Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016), the first general data protection statute in the GCC, is enforced by the National Cyber Governance and Assurance Affairs (NCGAA) division of the National Cyber Security Agency (NCSA), with a separate parallel regime for entities inside the Qatar Financial Centre.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Qatar's general personal data protection statute, in force since 2017, applying to processing of personal data in Qatar's mainland jurisdiction (outside the Qatar Financial Centre). The first economy-wide data protection law adopted by a GCC member state.
SourceA separate data protection regime applying only to entities incorporated or registered within the Qatar Financial Centre free zone, administered by the QFC's own Data Protection Officer rather than the NCSA.
Source72 hours
Where a breach is likely to cause serious harm to personal data or individual privacy, controllers must notify the NCGAA and, where risk to individuals is significant, affected data subjects, within 72 hours of becoming aware of the breach. Processors must notify controllers immediately so the controller can meet the 72-hour clock.
Notify: National Cyber Governance and Assurance Affairs (NCGAA), National Cyber Security Agency
SourcePublished legal maximums, not a personalized estimate, not legal advice.
PDPPL Law No. 13 of 2016, administrative fines
Up to QAR 1,000,000 for violations of Articles 4, 8-12, 14, 15 and 22; up to QAR 5,000,000 for violations involving special-nature (sensitive) data processing and children's data
The PDPPL is a purely financial penalty regime, no imprisonment provisions were found for PDPPL violations themselves (distinct from Qatar's separate Cybercrimes Combating Law).
SourceNot applicable , as of 2026-09-08
National Cyber Governance and Assurance Affairs (National Cyber Security Agency)(NCGAA / NCSA)
Visit authority siteThe Compliance and Data Protection Department function now sits within the National Cyber Governance and Assurance Affairs (NCGAA) division of the National Cyber Security Agency (NCSA), which took over PDPPL oversight from the former Ministry of Transport and Communications.
Controllers must notify the NCGAA (and affected individuals, where risk is significant) within 72 hours of becoming aware of a breach likely to cause serious harm.
No. QFC-registered entities are instead subject to the separate QFC Data Protection Regulations 2021, administered by the QFC's own Data Protection Officer.
Talk to us about scoping an engagement around your specific regulatory context.
