PDPPL compliance in Qatar: what your software must support

PDPPL compliance in Qatar is not something software can deliver on its own, but the systems you build or buy decide how easy it is. Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016, expects organisations to process personal data lawfully, transparently and securely. This guide turns that into features to ask for: consent records, request handling, access controls, breach logs and retention rules.

This is a practical guide for software buyers, not legal advice. Confirm your obligations with your legal adviser and the competent authority.

What does the PDPPL mean for a software project?

In practice, it means every system that holds personal data must let you show what data you hold, why you hold it, who can see it and when it will be deleted. Customer portals, HR systems, clinic software, delivery apps and CRMs are all in scope when they process personal data.

The law sets duties for controllers, the organisations that decide why data is processed, and processors, such as software and hosting providers acting on their behalf. Guidelines have been issued to explain how controllers and processors should apply it. If your business operates in the Qatar Financial Centre, a separate QFC data protection regime applies, so check which rules cover you.

The cheapest time to address all this is during discovery. Adding privacy features to a live system means data migration, retesting and retraining.

Which personal data rights must your system support?

Your system should let staff find, export, correct and delete one person's data on request, and record what was done. Under the PDPPL, individuals can withdraw consent, object to processing in certain cases, ask for correction and erasure, and ask to access their data.

• A search that finds every record linked to one person across modules
• An export of that person's data in a readable format
• Editing with an audit trail that shows old and new values
• Deletion or anonymisation that respects records you must keep for other legal reasons
• A request log with dates, the staff member handling it and the outcome
• Consent withdrawal that actually stops the related processing, such as marketing messages

Retention belongs in the same design. Decide how long each type of record is kept, which records must be kept for accounting, employment or other legal reasons, and what happens at the end of the period. A scheduled job that deletes or anonymises expired records, with a report of what it removed, is far more reliable than a reminder in someone's calendar. Confirm the retention periods with your adviser before they are built.

How should consent and privacy notices be handled?

Record consent as data, not as a ticked box that disappears. Store who consented, to what, when, through which channel and against which version of the notice.

Direct marketing needs particular care. Guidance on the PDPPL expects prior consent for electronic direct marketing, and messages should identify the sender and offer an easy way to opt out. For websites, the guidelines expect marketing cookies to be set only after the visitor opts in. Your cookie banner, sign-up forms and messaging tools should all read from the same consent record. Publish privacy notices in Arabic and English, written in plain language.

What about health, children's and other sensitive data?

Treat it as a separate category with tighter controls. The PDPPL defines personal data of a special nature, which includes health data, children's data, religious beliefs and criminal records, and processing it generally requires prior permission from the competent authority.

For software, that means restricting these fields to specific roles, logging every view, and keeping them out of exports and test environments by default. Clinics, schools and HR systems hold this kind of data daily. Our page on healthcare software for Qatar explains how patient records are handled in the systems we build. Confirm with your adviser what permission your organisation needs before processing starts.

What security controls should be built in?

Build security into the first release, because the PDPPL expects controllers to take appropriate precautions to protect personal data. Use this checklist when you review a proposal or an existing system:

• Role-based access, so each user sees only the data their job needs
• Multi-factor authentication for administrators and remote access
• Encryption in transit and at rest, including backups
• Audit logs of logins, views, edits, exports and deletions
• Separate development, test and live environments, with masked data outside live
• Automatic session time-outs and password rules
• Supplier access that is named, time-limited and logged
• A breach register that records what happened, which data was affected and who was informed
• Alerts for unusual activity, such as large exports or repeated failed logins

Serious breaches may have to be reported to the authority and to the people affected, and the guidelines expect this to happen promptly. Agree in advance who decides, who notifies and how the software helps you find out what was exposed. Check the current notification deadline with your adviser.

Where should the data be hosted?

The PDPPL generally allows personal data to move across borders, so hosting outside Qatar is not automatically a problem. Sector rules, government contracts and customer requirements can still require data to stay in the country.

Major cloud providers operate data centre regions in Qatar, which makes local hosting straightforward when it is required. Decide the hosting location in discovery, write it into the scope, and make sure the cloud account is in your company's name so you control where the data lives.

What drives the cost of privacy features, and what are the trade-offs?

Privacy features cost the most when data is scattered across many systems and the least when one well-designed system holds it. The main cost drivers are:

• The number of systems that hold personal data and need to be searched or linked
• Whether special-nature data is involved, which adds access rules and logging
• Data migration from old systems with duplicate or incomplete records
• Retention rules that differ by record type
• Integrations with marketing, messaging and analytics tools that also hold personal data
• The depth of audit logging and how long logs are kept

The main trade-off is between convenience and control. Broad access is easier for staff and harder to defend. Keeping everything forever is simpler and increases risk.

For example, a recruitment agency in Doha might hold candidate CVs in email, a spreadsheet and a job board account. Before building a candidate portal, the sensible first step is to map where the data sits today, decide which system becomes the single record, and set retention rules for unsuccessful candidates. The portal then enforces those rules instead of adding a fourth copy.

How is a privacy-aware software project usually run?

We start with video-call workshops that map the personal data the system will hold, who uses it and why. The written scope lists the data fields, roles, retention rules and hosting location alongside the features, so privacy is priced in from the start.

A named lead engineer runs delivery in two-week sprints, with a demo at the end of each one. Releases are phased so the core records and access rules go live first. Testing includes role and permission checks, not just features, and our quality assurance team uses masked data. At handover, the code and cloud accounts are registered to you, with documentation of roles and data flows. Read more about custom software development and our approach for Qatari companies.

Frequently asked questions

Does the PDPPL apply to small businesses?

The PDPPL is not limited to large organisations. If your business processes personal data, review your obligations with an adviser, whatever your size.

Can our data be hosted outside Qatar?

Often, yes, as the law generally permits cross-border transfers. Check sector rules, contracts and any special-nature data first, and confirm with your adviser.

Is a privacy policy on the website enough?

No. The notice must match what your systems actually do, and the systems must support consent, requests, access control and security.

If you want to review an existing system or plan a new one with privacy built in, talk to us and we will walk through the data flows with you.