Qatar: what the rules require

The policy must identify the controller, the purposes and description of processing, recipients or disclosures, retention, and data subject rights, and be available before or at the time data is collected.

Basis: Saudi PDPL Article 12 (privacy policy before collection); DIFC Law Articles 29 and 30; Oman Executive Regulations (notice before processing, including DPO details); Qatar PDPPL (notice before processing); ADGM and UAE PDPL transparency duties.

How to meet it: Open the policy with the legal name and contact details of the controller, then list purposes, data categories, recipients, retention periods and rights. For Saudi users publish it in Arabic and English and make it available before any data is collected.

The policy must state the lawful basis relied on for each processing purpose, such as consent, contract, legal obligation or, where available, legitimate interests.

Basis: DIFC Law Article 29 requires notices to state the lawful basis; UAE PDPL Articles 4 to 6 set consent plus listed exceptions with no general legitimate interests basis; Saudi PDPL Article 5 makes consent the default basis unless an exception applies.

How to meet it: Add a table mapping each purpose to its lawful basis. Do not cite legitimate interests for onshore UAE, Saudi or Oman processing unless the law expressly allows that ground.

Where consent is used, the policy must tell people they can withdraw consent at any time, explain how, and state that withdrawal does not affect earlier lawful processing.

Basis: Saudi PDPL Article 5(2); DIFC Law Articles 12(5) and 32; UAE PDPL consent provisions; Bahrain Resolution No. 48 of 2022 (withdrawal at any time without cost); Qatar PDPPL (right to withdraw approval); Oman PDPL (right to revoke consent).

How to meet it: Add a sentence such as: You can withdraw your consent at any time, free of charge, by [method]; this does not affect processing carried out before withdrawal. Set up an internal procedure to act on requests.

The policy must explain that individuals can request access to, or a copy or summary of, their personal data and how it is processed, and how to submit that request.

Basis: DPDP Act Section 11; UAE PDPL Articles 13 to 18; DIFC Law Article 33(1) (free, within one month); Saudi PDPL Article 4; Qatar PDPPL (right to review); Oman PDPL (right to obtain a copy); ADGM and Bahrain PDPL access rights.

How to meet it: List access as a named right with the request channel, identity checks and expected response time, for example one month in DIFC and 30 days under Qatar guidelines.

The policy must explain how individuals can ask for inaccurate data to be corrected or updated and for data to be erased, and when erasure may be refused.

Basis: DPDP Act Section 12; DIFC Law Article 33(2); Saudi PDPL Article 4; UAE PDPL Articles 13 to 18; Qatar PDPPL (alter or delete); Oman PDPL (rectify, update, erase, block); ADGM rights to correction and deletion.

How to meet it: Add named sections for correction and erasure, the request method, and the legal grounds for refusing erasure (for example legal retention duties).

The policy must explain the right to object to certain processing and, where available, to restrict processing, and how to exercise it.

Basis: DIFC Law Articles 34 and 35; UAE PDPL Articles 13 to 18 (restriction and objection); ADGM rights to restrict and object; Qatar PDPPL (objection to unnecessary or discriminatory processing); Bahrain PDPL (right to object in certain circumstances).

How to meet it: Add a short section on objecting and restricting processing, including an unconditional right to object to direct marketing where applicable.

The policy must state that children's data is processed only with the consent of a parent or guardian and, in Oman, only for a clear and safe purpose using the minimum data needed.

Basis: Qatar PDPPL requires explicit parental consent and treats children's data as special nature data; Oman PDPL and Executive Regulations require express parental consent and processing in the child's best interest.

How to meet it: Add a children's section that states the age threshold, how parental consent is obtained and checked, and that only the minimum data is collected.

The policy must state how long each category of data is kept, or the criteria used, and that data is deleted or anonymised once no longer needed.

Basis: Saudi PDPL Article 18 (destroy data when no longer necessary); DIFC Law Article 22 (delete, anonymise or archive when the basis ends); Oman PDPL fines retention violations; UAE PDPL, ADGM, Qatar and Bahrain storage limitation duties.

How to meet it: Add a retention table by data category with periods or criteria, plus the method of secure deletion or anonymisation at the end of the period.

The policy must describe the technical and organisational measures used to protect personal data, such as encryption, access control, logging, backups and staff confidentiality.

Basis: DPDP Act Section 8(5) and Rule 6; Saudi PDPL Article 19; Qatar PDPPL Article 13 (cited by NCSA in Binding Decision No. 3 of 2025); DIFC, ADGM, UAE, Bahrain and Oman security obligations.

How to meet it: Add a security section naming the main controls (encryption in transit and at rest, role-based access, logging and monitoring, backups, staff training). Avoid absolute promises such as 100 percent secure.

The policy must commit to notifying the regulator within 72 hours of becoming aware of a qualifying breach (ADGM Commissioner, SDAIA, Qatar NCSA, Bahrain PDPA or Oman MTCIT) and to informing affected individuals.

Basis: ADGM Data Protection Regulations 2021; Saudi PDPL Article 20 and Implementing Regulations (via the National Data Governance Platform); Qatar regulator guidelines and PDPPL Article 14; Bahrain Resolution No. 43 of 2022; Oman Executive Regulations (individuals also within 72 hours where severe harm is likely).

How to meet it: Add a breach clause with a 72-hour regulator deadline, the named regulator for each country, reasons for any delay and notice to affected individuals. For Oman, also tell individuals within 72 hours when severe damage is likely.

The policy framework must commit to maintaining a written record of processing activities covering purposes, data categories, recipients, transfers and retention.

Basis: UAE PDPL Articles 7(4) and 8(7); DIFC Law Article 15; ADGM Regulations; Saudi PDPL Article 31 (records kept for five years after processing ends); Qatar regulator guidelines; Oman Executive Regulations.

How to meet it: Add an accountability statement that the company maintains a record of processing activities, reviews it regularly and, for Saudi operations, keeps records for five years after processing ends.

The policy framework must require a data protection impact assessment before high-risk processing, new technologies, large-scale sensitive data or data exports.

Basis: UAE PDPL Article 21; DIFC Law Article 20; ADGM Regulations; Saudi PDPL Article 22; Qatar regulator guidelines (failure reported to attract a QAR 1 million fine).

How to meet it: State when a DPIA is triggered (high risk, new technology, sensitive data at scale, transfers), who approves it, and that it is completed before processing starts.

The policy must explain which cookies and trackers are used, their purposes and providers, and how users accept, refuse or withdraw consent for non-essential ones.

Basis: No dedicated cookie law was verified in these jurisdictions (DLA Piper confirms none in Saudi Arabia), so general notice and consent rules apply; Bahrain Resolution No. 48 of 2022 says consent required as a condition of browsing is invalid, and DPDP Section 9(3) bans tracking of children.

How to meet it: Add a cookie section or separate cookie policy listing cookies by category, purpose, provider and duration, with a banner that lets users refuse non-essential cookies as easily as they accept them.

The policy must identify any sensitive data processed, such as health, biometric, genetic, religious, ethnic, criminal or (in Saudi Arabia) credit and location data, and the extra conditions and safeguards applied.

Basis: DIFC Law Article 11; UAE PDPL sensitive data rules; Saudi PDPL Articles 23 and 24 (health and credit data controls) and Article 26 (no marketing use of sensitive data); ADGM policy document duty; Bahrain PDPL Article 5; Qatar and Oman special data rules.

How to meet it: List each sensitive category processed with its purpose, legal condition (often explicit consent) and extra safeguards such as restricted access.

Where sensitive or restricted data is processed, the policy must state that the required regulator permit or prior approval has been obtained.

Basis: Qatar PDPPL (special nature data needs regulator authorisation); Bahrain Resolution No. 44 of 2022 under PDPL Article 15 (biometrics, non-medical genetics, linking data sets, surveillance recording); Oman Executive Regulations (MTCIT permit, 45-day decision, valid five years).

How to meet it: Record the permit or approval reference and validity date for each restricted activity, and state in the policy that such processing happens only under regulator approval.

The policy must state that direct marketing is sent only with prior consent, identifies the sender, and includes an easy way to unsubscribe.

Basis: Saudi PDPL Articles 25 and 26; UAE PDPL (direct marketing requires consent); Qatar PDPPL (approval and sender identity); Oman Executive Regulations (written consent and unsubscribe mechanism).

How to meet it: Add a marketing section stating that you send marketing only with prior consent, that every message identifies the sender and that users can unsubscribe at any time via a link or reply.