Qatar

The Lawful Basis, Notice, and Data Subject Rights Obligation in Qatar is a legally binding statutory requirement that seeks to protect the privacy of individuals and regulate data processing by companies [13/2016]. It is mandated under Law No. 13 of 2016 [13/2016] and enforced by the National Cyber Security Agency (NCSA) on the mainland, requiring both public and private organizations to create a standard legal basis for their operations through either explicit or implied prior consent before processing any personal information. This requirement obliges organizations to provide privacy notice about purposes for processing and disclosure to third parties while complying with codified rights of data subjects (access, correction, erasure, and objection) within a mandatory 30-day period. Moreover, processing of "special nature" metrics (biometric, genetic, or children’s data) is forbidden unless specific approval is granted by NCSA. Enforcement of this obligation may result in the issuance of obligatory remedial orders or fixed administrative fines between QAR 1,000,000 and QAR 5,000,000 per violation.

Personal Data Breach Notification obligation in Qatar is a compulsory and legal requirement aimed at mitigating privacy risks after any kind of security breach [13/2016]. This obligation is governed by Law No. 13 of 2016 [13/2016] and is enforced on the mainland through the National Cyber Security Agency (NCSA). It implies that in case there is a security breach and there is an imminent risk of serious harm to the individual's privacy or data, the controller shall notify the NCSA and all affected individuals without delay, but not later than 72 hours from the date of detection. It involves giving a detailed description of the incident in terms of the scale of the affected data, the likely consequences, and the remedial measures put in place to mitigate the risk of harm. Failure to meet the timely notification requirement or concealment of the breach results in serious enforcement penalties, with either a fixed fine of between QAR 1,000,000 and QAR 5,000,000 or the obligation to correct the breach.