Qatar Personal Data Privacy Protection Law (PDPPL) and AI

What it is

Law No. (13) of 2016 on Protecting Personal Data Privacy, usually called the PDPPL, is Qatar’s general data protection law. It was issued at the Emiri Diwan on 3 November 2016. It is short, with 32 articles, and leaves much of the detail to ministerial decisions and to guidelines from the competent department.

That department is now the National Cyber Governance and Assurance Affairs within the National Cyber Security Agency (NCSA). Under Amiri Decree No. (1) of 2021 it administers and enforces the law, and it publishes a set of guidelines, checklists and templates for regulated entities. The law itself still names the Ministry of Transport and Communications, which held the role when it was enacted.

The PDPPL does not mention artificial intelligence. It matters for AI because almost every AI system that touches people processes their personal data, and because the NCSA’s guidelines speak directly to automated decision-making.

Who it applies to

Article 2 applies the law to personal data that is processed electronically, that is obtained or gathered in preparation for electronic processing, or that is processed through a mix of electronic and traditional means. Processing by individuals in a private or family setting, and processing to produce official statistics under Law No. (2) of 2011, are outside it.

Duties fall mainly on the controller, the natural or legal person who decides how and why personal data is processed. A processor processes personal data for the controller. An organisation that uses a vendor’s AI model to screen applicants or score customers is the controller, and the vendor is usually its processor.

Firms operating in the Qatar Financial Centre are subject to the QFC Data Protection Regulations 2021 instead, which have their own automated decision rule.

What it requires

For an AI system, these are the duties that matter most.

• Lawful basis. Article 4 allows processing only with the individual’s consent, unless it is necessary to achieve a lawful purpose of the controller or of the recipient of the data.
• Notice before processing. Article 9 requires the controller to tell the individual, before processing starts, who is processing their data, for which lawful purposes, and to give a comprehensive and accurate description of the processing and of any disclosure.
• Relevance and accuracy. Article 10 requires personal data to be relevant and adequate for the lawful purpose, and accurate, complete and up to date. Training and input data for AI sit squarely inside this.
• Privacy review before new processing. Article 11 requires the controller to review privacy protection measures before starting new processing operations, to audit compliance, to give individuals ways to access and correct their data, and to keep checking that processors follow instructions. Article 8 adds a duty to consider privacy controls when designing, changing or developing products, systems and services.
• Security and breach notification. Article 13 requires precautions against loss, damage, change, disclosure, access or misuse, proportionate to the importance of the data. Article 14 requires the controller to inform the individual and the competent department of a breach that may cause serious damage to personal data or privacy. The NCSA’s breach guidelines set a 72-hour expectation for that notification.
• Rights. Under Articles 5 and 6, individuals can withdraw consent, object to processing that is unnecessary, excessive, discriminatory, unfair or illegal, ask for erasure or correction, and access their data and be told the purposes of processing.
• Special nature data. Article 16 treats data on ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations and criminal offences as data of a special nature, which may only be processed with permission from the competent department.

The NCSA’s DPIA guidelines for regulated entities, version 2.0 from September 2022, turn Article 11 into a working test. Controllers must carry out a data privacy impact assessment for any processing that may cause serious damage, and must record why one was not needed where they decide against it. The screening list includes using a new innovative technology or an existing one in a new way, and carrying out automated decision-making that leads to a decision to limit an individual’s access to a product, service, opportunity or benefit. Most consequential AI systems meet one or both.

Key dates

• 3 November 2016. Law No. (13) of 2016 issued.
• November 2020. First version of the DPIA guidelines for regulated entities published.
• 2021. Amiri Decree No. (1) of 2021 makes the NCSA’s National Cyber Governance and Assurance Affairs the competent department.
• September 2022. Version 2.0 of the NCSA’s DPIA and breach notification guidelines published.

How it relates to other frameworks

The PDPPL is older and shorter than the GDPR, and it has no equivalent of Article 22’s right not to be subject to solely automated decisions. Its protection for people affected by AI comes instead from notice, accuracy, the right to object to unfair or discriminatory processing, and the DPIA expectation in the NCSA guidelines.

In the financial sector, the QCB Artificial Intelligence Guideline lists the PDPPL among the laws licensed entities must comply with when they use AI. Organisations that want a structure for their wider AI governance often pair the PDPPL with ISO/IEC 42001 or the NIST AI RMF, and an AI impact assessment built for those can carry most of what a PDPPL DPIA needs.

A note on this page

This is Aicura’s reading of the PDPPL and the NCSA’s published guidelines. It is not legal advice. The English text published by the NCSA is a translation, and the official version is the Arabic text in Official Gazette No. 15 of 2016, available on Al Meezan. Take advice on how the law applies to your organisation.