Qatar’s data privacy law and AI: what Law 13 of 2016 asks before you deploy

Qatar’s data privacy law, القانون رقم (13) لسنة 2016 بشأن حماية خصوصية البيانات الشخصية, was issued in November 2016 and published in the Official Gazette at the end of that year [1, 2]. Al Meezan, the state’s legal portal, lists it as in force [2]. It was written before anyone put a language model in front of customer records, and it never uses the words artificial intelligence.

It does not need to. The law applies to personal data processed electronically, or gathered in preparation for electronic processing [1], which describes every AI system I have seen in production. Its definition of personal data covers data from which a person can be reasonably identified, directly or “through the combination of such data with any other data” [1]. Combining data is what retrieval and inference do all day.

The law gives enforcement to a competent department inside the ministry. NCSA’s own guidelines state that under Amiri Decree No. 1 of 2021 that role belongs to the National Cyber Governance and Assurance Affairs at the National Cyber Security Agency, which publishes the guidelines quoted on this page [3]. The Arabic text calls the controller المراقب and the competent department الإدارة المختصة [2], which is worth knowing when your DPO and your counsel are reading different versions.

The penalties are in the law. Breaching the articles on consent, design and precautions, notice, data quality, the review and processor duties, disclosure to processors, breach notice, cross-border flow or direct marketing (Articles 4, 8 to 12, 14, 15 and 22) carries a fine of up to QR1 million. Breaching the security precautions in Article 13, processing special-nature data without a permit, or the rules for websites aimed at children carries up to QR5 million, a company can be fined up to QR1 million for an offence committed in its name, and any contract that breaches the law is void [1]. Firms in the Qatar Financial Centre have their own Data Protection Regulations 2021 and Data Protection Office [4]; this page covers the national law.

Here is Article 15 in full, in the official English translation: “Taking into account the liabilities provided for hereto, the Controller shall be forbidden from taking any decision or measure that may limit the Cross-Border Data Flow, unless the processing of such data is in breach of this Law, or where such processing may cause serious damage to the Personal Data or to the Individual’s privacy” [1]. The Arabic opens the operative clause with يُحظر على المراقب, the controller is prohibited [2].

Read that twice. A lot of Gulf residency conversations assume the law wants data kept at home. Qatar’s data privacy statute starts from the other end: the party it restrains is the controller that blocks the flow, and a breach of Article 15 sits in the same QR1 million band as a missed breach notice [1].

The flow is not unconditional. The opening words keep every other duty in play, and NCSA’s impact assessment guidelines treat a transfer of personal data outside Qatar as one of two kinds of processing the law itself marks as able to cause serious damage [3]. So a model endpoint in another country is allowed, and it is something you assess before you use it. NCSA’s controller and processor guidelines add that the contract with a processor must say it processes personal data only on your written instructions, including on any transfer outside Qatar [5].

In practice the statute will rarely be the reason an AI system has to run in Doha. Sector rules can be. The Qatar Central Bank’s Cloud Computing Regulation, in force since 15 April 2024, requires every entity it regulates to ensure that personally identifiable and financial information is processed within Qatar only, and to get QCB approval before entering a cloud arrangement [6]. Whether the model you want runs in the Doha region at all is a separate question, and the guide to where Gulf AI workloads actually run sets out what to ask a cloud or model vendor.

Here is the law read the way an AI team has to read it. The first column is where each duty sits and the most it can cost. The second is my reading of what it asks of an AI system. The third is the artefact that shows the duty was met, which is what a DPO, an auditor or NCSA will ask to see.

The first column is from the law [1]. The 72 hours come from NCSA’s breach guidelines, not the statute, which asks for notice without setting hours [7], and NCSA grounds privacy by design and by default in Articles 3, 8 and 13 [8]. The middle column is my reading, not NCSA’s, and this page is not legal advice.

Article 11(1) is one line: the controller reviews its privacy protection measures before proceeding with new processing operations [1]. The Arabic says the same thing, قبل إدراج عمليات معالجة جديدة, before introducing new processing operations [2]. NCSA’s guidelines turn that line into a data privacy impact assessment and are firmer than its brevity suggests. An assessment should be done before any new processing activity, it must be done where the processing may cause serious damage, and where you decide one is not needed you record that decision and the reasons for it [3].

NCSA gives a screening list for that judgement [3], and an AI system usually meets several items on it at once.

The appendix matters most to an AI team. Its examples of changes that may trigger an assessment include using a new third-party system provider, processing personal data for a new use case and using existing personal data to improve a product [3]. On that reading, switching model provider, pointing an existing assistant at a new data source or fine-tuning on customer history each start a new review, so the assessment is not a one-off at launch.

The assessment has a set shape in NCSA’s guidelines: who owns the processing, the decision on whether to assess, what is processed, whose data, how and where and why, necessity and proportionality, risks and mitigations, residual risk, how each data privacy principle is met, and sign-off by the data protection lead, the head of the owning function and the people who contributed [3]. If a high risk of serious damage remains after the mitigations, you consult NCSA before going ahead, and NCSA reads a failure to assess where one was clearly required as open to the QR1 million fine in Article 23 [3].

Saudi Arabia’s regulation works the other way round: it names the situations that require an assessment. Qatar’s law asks for the review before every new processing operation and leaves the depth to the controller. If one system serves both countries, write one assessment that answers both, starting from Saudi Arabia’s impact assessment triggers and NCSA’s screening list.

Article 16 treats data on ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations and criminal offences as personal data of a special nature, and allows it to be processed only after the competent department grants permission, under procedures a ministerial decision sets [1]. The Arabic word is تصريح, a permit [2], and processing without one is in the QR5 million band [1].

Children are on that list as a category in their own right. Any AI system that processes data about children, a tutoring product, a school platform, a paediatric triage tool, is processing special-nature data before anyone asks what the model does with it. A website aimed at children carries extra duties under Article 17 as well, including explicit consent from a guardian [1].

The harder case is data the system produces. The law’s definition of personal data turns on whether a person can be identified through the data or its combination with other data [1], and on my reading a model that infers a health condition or a religious practice from ordinary records has created special-nature data about an identifiable person. A presentation published in NCSA’s document library in February 2026, given by a Qatar University law professor, makes the same argument: inference is processing, and an inferred special-nature attribute calls for permission and heightened safeguards [9]. That is a lecture rather than NCSA guidance, but I would design as if it were right.

In practice that means deciding which inferences the system is allowed to make, blocking the rest at the prompt and at the output, and never writing an inferred special-nature attribute into a profile or a vector index that no permit covers.

Nothing in the law takes government entities out of the definition of a controller, and two articles give them room. Article 18 lets the competent authority process some personal data without Articles 4, 9, 15 and 17 (consent, notice, the cross-border rule and the rules for children’s websites) to protect national and public security, the state’s international relations or its economic and financial interests, or to prevent and investigate crime, and it keeps a special record of that data [1]. Article 19 exempts a controller from consent, from the rights to withdraw, object and seek erasure, and from the access rights in Article 6, where it is carrying out a public-interest task under law, meeting a legal obligation or court order, protecting a person’s vital interests, doing public-interest research or gathering information for a criminal investigation [1].

Neither article touches Articles 8, 11, 13, 14 or 16. A ministry that needs no consent for an assistant over case files still reviews its privacy measures before the new processing starts, still keeps precautions proportionate to the data, still reports a serious breach and still needs a permit for health or children’s data. For a public-sector programme, the Article 11(1) review is the document that shows the exemption was considered rather than assumed.

This is the order I would work in. It is built from the law and NCSA’s guidelines rather than a procedure NCSA publishes, and it assumes someone can make decisions about the system.

Where nobody can say which systems hold personal data, start with the map, because the other seven steps all depend on it.

This is the work we sell as AI governance implementation: the impact assessment, the processor register and the logging built into the system they describe, so the evidence NCSA may ask for comes out of the system rather than from a document written beside it. We work with clients across the UK, the US and the Gulf, and we have built Arabic-language AI, including bilingual Arabic and English search and Arabic document OCR, which matters in Qatar because the records an assessment has to map are often in Arabic.

Our closest published work in the region is the production estate of a government-accredited EdTech in the Middle East, whose database we replatformed into Google Cloud’s Doha region, me-central1, to meet Gulf data-residency requirements, with every store placed in a named region and the reasons written down. Once a scope is signed, a fixed-scope build can start within a day, and if you already have a scoped job, we can resource it on contract from the collective of associates who work with us, held to the same standard. Whether the result satisfies NCSA stays with your data protection lead and your counsel. The call is booked from the end of this page.