Keeping your data in Qatar: cloud regions, private models and when each makes sense

Start with what the rules actually require

Qatar's personal data protection law (Law No. 13 of 2016) does not contain a general requirement to keep personal data inside the country. Transfers abroad are possible, but the organisation remains responsible for the data, and personal data of a special nature, such as health data, needs a permit from the competent authority before it is processed at all.

Other rules can be stricter. Government entities classify their information under the National Data Classification Policy issued by the National Cyber Security Agency in 2023, and the classification decides which controls apply. Regulated sectors such as banking follow their supervisors' expectations, and many large clients write residency requirements into their contracts. Map which of your data falls under which rule before you choose an architecture.

Three ways to run AI

1. Global AI services

Calling a model provider's API, wherever it hosts the model, is the fastest way to use the most capable models. It suits public information, internal content that is not sensitive, and data from which personal details have been removed. Check the provider's data terms: whether prompts are stored, for how long, and whether they are used for training.

2. Cloud regions in Doha

Microsoft opened its Azure Qatar Central region in Doha in 2022, and Google Cloud opened its Doha region in 2023, each with three availability zones. Running your applications, databases and document indexes there keeps the data itself in the country. The catch: the newest AI models are not always offered in every region, so check exactly which models and services are available in-country before you design around them.

3. Private models

Open-weight models, which you download and run yourself, can be deployed on servers you control, in a Doha cloud region or on your own premises. Nothing leaves your environment. In exchange you give up some capability and take on running costs: GPU capacity, updates, monitoring and security become your responsibility, or your partner's.

In practice: a mix, decided per class of data

Most organisations do not need one answer for everything. A common pattern:

• Public and low-sensitivity content: global AI services, for the best quality at the lowest cost.
• Internal and personal data: data, indexes and logs stored in a Doha region; model calls go to models available in-country, or to global models after personal details are removed.
• Special-nature or highly classified data: private models inside your own environment, with no external calls.

The routing between these tiers belongs in the system design, not in each user's judgement: the application decides which model may see which data, and logs the decision.

Questions to ask any AI provider

• Where exactly are prompts, files and outputs processed and stored, including backups and logs?
• Is our data used to train or improve your models, and can that be excluded in the contract?
• How long is data retained, and can we have it deleted on request?
• Which sub-processors are involved, and in which countries?
• How, and how quickly, will you tell us about a security incident?

Where to start

Classify the data your first AI use case needs, then choose the simplest option that the most sensitive part of that data allows. Our article on Qatar's data protection law and AI covers the legal questions in more detail, or talk to us about your architecture.