Qatar's data protection law and AI: what to settle before you build

Why this matters for AI projects

Most AI projects in a business touch personal data sooner or later. A customer service agent reads names, phone numbers and order histories. An HR assistant sees CVs. A document search system indexes contracts that name people. In Qatar, that processing falls under Law No. 13 of 2016 on the Protection of Personal Data Privacy, usually called the PDPPL.

The PDPPL predates today's generative AI and contains no AI-specific rules. It covers personal data processed electronically, whatever the technology, which makes it the first legal question for almost every AI system built in Qatar. Organisations in the Qatar Financial Centre follow the QFC's own data protection regulations instead.

Who oversees the law

Responsibility for the law has moved over the years. Its regulatory guidelines for controllers and processors were published in 2021 by the communications ministry's Compliance and Data Protection Department, and the National Cyber Security Agency (NCSA) has since been described as the competent authority for administering and enforcing it. Recent legal commentary notes that these arrangements are still being clarified, so confirm the current contact point before you file a permit request or a breach notification. Fines for breaching the law can reach QAR 5 million, depending on the violation.

Seven questions to answer before you build

1. What personal data will the AI actually see?

List every place personal data enters the system: the documents you index, the prompts users type, the answers the model writes, logs, analytics, and any data used for testing or fine-tuning. Teams often protect the source database and forget that the same data now also lives in a search index, a prompt log and a vendor's console. Collect and keep only what the use case needs.

2. Is the purpose clear, and was the data collected for it?

The PDPPL expects personal data to be processed transparently and for a legitimate purpose. Data gathered to deliver a service cannot automatically be reused to train or tune a model. If the AI use is new, check whether your privacy notice covers it, and whether you need consent or can rely on another ground the law allows.

3. Does it involve “special nature” data?

The law gives extra protection to personal data of a special nature: data about ethnic origin, children, health, physical or mental condition, religious beliefs, marital relations and criminal records. It may only be processed after obtaining a permit from the competent authority, with additional safeguards. This matters directly for AI in healthcare, HR, insurance and education. Plan the permit and a data protection impact assessment into the project timeline rather than discovering them at launch.

4. Where will the data be processed, and by whom?

Most AI systems rely on outside providers: a model API, a cloud platform, a vector database. The organisation that decides why and how the data is processed (the controller) stays responsible for what its processors do. For each provider, check where data is stored and processed, what is kept and for how long, whether your data is used to train their models, and what the contract says about security and breaches.

The law does not block transfers abroad by default, but government entities, regulated sectors and many clients have their own data residency requirements. Where data must stay in the country, cloud regions in Qatar and private deployments of open models are practical options.

5. Can you honour people's rights inside the AI system?

Individuals can ask to access their data, have it corrected or erased, and withdraw consent. In an AI system, that means finding a person's data not only in the main database but also in conversation logs, document indexes and caches, and being able to remove it. Build this in from the start; retrofitting it is expensive.

6. Are security and breach response ready?

Controllers must protect personal data with appropriate technical and organisational measures. If a breach is likely to cause serious harm, the competent authority and the affected individuals must be notified, and the guidelines set a 72-hour deadline. Include the risks that are new with AI: prompt injection, answers that reveal data a user should not see, and agents with broader access to other systems than their task requires.

7. Will the AI send marketing messages?

The PDPPL prohibits electronic direct marketing without the recipient's prior consent. An AI that drafts and sends personalised offers by email, SMS or messaging apps must follow the same consent and opt-out rules as any other campaign.

Sector rules on top

Some sectors have additional requirements. In September 2024, Qatar Central Bank issued an Artificial Intelligence Guideline for its licensed entities. It covers governance, risk management, human oversight, record keeping and disclosure, and requires QCB approval before AI systems classed as high-risk are deployed.

The National Cyber Security Agency has also published guidelines on the secure adoption and use of AI (2024), covering people, processes and technology across the AI lifecycle. They are voluntary, and a useful checklist for any organisation.

A practical way to start

None of this needs to slow a project down if it is part of the design rather than an afterthought. We recommend starting every AI project with a short data map: what data the system touches, where it flows, who can see it and how long it is kept. That map answers most of the questions above, shows early where a permit or impact assessment is needed, and becomes part of the project documentation.

If you are planning an AI project, the free AI Readiness Check shows in a few minutes where you stand on data, governance and the other areas that matter. Or talk to us about your use case.

This article is general information, not legal advice. Laws and guidance change; for a specific project, confirm the current requirements with the competent authority or a qualified lawyer in Qatar.