other types of data to this category if it is deemed that the misuse of this type of data would cause serious damage to the individual.
00:06:35.839 --> 00:06:42.639
So um it's the Minister of Transport and Communication that can expand that category, you know, in the future.
00:06:43.360 --> 00:06:49.519
So, yeah, so I mean they take personal data and special category data very seriously.
00:06:49.680 --> 00:07:03.920
And we we see as well with the NCSA, the National Cybersecurity Agency, that you know, you actually have if you want to process personal uh special category data or what we call under the GPR special category data, you actually have to get permission to process that data.
00:07:04.079 --> 00:07:05.120
So that's interesting.
00:07:06.000 --> 00:07:06.720
That is different.
00:07:07.120 --> 00:07:08.000
Yeah, it's different.
00:07:08.160 --> 00:07:08.560
Yeah.
00:07:09.680 --> 00:07:17.439
So moving on, Katie, to question three what lawful basis does Qatar rely on for personal processing personal data?
00:07:17.680 --> 00:07:23.759
Is it consent central like we saw with uh various other legislation in the Gulf region?
00:07:24.160 --> 00:07:26.079
Or is it similar to the GDPR?
00:07:26.399 --> 00:07:27.360
Thanks, Maria.
00:07:28.319 --> 00:07:29.839
It is consent central.
00:07:29.920 --> 00:07:30.879
I would say yes.
00:07:31.120 --> 00:07:36.399
It consent seems to be the core, the core of lawful processing.
00:07:36.639 --> 00:07:50.480
Article 4 of the PDPPL says that the controller shall process personal data only after obtaining the consent of the individual, unless there is a certain lawful purpose.
00:07:50.879 --> 00:07:54.399
Individuals have the right to withdraw their consent at any time.
00:07:54.720 --> 00:08:03.680
And I mean, as per usual, the process for withdrawing consent needs to be as easy as the process of doing it, so that's quite good.
00:08:04.319 --> 00:08:17.360
But so I'm just gonna go back to those lawful purposes because the other these are more exceptions to consent, so situations where you can process data without consent.
00:08:17.680 --> 00:08:20.800
Um, and they're set out in chapter five of the act.
00:08:20.959 --> 00:08:22.480
I'm just gonna go through them here.
00:08:22.560 --> 00:08:30.480
So we have legal obligations where they're required by Qatari laws or court order to process data.
00:08:30.800 --> 00:08:49.279
I also just want to mention here that I feel I'm not sure if contractual necessity would come under legal obligation because they haven't explicitly listed contract as a reason in the same way GDPR has.
00:08:50.240 --> 00:08:58.399
So I assume to the extent that a contract is legally enforceable, it would come under this lawful purpose.
00:08:58.799 --> 00:09:18.320
They have public interest where processing is necessary for a task carried out in the public interest, or vital interest, or as usual, they have where processing serves a legitimate business purpose, they have scientific research carried out in the public interest and investigating a crime.
00:09:18.960 --> 00:09:29.440
And as you just touched on, they do have structural require requirements for the law for processing sensitive data lawfully, and the bar is much higher.
00:09:29.759 --> 00:09:36.080
For these categories, having a lawful basis like legitimate interest is not enough.
00:09:36.320 --> 00:09:44.000
They do need the explicit permission of the National Cybersecurity Agency, and they do need explicit consent.
00:09:44.799 --> 00:09:57.519
Okay, and we saw as well there that um you know that sensitive or uh the data, personal data of a of a sensitive nature with it, that extends to uh your criminal record.
00:09:57.759 --> 00:10:04.720
So, yeah, so you would have to get permission uh from the from the National Cybersecurity Agency to process that data.
00:10:04.879 --> 00:10:10.399
But like you say, it is very much consent-driven as opposed to the GDPR.
00:10:10.480 --> 00:10:10.799
Yeah.
00:10:11.200 --> 00:10:14.080
It is consent at the forefront for sure.
00:10:14.399 --> 00:10:15.039
Yeah.
00:10:15.440 --> 00:10:19.600
Um so go on to question four for yourself.
00:10:19.840 --> 00:10:22.000
And it's about the data subject rights.
00:10:22.159 --> 00:10:27.919
So, what rights does the law provide to the individual and how do they compare to the GDPR?
00:10:28.320 --> 00:11:01.519
Well, again, I think if you know the data subject rights in the GDPR, you will be, you know, I think you'll feel quite comfortable with the data subject rights in uh uh Qatar's law number 13, um, because it grants individuals a specific set of rights, uh, it and it has the same philosophy as the GDPR, you know, kind of fundamentally protection of individuals' fundamental rights, like in the GDPR, uh, although the scope um in Qatar is somewhat narrower and more focused on the core principles of transparency and control.
00:11:02.320 --> 00:11:07.679
The law explicitly provides individuals with the following rights regarding their personal information.
00:11:07.840 --> 00:11:13.759
So you have what we call the right to withdraw consent, and that's again similar to what we see in the GDPR.
00:11:14.080 --> 00:11:29.519
You have the right to object to processing if you think that the processing is outside the original purpose for which you gave your data, or it has become excessive, or it's been used in a discriminatory or illegal way.
00:11:30.159 --> 00:11:46.240
Um, you also have the right to erasure, which is Qatar's version of the right to be forgotten, allowing individuals to request the deletion of their data once the purpose for the processing has ended, or if the if the data can be proven to be collected unfairly.
00:11:46.480 --> 00:12:01.679
Uh, it also has you know a right to access and review, so the individual can uh view their data, their store data, and verify that it's accurate and update that, you know, if again, so the next right would be the right correction.
00:12:01.840 --> 00:12:08.320
So if you review your data and you see that it's inaccurate, you actually have the right to update that data as well.
00:12:08.480 --> 00:12:10.879
So, again, very similar to the GDPR.
00:12:11.200 --> 00:12:13.039
You have the right to be notified as well.
00:12:13.120 --> 00:12:22.960
So the individuals must be informed of the processing activities, the purposes behind them, and any instances where their inaccurate data has been disclosed to third parties.
00:12:23.120 --> 00:12:23.440
Okay.
00:12:24.080 --> 00:12:33.759
Um, so overall, like again, you'd be comfortable coming from the GDPR and going to the Qatari set of data subject rights.
00:12:33.919 --> 00:12:48.720
In terms of the right to portability, there's no it's not explicitly mentioned in the 2016 law in Qatar, but they don't really provide uh kind of protection for automated decision making either, like they do in the GDPR.
00:12:49.200 --> 00:12:58.480
And as well, it's kind of generally understood that the response time is 30 days, whereas it's more specific explicit in the in the GDPR.
00:12:59.039 --> 00:13:06.159
And of course, like we said, you know, personal sensitive category data is needs it needs a uh a permit.
00:13:06.240 --> 00:13:10.879
So they're the kind of the differences between the GDPR and um and Qatar.
00:13:11.440 --> 00:13:13.440
But again, you know, very similar.
00:13:13.759 --> 00:13:16.720
So moving on then to question five, Katie.
00:13:17.200 --> 00:13:22.159
What are the main organizational obligations under the PBPPL?
00:13:23.360 --> 00:13:24.639
Thanks, Maria.
00:13:24.960 --> 00:13:37.279
So organizations who are as per usual uh or as normal anyways, referred to as controllers, are bound by a set of strict operational and technical obligations.
00:13:37.759 --> 00:13:43.840
They're designed to shift the burden of protection from individuals to the controller themselves.
00:13:45.279 --> 00:13:53.919
So there's a few specific conditions directly from the act, and then there's a few kind of expansions that are found within the guidelines.
00:13:55.039 --> 00:14:16.559
So what we find in the act is they need to review privacy protection measures before entering new processing operations, which I suppose is expanded on in the guidelines, which talks about the need for DPIOs before starting any processing activity.
00:14:16.799 --> 00:14:22.000
They have a couple of guidelines about you know how to assess that risk and how to carry it out.
00:14:22.320 --> 00:14:29.120
But when they engage protesters, they need to make sure that they're going to be responsible for their data protection obligations.
00:14:29.360 --> 00:14:31.279
So again, we've seen that.
00:14:32.960 --> 00:14:37.600
So they're also responsible for training and raising awareness on data protection.
00:14:37.840 --> 00:14:43.919
They need to develop their internal systems to receive and investigate complaints and any rights requests.
00:14:45.200 --> 00:14:49.279
They need to develop internal systems for management of personal data.
00:14:49.519 --> 00:14:55.919
So they basically need a formal framework to manage the data lifecycles and document compliance.
00:14:56.720 --> 00:15:03.600
There's no explicit requirement for a DPO, it's more of a may, but it's still recommended.
00:15:03.679 --> 00:15:08.559
I mean, to to coordinate and carry out all of these requirements at the end of the day.
00:15:08.879 --> 00:15:15.120
They need to use their appropriate technologies to enable individuals to exercise their rights.
00:15:16.480 --> 00:15:22.559
So that just reminds me of like the web forms and stuff.
00:15:23.360 --> 00:15:26.080
But we would have in privacy engines, yeah.
00:15:26.879 --> 00:15:34.240
So facilitating, facilitating data subjects, you know, having ability to access their rights or request information.
00:15:34.639 --> 00:15:34.960
Yeah.
00:15:36.159 --> 00:15:48.879
And they also need to conduct audit, ongoing audits and reviews of their compliance with the requirements, and need to verify protesters' compliance, taking appropriate precautions to protect personal data.
00:15:48.960 --> 00:15:54.240
So I mean, a data sharing agreement wouldn't be out of the question there.
00:15:54.320 --> 00:15:56.960
Like, you know, some of the things don't explicitly say it.
00:15:57.039 --> 00:16:10.559
As I said, the guidelines go a lot more into it, but you know, it's a mat it's a kind of a question of it'll make your life easier to abide by those requirements.
00:16:10.960 --> 00:16:11.519
Absolutely.
00:16:11.600 --> 00:16:27.440
So it's kind of a standard approach that we see, you know, we've seen with the GDPR kind of you know, assessments of of third parties, vendors, uh, making sure you have a contract in place to ensure that you are protected if there's a breach that happens with the processor and so on.
00:16:27.600 --> 00:16:27.840
Yeah.
00:16:28.159 --> 00:16:29.360
Yeah, for sure.
00:16:29.919 --> 00:16:37.840
So they also have their notifications obligations, their transparency obligations, which we know quite well.
00:16:38.000 --> 00:16:43.919
Um so they all would align quite similarly to the GDPR, basically.
00:16:45.279 --> 00:16:45.840
Yeah.
00:16:46.159 --> 00:16:52.240
They also have their principles um like of data minimization and accuracy.
00:16:52.720 --> 00:16:57.440
They have their bridge reporting, but we're going to talk about that a bit a bit more later.
00:16:57.600 --> 00:17:11.519
But yeah, so a lot of it is GDPR related, and you don't need a DPO, but I mean it's easier to be compliant with one, especially if you're handling handling a lot of data.
00:17:11.839 --> 00:17:16.079
So we'll move on now to kind of what I was touching on there at the end of that.
00:17:16.240 --> 00:17:24.799
But um, Maria, could you tell us a bit about their breach notification requirements and what is expected in practice?
00:17:25.279 --> 00:17:26.240
Absolutely, yeah.
00:17:26.319 --> 00:17:32.480
So um in Qatar, the PDPPL explicitly requires breach notification.
00:17:32.720 --> 00:17:40.559
And as of 2026, the regulatory expectations are strictly enforced by the NCSA or the National Cybersecurity Agency.
00:17:40.640 --> 00:17:51.119
So we've seen guidelines as well in 2026 and uh you know uh in in the recent past that makes it makes things more specific about the law.
00:17:51.440 --> 00:18:00.079
So unlike some jurisdictions where every minor leak must be reported, so we've seen that more and more with a GDPR.
00:18:00.240 --> 00:18:04.720
It seems like we you know you always have to report uh breaches with the GDPR.
00:18:04.880 --> 00:18:19.599
Qatar's law and more specifically Article 14 of the law triggers the notification requirement only if the breach is likely to cause what they call serious damage to the personal data or the privacy of the individuals.
00:18:19.839 --> 00:18:32.400
So how they interpret serious damage or how the regulators interpret serious damage usually means either something like identity theft or fraudulent use of personal data in some way.
00:18:32.799 --> 00:18:44.799
Uh, finance the potential of financial loss, financial loss for the individuals, or if there was unauthorized access to bank accounts of the individual and so on, that would be seen as serious damage.
00:18:45.119 --> 00:18:53.119
Physical or psychological harm as well, um, particularly involving sensitive data like health or children's data.
00:18:53.279 --> 00:19:11.440
And again, we saw that in the uh the Kingdom of Saudi Arabia's law, do you remember um particular sensitive, you know, quite protective of the individual, you know, would be considered quite, you know, psychological harm would be considered serious damage to the individual.
00:19:11.680 --> 00:19:22.160
And as well, reputational damage would be, you know, a sign where if there's a significant loss of privacy, that would be seen as serious damage as well.
00:19:22.319 --> 00:19:27.119
So that's quite interesting, the interpretation of what they see as serious damage.
00:19:27.200 --> 00:19:37.759
And we've seen that quite a lot in the in the Gulf region, where you know the culture kind of impacts the you know how they interpret the law, which is which is an interesting thing.
00:19:38.000 --> 00:20:00.480
Um, in terms of the the like the 70 72-hour rule that we see in the GDPR, the original law back in 2016 was somewhat vague on timing, but supplement, like I said, supplemental guidelines issued by the regulator have introduced a clear 72-hour window after 2020 uh 2016.
00:20:00.880 --> 00:20:10.079
So the organization must notify the NCSA or the National Cybersecurity Agency within 72 hours of becoming aware of the breach.
00:20:10.559 --> 00:20:18.640
And it must notify affected individuals within 72 hours as well if the serious damage threshold is met.
00:20:19.200 --> 00:20:27.279
And this ensures that individuals can take immediate steps, such as changing passwords or freezing credit cards and so on, to protect themselves.
00:20:27.519 --> 00:20:38.000
So, in practice, the Guitari Qatari regulator expects a high level of accountability and proactivity when it comes to breach reporting.
00:20:38.160 --> 00:20:40.400
They expect kind of internal management.
00:20:40.480 --> 00:20:50.480
So organizations are expected to have an internal personal data management system, as you mentioned previously, Katie, that can detect and try out breaches very quickly.
00:20:50.640 --> 00:20:58.400
If an organization cannot prove that they have the tools to detect a breach, they can be fined, even if they eventually report it.
00:20:58.480 --> 00:21:04.240
Like if they if their processes are seen to be inadequate, then they can be fined.
00:21:04.480 --> 00:21:17.440
Transparency is also a very big thing when notifying individuals, the organization must use clear, non-technical language to explain what happened, what data was lost, and what steps the individual should take to protect themselves.
00:21:17.599 --> 00:21:26.880
If the breach happens with the processor or a third party, they are legally required to notify the main organization or what they call the data controller immediately.
00:21:27.039 --> 00:21:32.640
So, you know, the things can be put in place to protect the individual and to notify the regulator.
00:21:33.200 --> 00:21:40.960
So, in terms of penalties, the expectation for reporting is backed up by significant financial deterrence.
00:21:41.119 --> 00:21:53.839
Uh failure to report a breach causes serious that can cause serious damage to individuals, can result in a fine of up to a million Qatari real, which is about$275,000.
00:21:54.480 --> 00:22:06.319
So and if the breach happened because the company failed to put appropriate Precautions in place, that fine can actually rise up to five million Qatar in Ryan.
00:22:06.799 --> 00:22:09.279
You know, so that's a significant increase.
00:22:09.440 --> 00:22:11.599
You know, that's over a million dollars as well.
00:22:12.480 --> 00:22:16.000
So yeah, they they take breach very seriously.
00:22:16.480 --> 00:22:23.839
And overall, I think from looking at everything that we've looked at so far, we can say that Qatar takes data protection quite seriously as well.
00:22:26.559 --> 00:22:29.200
Moving on with it for question seven, Katie.
00:22:29.680 --> 00:22:38.240
And we're moving through these quite quickly this week because I think we're getting good at we're getting more experienced at questions and answers.
00:22:38.480 --> 00:22:43.680
Um who enforces Qatar's national data protection law and what penalties exist?
00:22:43.839 --> 00:22:48.160
So again, I've touched on that in the previous question, but let's look into it in more detail now.
00:22:49.119 --> 00:22:51.200
Yeah, um thanks, Maria.
00:22:51.359 --> 00:23:10.079
So as we said, they have kind of the overseeing authority, the National Cybersecurity Agency, but they also have a national data protection office within the cybersecurity agency that's focused on data protection specifically.
00:23:10.799 --> 00:23:30.880
So the agency itself has the power to conduct investigations, audits, and give orders, but the office give uh you know decisions, more so to say they give decisions on the uh on the organizations, you know, following the investigations and stuff.
00:23:31.119 --> 00:23:40.480
So the the PD PPL uh carries some of the steepest financial penalties in the region.
00:23:40.960 --> 00:24:00.559
Um you had failure to report a breach, which uh you already mentioned, but uh a fine for lack of proper safeguards could be up to five million uh Hictorian Reales, which is one million three hundred and seventy thousand dollar equival equivalent.
00:24:00.960 --> 00:24:01.519
Wow.
00:24:02.079 --> 00:24:02.720
Yeah.
00:24:03.359 --> 00:24:15.759
So it's significant, and also the reputational damage of you know having a fine and and a decision made against you because you you didn't have technical measures in place, you know.
00:24:15.920 --> 00:24:21.920
I feel like sometimes the reputational damage can be worse, especially for big companies.
00:24:22.319 --> 00:24:24.079
I agree, yeah, yeah.
00:24:24.559 --> 00:24:28.960
So yeah, they also it's interesting there as well.
00:24:29.039 --> 00:24:37.200
So processing sensitive data without a permit can bring can get you the same kind of uh time over a million dollars.
00:24:37.440 --> 00:24:38.400
That's interesting.
00:24:39.599 --> 00:24:46.319
It is, yeah, especially like like I don't know what the process of going through that would be, you know.
00:24:46.480 --> 00:24:57.119
Like I wonder how much leeway companies who were already processing sensitive data had between the introduction of the act and the permit process.
00:24:58.240 --> 00:24:59.680
Yeah, that's true, yeah.
00:25:00.400 --> 00:25:00.960
I don't know.
00:25:01.200 --> 00:25:03.359
But especially in the medical industry, you know.
00:25:03.599 --> 00:25:04.720
Yeah, yeah.
00:25:06.000 --> 00:25:12.079
Um, even religious organizations for marriages and stuff, prisons, you know, there's loads.
00:25:12.480 --> 00:25:20.880
So I'll just touch touch on uh an enforcement decision uh as we did last week.
00:25:21.039 --> 00:25:22.559
We found that quite helpful.
00:25:24.079 --> 00:25:25.039
Oh yeah, that's true.
00:25:25.119 --> 00:25:25.359
Yeah.
00:25:26.480 --> 00:25:38.960
So they don't seem to give the names of the company uh involved whenever they publish enforcement decisions, which is interesting, like kind of choice and transparency.
00:25:40.000 --> 00:25:59.759
But so basically the NDPO issued a ruling uh for a company in the ICT sector around its compliance program, which was prompted by an investigation following a formal complaint submitted by a data subject related to a request.
00:26:01.920 --> 00:26:04.720
So we've seen that that's kind of a pattern, you know.
00:26:04.880 --> 00:26:28.480
One one request that wasn't fulfilled to a satisfactory nature has led to investigations in two jurisdictions so far that we've seen that then highlighted bigger deficiencies in their privacy programs, and they got decisions from the authority saying this is not adequate.
00:26:28.960 --> 00:26:34.240
Um so I find more about their privacy programs than it was about the data subject access request.
00:26:34.480 --> 00:26:34.640
Yeah.
00:26:34.880 --> 00:26:35.200
Yeah.
00:26:35.519 --> 00:26:36.319
Exactly.
00:26:36.640 --> 00:26:53.200
In this case, for the ND NDPO decision, the company apparently, well, according to the the source, their their level of cooperation with the authority helped their case.
00:26:53.279 --> 00:27:00.640
That was apparently a note, a note that they commented on that they had they were quite forthcoming and you know cooperative.
00:27:01.279 --> 00:27:23.920
So that's another point to remember, I think, that like even though there is those fines, that once the authority is kind of at your doorstep to cooperate them and be transparent with them rather than kind of developing a defensive mentality around God, I'm gonna get a fine, you know.
00:27:24.240 --> 00:27:27.039
Yeah, and I think I think that's an a natural response as well.
00:27:27.200 --> 00:27:29.119
And you know, we've seen that with the GDPR.
00:27:29.440 --> 00:27:47.200
People are quite defensive, of course, and you know, they want to hide things and stuff, but I think the more you cooperate, the more the uh you know the authorities or the regulator sees that you're willing to cooperate and you're open to change, the less you know hard or or strict they're gonna be when it comes to finding you.
00:27:48.240 --> 00:27:49.519
Yeah, for sure.
00:27:49.759 --> 00:27:53.039
That I mean that that's evidence there anyway.
00:27:53.279 --> 00:28:12.160
Yeah, so we'll move on to question eight for yourself, Maria.
00:28:12.319 --> 00:28:18.640
So, what does Qatar's law say about cross-border transfers of personal data?
00:28:19.279 --> 00:28:20.000
Thanks, Katie.
00:28:20.240 --> 00:28:31.119
Well, this is interesting actually, because Qatar's approach to cross-border transfers under the PDPPL is unique compared to other international frameworks like the GPR.
00:28:31.519 --> 00:28:41.519
While most laws start by prohibiting trans transfers unless specific safeguards are met, Qatar's law begins with kind of a principle of openness.
00:28:41.680 --> 00:28:54.480
Um, under Article 15, the law establishes a general rule that a data controller should not take measures or adopt procedures that may curb transfer transborder data flows.
00:28:54.640 --> 00:28:57.039
So they're kind of almost encouraging it there.
00:28:57.279 --> 00:29:07.279
Um, this means that by default, the law supports the international exchange of data to facilitate global business and technological innovation.
00:29:07.519 --> 00:29:10.720
So that's a different kind of perspective that we see from the GDPR.
00:29:10.799 --> 00:29:14.480
The GDPR would be like take the individual's uh personal data.
00:29:14.640 --> 00:29:22.799
If you can't provide the same level of protection when transferring the data, then you're not allowed to transfer it at all.
00:29:23.039 --> 00:29:31.519
Whereas here it's saying, you know, business and innovation shouldn't be hindered by stopping the transfer of personal data internationally.
00:29:31.839 --> 00:29:34.480
Uh, this freedom, however, is not absolute.
00:29:34.640 --> 00:29:45.200
The controller or the regulator is empowered to restrict or block data or the transfer of data if the transfer would violate the provisions of the PDPPL.
00:29:45.680 --> 00:29:54.480
Or the processing of that data in the destination country is likely to cause gross damage to the individual or their personal data.
00:29:54.640 --> 00:29:57.119
So there are kind of restrictions on that.
00:29:57.359 --> 00:30:09.039
Um, while the law itself is permissive, the National Cybersecurity Agency has issued guidelines that clarify how organizations should handle these transfers in a professional setting.
00:30:09.279 --> 00:30:13.119
Um, again, they go back to kind of explicit consent.
00:30:13.279 --> 00:30:21.680
For many high-risk transfers, obtaining the individual's clear and explicit consent remains the safest gold standard kind of thing for compliance.
00:30:21.759 --> 00:30:34.079
So that's like they're pointing back to, you know, even though it is a permissive type of approach to transfers, you still have to get explicit consent from the individual who's dating the processing.
00:30:34.240 --> 00:30:37.279
Again, they kind of look at contractual safeguards.
00:30:37.440 --> 00:30:48.720
Um, in practice, the regulator expects kind of written contracts between the Qatari entity or the exporter of the data and the international recipient who would be the importer.
00:30:48.960 --> 00:30:56.160
These contracts must ensure that the recipient would provide a level of protection at least equivalent to the Qatar's law.
00:30:56.319 --> 00:31:01.599
And again, very similar there to the GDPR, their idea of adequacy.
00:31:02.400 --> 00:31:08.720
And as well, DPIAs or data protection impact assessments can be undertaken as well in such scenarios.
00:31:08.960 --> 00:31:20.400
Um, for a university or a tech company, the NCSA typically requires DPI a DPIA to be done before starting any kind of large-scale international transfer.
00:31:20.640 --> 00:31:34.799
You must document that you have analysed the risk, the risks of the destination country and implement mitigation measures, like for example, you know, um sending data encrypted when transferring and so on.
00:31:34.960 --> 00:31:45.119
So the law provides the government with the right to restrict transfers for specific reasons such as national security, international relations, or the economic interest of the state.
00:31:45.359 --> 00:31:54.400
In 2026, this often means that certain sovereign data related to citizens or critical infrastructure may be required to stay within Qatar's borders.
00:31:54.480 --> 00:32:05.519
And again, we're seeing that happen quite a lot across the globe, kind of data sovereignty, keeping it within your borders, um, just for safety, for national safety.
00:32:05.759 --> 00:32:13.440
Uh, and this is this is this isn't a practice that we've we've known to be called like data sovereignty or data localization.
00:32:14.160 --> 00:32:34.240
So, you know, it it looks like they're kind of on the same path as many countries in in across the globe in terms of protecting personal data, protecting the citizens' data, and protecting the national security uh by keeping the data within their own kind of uh borders.
00:32:35.440 --> 00:32:37.680
So question nine, Katie.
00:32:38.799 --> 00:32:44.000
How is sensitive personal data treated differently under the Qatar law?
00:32:45.039 --> 00:32:46.319
Thanks, Maria.
00:32:46.480 --> 00:32:52.880
So it sensitive personal data is treated more strictly under Qatar's law.
00:32:53.119 --> 00:33:09.680
It I know we've defined this in the past and previously, but I'm just gonna go over the definition again, which is data related to ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations, and criminal offenses.
00:33:10.000 --> 00:33:15.039
So you need to get the permission of the authority if you're gonna protest this data.
00:33:15.279 --> 00:33:26.559
To get the permission, they also need to have it paired with a purpose of processing, explicit consent or parental consent if it's a minor's data.
00:33:27.359 --> 00:33:40.240
And they can also uh two, sorry, two of the reasons under which they can process sensitive data is if the data has been manifestly made public or if it's for an employment obligation.
00:33:40.319 --> 00:33:47.519
So we've seen that again with the GDPR, but they also need to carry out a DPIA to assess the risks and mitigate them.
00:33:47.759 --> 00:34:00.079
And in most cases, organizations are going to need to obtain the explicit consent before processing this type of data, and they're always going to need to implement enhanced safeguards to prevent misuse or harm.
00:34:00.400 --> 00:34:13.360
So it really reflects the principle that sensitive data carries greater risk for individuals, and they'll need to put in stronger conditions on accountability when they're handling this kind of data.
00:34:13.679 --> 00:34:31.280
The guidelines uh from the Ministry of Communications, the guidelines on AI, which we'll talk about later, also mentioned that the definition of personal data with a special nature should be interpreted broadly.
00:34:31.599 --> 00:34:45.519
They mentioned that and explicitly, which is you know, it's good when they say, you know, this is a strict textual interpretation, or you want to you want to understand this in a broad sense.
00:34:45.679 --> 00:34:46.559
So yeah.
00:34:46.880 --> 00:34:49.119
Yeah, because it encompasses more basically.
00:34:49.280 --> 00:34:50.400
It protects more.
00:34:50.559 --> 00:34:51.199
Yeah.
00:34:52.320 --> 00:34:58.159
So yeah, I'll I'll move on to my next question for yourself, Maria.
00:34:58.559 --> 00:35:03.920
How does the law address online privacy, marketing, and children's data?
00:35:04.239 --> 00:35:20.880
So again, the PD PPL contains robust provisions specifically targeting online environments, the commercial use of data for marketing and the protection of children, which I really like, you know, um, who are afforded a heightened level of care under the law.
00:35:21.039 --> 00:35:30.800
And I I really like that idea that um children, because they're so vulnerable, we're seeing more and more how the online environment can damage children.
00:35:30.960 --> 00:35:35.679
So putting extra protections in place for children, I think, is a really good idea.
00:35:36.159 --> 00:35:42.880
The law is primarily designed for the digital age, applying to all personal data that is processed electronically.
00:35:43.039 --> 00:35:52.400
In 2026, the regulator or the NCS, the NCSA expects any organization with a digital presence to adhere to privacy by design.
00:35:52.800 --> 00:36:00.320
And we see that with the GDPR, we've seen that with a lot of other uh legislations that we've looked at in this series as well.
00:36:00.480 --> 00:36:18.400
And this means that websites and apps must have accessible privacy notices, clear, non-technical explanations of what data is being collected via cookies and tracking pixels and so on, and for what purpose the data is being collected.
00:36:18.639 --> 00:36:39.840
Um, technical mess mechanisms, technical mechanisms that allow users to exercise their rights, such as buttons to request data deletion or to withdraw consent directly through the interface, are also recommended, and that makes withdrawing consent much easier if you have those things in place already.
00:36:40.480 --> 00:36:52.559
With regard to direct marketing, Qatar takes a very firm stance against direct marketing by electronic channels like email and SMS and automated calls.
00:36:52.800 --> 00:37:03.519
Under Article 22, organizations are strictly prohibited from sending marketing materials unless they have obtained the individual's prior explicit consent.
00:37:03.760 --> 00:37:17.840
The opt-out requirement, every marketing communication must include the sender's identity and a clear, valid address or link that allows the recipient to opt out or stop future communications immediately.
00:37:17.920 --> 00:37:20.000
So that's very similar to the QPR.
00:37:20.159 --> 00:37:29.119
Thankfully, we're now seeing lots of emails where you can literally just decide, you know, the top of the email, you can unsubscribe, which makes it really easy.
00:37:29.440 --> 00:37:33.760
Um and as well, they they will not accept implied consent.
00:37:34.000 --> 00:37:47.519
Like, unlike some jurisdictions that allowed that allow soft opt-ins for uh existing customers, the Tatari regulator generally expects a high opt-in for any electronic marketing activity.
00:37:47.679 --> 00:37:50.239
So that's quite you know that's quite strict as well.
00:37:51.280 --> 00:37:59.840
Now, when it comes to children, children are specifically identified as special nature, special nature category, so special category data.
00:38:00.000 --> 00:38:07.679
This means that the law treats their data with the same level of sensitivity as health or religious information, which is great.
00:38:08.239 --> 00:38:11.360
So they require the guardian's consent.
00:38:11.679 --> 00:38:21.119
Any website or service targeting children must obtain the explicit consent of the child's parent or legal guardian before processing any of the child's data.
00:38:21.360 --> 00:38:29.360
Operators are expected to take reasonable steps to verify that the person providing consent is indeed the legal guardian.
00:38:29.599 --> 00:38:41.679
And upon a request, a website operator must provide a guardian with a full description of the data being processed, a reason for the processing, and a copy of the actual data collected about the child.
00:38:42.000 --> 00:38:43.519
So that is really good.
00:38:43.920 --> 00:38:50.719
You know, all the data that have been collected about their child can be provided to them upon request.
00:38:51.119 --> 00:38:52.079
You know, it's great.
00:38:52.960 --> 00:39:06.000
Um so yeah, like we're seeing more and more that like um this uh this data protection law, the PDPPL, has teeth, you know, it's it's you know, it takes the protection of data very seriously.
00:39:07.119 --> 00:39:13.039
So now, Katie, we're going to look at kind of more of the AI angle in terms of data protection.
00:39:13.440 --> 00:39:18.800
So, does Qatar currently have AI-specific legislation?
00:39:18.880 --> 00:39:24.079
And what does the PDPPL apply to in terms of AI systems?
00:39:24.559 --> 00:39:25.840
Uh thanks, Maria.
00:39:25.920 --> 00:39:28.800
So this is a somewhat interesting question.
00:39:28.880 --> 00:39:42.000
So, right now, when we're recording this, they don't have a standalone AI law like the EU AI Act, but they do have soft law for AI through the national AI strategy and the guidelines.
00:39:42.639 --> 00:39:50.239
And as usual, you know, the PDPPL is going to apply to AI to the extent that people are using personal data.
00:39:50.400 --> 00:40:08.320
So where AI models or AI developers are using personal data, they're still subject to transparency, data minimization, accuracy, storage limitation, purpose limitation, and accountability, you know, and I feel like that makes a significant positive impact.
00:40:09.280 --> 00:40:10.480
I totally agree.
00:40:11.199 --> 00:40:31.599
And then again, not just that, but in the absence of you know, hard law, the Ministry of Communications and Information Technology has released principles and guidelines for ethical development and deployment of AI, and likewise principles and guidelines for the ethical use of AI.
00:40:31.760 --> 00:40:40.079
So they're not statutes, but they're could the best practice for if you're doing if you're if you're developing or using AI in Qatar.
00:40:41.119 --> 00:40:44.559
So I find these quite interesting and nice.
00:40:44.719 --> 00:41:12.159
So the development and deployment principles are do no harm, ensure system robustness and security, reduce bias and avoid discrimination, protect the environment, safeguard privacy, promote transparency, develop a human-centered approach, and assign the ultimate accountability to humans.
00:41:13.039 --> 00:41:13.840
That's really good.
00:41:15.440 --> 00:41:24.159
It's nice to know they're similar to the EU AI act principles as well, you know, just with the AI and so on.
00:41:25.119 --> 00:41:26.000
That's really good.
00:41:30.159 --> 00:41:33.679
But they also have principles for use of these systems.
00:41:34.719 --> 00:41:40.719
For anyone who's using them, it's kind of targeted to even mention students, you know, like you know, students.
00:41:40.880 --> 00:41:48.480
There's a big debate about whether students in college should be using AI, and I suppose the ultimate answer is you can't stop them, so you may as well give them guidelines.
00:41:48.880 --> 00:41:50.480
Absolutely totally great.
00:41:51.039 --> 00:42:05.199
So the principles for the use of AI is minimize bias and promote fairness, safeguard personal and organizational data, understand the AI's capabilities and limitations.
00:42:06.960 --> 00:42:25.280
Um, assume accountability, and this one it's entitled Assume Accountability, but it's explained as you need to gain an understanding and practice informed decision making and consider the ethical implications when you're using this technology.
00:42:26.159 --> 00:42:28.320
And there's two more principles.
00:42:28.480 --> 00:42:34.639
So the last two are comply with relevant laws and ensure the well-being of individuals and society.
00:42:35.360 --> 00:42:36.320
I like those.
00:42:36.559 --> 00:42:46.079
Especially, I like the idea of assuming accountability because like you really have to assume accountability when you're using AI.
00:42:46.320 --> 00:42:52.239
You can ask AI a question and you can take it as verbatim, there is a response.
00:42:52.559 --> 00:42:59.039
But like if it comes out as garbage, then you're responsible for that garbage if you proliferate that garbage.
00:42:59.119 --> 00:42:59.840
Do you know what I mean?
00:42:59.920 --> 00:43:10.800
So you have to really kind of take ownership of what you're ready to get behind when it comes to responses from things like ChatGPT and so on.
00:43:11.199 --> 00:43:17.599
So I really like that idea of assume accountability because at the end of the day, you can't blame an AI system.
00:43:18.000 --> 00:43:22.000
You know, you have to blame yourself for the leading AI system.
00:43:23.039 --> 00:43:27.039
I I personally really like to understand its limitations.
00:43:27.360 --> 00:43:27.599
Yeah.
00:43:27.840 --> 00:43:31.440
You know, I think that's a crucial, like they're all very good.
00:43:31.519 --> 00:43:33.039
Like, I I yeah.
00:43:33.440 --> 00:43:34.880
They're very well thought out, I think.
00:43:34.960 --> 00:43:35.360
Yeah.
00:43:35.519 --> 00:43:36.000
Yeah.
00:43:36.320 --> 00:43:36.960
Yeah.
00:43:37.360 --> 00:43:42.400
And because that leads that that kind of blends with assume accountability.
00:43:42.559 --> 00:43:47.119
So understand its limitations, they kind of go hand in hand together, you know.
00:43:47.360 --> 00:43:56.000
So if you if you understand their limitations, then you know you have to be ready to assume accountability, you know, if you're gonna use it.
00:43:56.960 --> 00:43:59.519
Um I think you like to hear this too then.
00:44:00.320 --> 00:44:16.960
On assume accountability and four use of our International Court and Dispute Resolution Center, which you've got a direction on practice guidelines for the use of artificial intelligence and court proceedings.
00:44:17.119 --> 00:44:32.639
And the reason why they did this was down from the judgment on uh related to the Qatar Financial Center Court where somebody referenced court law that did not exist.
00:44:36.719 --> 00:44:46.159
But this is beyond a mere research or on its it's uh you know, it's merely professional, it's it's professional negligence, you know.
00:44:48.559 --> 00:45:01.440
Um and the lawyer was found to be in contempt of court for first of argument that was based on AI that's hallucination, basically.
00:45:01.679 --> 00:45:03.599
Yeah, the hallucination, yeah.
00:45:03.920 --> 00:45:06.480
So these guys are on it.
00:45:07.280 --> 00:45:24.639
Yeah, it's funny as well because I was just on LinkedIn today as well, and I saw a friend, a post from a friend who said that the Pope has actually uh come out and said and asked priests not to use AI when creating sermons, would you believe?
00:45:25.199 --> 00:45:26.239
That's mental.
00:45:26.480 --> 00:45:28.000
Yeah, really interesting.
00:45:28.079 --> 00:45:30.239
So everybody's using AI now.
00:45:30.800 --> 00:45:32.719
Yeah, even the priests.
00:45:33.440 --> 00:45:40.000
So yeah, maybe these guidelines I like, I like the use guidelines they can apply, you know.
00:45:40.320 --> 00:45:40.800
Absolutely.
00:45:41.199 --> 00:45:44.400
If you take them into account and you really consider them, yeah, yeah.
00:45:45.519 --> 00:45:49.599
So we'll we'll move on to our final question here for yourself, Maria.
00:45:49.920 --> 00:45:57.760
Looking ahead, do you expect Qatar's privacy framework to evolve in response to AI and global trends?
00:45:58.320 --> 00:45:59.039
Thanks, Katie.
00:45:59.280 --> 00:46:04.320
Well, this is the last question, and my answer to that is I think it has to.
00:46:04.719 --> 00:46:11.599
You know, like every every country, we have to accept AI is going to be in our future.
00:46:11.920 --> 00:46:36.639
Qatar's privacy framework is expected to undergo a significant shift from passive compliance to proactive AI governance, and we're seeing that all over the place lately, where you know, we have the the GDPR era was you know quite passive compliance, writing documents, writing policies, demonstrating that you've done, you know, you've looked into things and you have documentation to show.
00:46:36.880 --> 00:46:44.000
Whereas now with the AI, um in the AI era, evidence is key to compliance.
00:46:44.159 --> 00:46:51.840
You can no longer just write a policy, you really have to show uh the auditors that you're actually doing what you say you're doing.
00:46:52.079 --> 00:46:55.679
So, like they said in Qatar, proactive AI governance.
00:46:56.000 --> 00:47:00.079
So the PDPPL remains the core statute.
00:47:00.639 --> 00:47:15.599
Uh, there are several clear trends that indicate how the framework is evolving to keep pace with global movements like the EU AI Act and the surge in agentic AI, which is like everybody's talking about agentic AI at the moment.
00:47:15.840 --> 00:47:27.039
For the past few years, Qatar has relied on soft law, as you have mentioned, Katie, in the form of ethical AI guidelines issued by the Ministry of Communication and Information Technology.
00:47:27.199 --> 00:47:34.239
However, as of early 2026, there is a clear move towards making these principles legally binding.
00:47:34.480 --> 00:47:51.840
Experts expect an amendment to the PDPPL or a new executive decree that formally mandates algorithmic auditing and bias assessments for high-risk AI systems used in public services, healthcare, and finance.
00:47:52.079 --> 00:48:02.320
This would move Qatar from simply suggesting ethical AI to requiring it, with the National Cybersecurity Agency acting as a primary enforcer.
00:48:02.800 --> 00:48:18.239
In 2026, Qatar is doubling down on data localization that we referenced earlier about data sovereignty and making sure that certain types of personal data and sensitive data stay within the borders of Qatar.
00:48:18.639 --> 00:48:36.880
As the country builds out its own infrastructure, like the recently expanded Oracle and Asia Cloud region in Doha, the government is increasingly requiring that sensitive data about Qatari citizens and critical national infrastructure stays within the country's borders.
00:48:37.119 --> 00:48:51.760
This mirrors global trends in sovereign clouds, where nations want to ensure that AI models are trained on local data that never leaves their jurisdiction, protecting against foreign surveillance and ensuring cultural alignment.
00:48:52.079 --> 00:48:55.039
We are seeing a trend of regional convergence.
00:48:55.199 --> 00:49:09.039
Countries like Saudi Arabia and Oman have recently updated their laws to be even more GDPR compliant or GDPR-like, sorry, introducing mandatory data protection officers and stricter portability rights.
00:49:09.360 --> 00:49:21.360
Qatar is likely to update its 2016 law to include missing modern rights like data portability and a more explicit right to contest automated decision making.
00:49:22.079 --> 00:49:33.519
This would ensure that Qatar remains a GDPR-aligned pioneer in the region, facilitating smoother trade and data flows between Europe and Qatar.
00:49:33.920 --> 00:49:38.480
The regulator is now moving beyond just policies on paper.
00:49:38.639 --> 00:49:43.920
The NCSA's 2026 agenda places a massive emphasis on technical enforcement.
00:49:44.159 --> 00:49:52.159
Organizations will soon be expected to prove that they are using synthetic data or differential privacy when training AI models.
00:49:52.400 --> 00:50:05.039
I think that's that's kind of where it's going in terms of data protection and AI, then again, very closely aligned with AI compliance, as we're seeing with the GDPR as well.
00:50:05.360 --> 00:50:21.519
So the kind of the data protection law would be fundamental and it would, you know, any kind of laws that you would see coming in in terms of AI would have to kind of sit on top of that data protection law, again, similar to Europe.
00:50:23.119 --> 00:50:26.719
So that kind of concludes our podcast for today.
00:50:26.880 --> 00:50:28.639
I think we've been quite efficient.
00:50:28.800 --> 00:50:33.039
Uh, usually we take an hour, but we we definitely are within the hour this time.
00:50:33.519 --> 00:50:41.440
So this is the end of today's episode on Qatar's personal data privacy objection law, law number 13 of 2016.
00:50:41.679 --> 00:50:53.519
Katie and I have explored the foundations of Qatar's national privacy regime, the rights and uh the rights it provides, how it may increasingly intersect with AI governance as technology evolves.
00:50:53.760 --> 00:50:58.239
But again, there's a lot more to be learned, a lot more to understand about the law.
00:50:58.400 --> 00:51:02.480
So I would encourage you all to go and read the law and interpret the law.
00:51:02.719 --> 00:51:08.559
Um so thanks for listening, and um until next time.
00:51:09.199 --> 00:51:10.400
Thanks everyone.
00:51:10.639 --> 00:51:11.599
Take care.
