Qatar’s data protection law is Law No. 13 of 2016 on Protecting Personal Data Privacy. It applies to personal data handled electronically, so it reaches your website forms, mailing lists and CRM. A company must tell people what it collects and why, keep the data secure, report serious breaches and get consent before sending marketing messages.
What the law covers and who enforces it
Under Article 2, the law covers personal data processed electronically, collected for electronic processing, or handled partly on paper and partly on a computer. Data kept for personal or family reasons is outside it, as is data for official statistics.
Personal data is any data about a person who can reasonably be identified, from it alone or combined with other data. A name and mobile number in a contact form qualify; so does an email address on a newsletter list.
The company that decides why and how data is used is the controller. A supplier handling data for it, such as a hosting firm or an email platform, is a processor.
- Of 2016, 32 articles, in force with no amendment shown on Al Meezan
- Law No. 13
- Highest fine for most breaches (Art. 23)
- QAR 1 million
- Highest fine for security, sensitive data and children (Art. 24)
- QAR 5 million
- Breach notice window in NCSA guidance, not in the law itself
- 72 hours
From Law No. 13 of 2016 (Al Meezan, Arabic text) and the NCSA breach notification guidelines, checked 26 Oct 2026.
What a company must do, article by article
| Article | What the company must do | Highest fine |
|---|---|---|
| 4 | Get the person’s consent, unless the processing is needed for a legitimate purpose of the company or of the party receiving the data | QAR 1 million |
| 8 and 11 | Process data honestly and lawfully, build privacy into new systems, train staff, set up ways to handle complaints and requests, and check suppliers | QAR 1 million |
| 9 | Before collecting, tell the person who you are, why you want the data and how it will be used and disclosed | QAR 1 million |
| 10 | Collect only what the purpose needs, keep it accurate, and keep it no longer than the purpose requires | QAR 1 million |
| 12 and 13 | Pass data to a processor only for a lawful purpose; protect it against loss, change, disclosure or misuse | QAR 1 million (Art. 12); QAR 5 million (Art. 13) |
| 14 | Tell the person and the regulator of a breach that could cause serious harm | QAR 1 million |
| 15 | Do not block data from moving across borders unless the processing breaks the law or could cause serious harm | QAR 1 million |
| 16 and 17 | Get a permit before processing sensitive data; follow the extra rules for websites aimed at children | QAR 5 million |
| 22 | Send marketing by electronic means only with prior consent, naming the sender and giving a way to stop | QAR 1 million |
Article 11 adds eight internal duties that sit behind the website.
The eight duties in Article 11
Review privacy safeguards before any new processing starts.
Name the processors responsible for protecting personal data.
Train those processors and keep them aware of the rules.
Set up a way to receive and study complaints and requests for access, correction or deletion, and make it available to people.
Keep internal systems to manage personal data and to report any breach of its safeguards.
Use suitable technology so people can see, review and correct their own data directly.
Carry out full audits and reviews of how well the company complies.
Check that each processor follows your instructions and protects the data, and keep monitoring it.
Article 25 also fines the company itself up to QAR 1 million when an offence is committed in its name and for its benefit. Under Article 28, a contract made in breach of the law is void.
On your website: privacy notice, forms and cookies
The privacy notice is where Article 9 is met. NCSA’s guideline expects it to name the company, describe the processing and its purposes, say how long data is kept and who receives it, list the person’s rights and state any transfer outside Qatar.
Notice at the point of collection
Before or when a form is sent. For data received from elsewhere, within one month at most.
Ask for less
A callback form needs a name and a number. Nationality or passport fields need a reason under Article 10.
Advertising cookies after a click
NCSA says cookies for targeted advertising, not needed to run the site, are set only after the visitor opts in.
A way to ask
An address or form for requests to see, correct or delete data. NCSA expects an answer within 30 calendar days.
Hosting, email and analytics suppliers are processors. NCSA’s controller and processor guideline asks for a written contract with each, and checks on their safeguards.
Marketing messages: email, SMS, social media and calls
Article 22 bans any electronic message sent for direct marketing unless the person agreed beforehand. Each message must show who sent it, make clear that it is marketing, and give a working address where the person can ask to stop or withdraw consent.
- Consent by an action
An empty tick box or a clearly worded sign-up field. NCSA treats pre-ticked boxes and "accept the terms" wording as opt-out, not consent.
- One channel at a time
Consent for email does not cover SMS. A discount cannot depend on agreeing to marketing.
- Keep the evidence
Record when and where each person signed up, ideally with a timestamp.
- Make stopping easy
One-click unsubscribe, and a request to stop honoured whichever channel it arrives by.
Email: an honest sender name, a statement that it is marketing, your contact details and a link to your privacy notice.
SMS: a clear sender name and plain opt-out instructions; "STOP" and a number alone is not enough, NCSA says.
Social media: messages only from your official page, with a way to opt out on the same platform.
Telephone: the caller names themselves and the company, says it is a marketing call and records any request to stop.
Requests from individuals and data breaches
Under Articles 5 and 6, a person may at any time withdraw consent, object to unnecessary or unfair processing, ask for deletion or correction, and see their data. A copy may cost no more than the service fee.
Article 13 makes a processor tell the controller as soon as it learns of a breach or a risk to the data. Article 14 then requires the controller to inform the person and the regulator if the breach could seriously harm the data or the person’s privacy.
What NCSA’s guideline adds
Report through the breach form on NCSA’s website within 72 hours of becoming aware of it. If the facts are incomplete, report what you have and say when the rest will follow.
Give the nature of the breach, the kinds of people and data involved, rough numbers and a contact for privacy matters.
Record why you decided to report or not. Wrongly judging a breach harmless can itself breach Article 14.
Sensitive data, children and data sent abroad
Article 16 treats data on ethnic origin, children, health or physical or mental condition, religious belief, marriage and criminal offences as data of a special nature. It may be processed only with a permit from the regulator. A clinic booking form that asks about symptoms falls here.
NCSA’s guideline asks for a data privacy impact assessment before the request. A permit covers only the processing described in it; any change needs a new one.
A website aimed at children carries five extra duties under Article 17.
The five duties
A notice on the site on what children’s data is collected, how it is used and when it is disclosed.
Explicit consent from the child’s guardian.
On the guardian’s request, after checking identity: a description of the data, the purpose and a copy.
Deleting or stopping the processing of the child’s data when the guardian asks.
No game or prize draw that needs more data than taking part requires.
Hosting abroad is not banned. Article 15 stops a controller from limiting cross-border flows unless the processing breaks the law or could cause serious harm. Your privacy notice should still say where data goes.
How we help
Noor Digital Technology, part of Noor Group, reviews what your company already runs: website forms, cookies and tracking tags, mailing lists, ad accounts and the suppliers behind them. We prepare a list of gaps against the law, help you set up opt-in sign-ups with a consent record and working unsubscribe links, and prepare a draft privacy notice for your lawyer to check. The NCSA decides on permits and complaints.
