On November 3, 2016, the State of Qatar announced the passage of a new national privacy law.  The law, which requires companies and organizations to protect the personal information they gather from individuals, is the first national-level legal regime governing data protection to be signed into law by a Gulf Cooperation Council (“GCC”) member state.

A draft of the law was first released in 2011 and was approved by Qatar’s Advisory Council and Cabinet earlier this year.  The law is expected to go into effect in approximately six months.  Prior to passage of the new law, Qatar’s legal landscape for privacy and data protection was limited.  The Qatar Financial Centre had a comprehensive framework modeled after EU Directive 95/46/EC, but the framework did not apply at the national level.  Individuals in Qatar were afforded some privacy protections, but the protections were too general and vague to adequately govern the use of electronic data. 

The goal of the new law is to protect the electronic data of individuals by requiring that organizations adhere to basic data protection responsibilities.  This includes ensuring data handlers are properly trained and that necessary precautions are taken to protect personal data from loss, damage or disclosure.  The law broadly defines personal data as any data that alone, or in combination with other data, can be used to reveal the identity of a person.  The law also creates a data breach notification requirement.  Companies that fail to adhere to these rules can face fines up to 5 million Qatar Riyal (approximately US$1.4 million). 

Additionally, the law imposes restrictions on electronic marketing and websites that target children.  Specifically, if a company wishes to make any direct electronic communication with a consumer for the purpose of marketing, the company must obtain the consumer’s prior consent.  A website directed at children must post notices on the website detailing the type of data that is being collected and how it is being used, and the website must obtain the approval of the child’s parents for the use of the data. 

Ultimately, the new data privacy law appears to mark a new legal era in Qatar where privacy and data protection compliance concerns will become key legal considerations in doing business in the Gulf state.  It is likely that we will see similar legal developments in other GCC members.  Saudi Arabia has a similar law pending before its legislature.