Qatar Data Privacy Laws
Qatar`s DPL sets out clear consent requirements. According to Article 4 of the DPL, the controller is required to obtain the consent of an individual before processing his or her personal data. However, the controller may not be required to obtain consent if the processing is necessary for legitimate purposes for the controller or another recipient of the data. According to those rules, electronic communications providers may only process traffic data for the duration of the data necessary for the transmission of the communication and must then erase or anonymise that data. Any organisation processing such personal data must respect the principles of transparency, fairness and respect for human dignity. The law places a strong emphasis on organizations ensuring that the personal data they process is up-to-date and that appropriate measures are in place to ensure the security of personal data. Any natural person whose data is being processed. Data documentation shall be retained for as long as necessary for its collection. The DPL describes a number of rights granted by law to persons whose personal data is processed, such as: The Commissioner issued Instruction No. 06 of 28 May 2010 “On the correct use of SMS for advertising, advertising, information, direct sales, via mobile phone”. This instruction stresses the importance of the prior consent of the data subject. In accordance with Directive No.
47 of 14. September 2018 “On establishing rules to maintain the security of personal data processed by large processors”, which, as mentioned above, only applies to large data processors, the DPO will promptly inform the large data processor in writing of any risk of violation of the rights of data subjects, including in the event of a breach of the legislation on the protection of personal data. Although the DPL contains some provisions requiring data controllers to verify the level of compliance of their subcontractors, the text does not explicitly suggest a contract. However, the DPL Directives contain additional obligations for data controllers that require them to enter into a contract with their processors for data processing. The contract must mention the nature of the processing, its purpose, duration, security measures and human rights. Any natural person who processes personal data at the suggestion or recommendation of a controller. Qatar was the first country in the Middle East to adopt a national data protection law. The local data protection authority recently published a set of regulatory guidelines that clarify existing legislation and introduce new compliance requirements for data controllers. In this article, we give an overview of the main changes to the data protection regime and some specific considerations for all organizations doing business in Qatar.
In addition, in accordance with Article 124 of the Law on Electronic Communications, providers of electronic communications services may only process traffic data for marketing purposes with the prior consent of the subscriber. Subscribers should be informed of the type of traffic data processed before giving their consent to their processing. Subscribers and users have the right to withdraw the consent given at any time. Those measures shall aim to ensure an adequate level of protection and security of personal data against potential foreseeable risks. With regard to users` personal data, professionals of public electronic communications networks and services are required to inform their users of a specific risk, how the risk can be reduced by users, as well as the possible costs to be borne by the user if the risk incurred goes beyond the measures that the trader can take. Data protection law does not provide for a general obligation of the controller or processor to inform the controller in the event of a personal data breach. According to Commissioner`s Decision No. 8 of 31 October 2016 The following countries have an adequate level of data protection: Information received by the Commissioner in the performance of his duties may only be used for supervisory purposes in accordance with the legislation on the protection of personal data.
