What Is Law No. 13 of 2016 on Protecting Personal Data Privacy?
Qatar's Law No. 13 of 2016 on Protecting Personal Data Privacy, dated 3 November 2016, is listed as in application on the Al Meezan legal portal and was published in Official Gazette issue 15 on 29 December 2016. Articles 5 and 6 give rights to withdraw prior consent, object where processing is unnecessary, excessive, discriminatory, unfair, or illegal, request omission/erasure in the cases specified by Article 5, request correction, access and review personal data, receive notice of processing purposes, and obtain a copy for a fee not exceeding service cost. Article 22 prohibits electronic direct-marketing communications without prior consent and requires sender identification and a way to stop communications or withdraw consent. Article 26 lets a person complain to the law's 'Competent Department' for a violation; current official materials identify that department as the National Data Privacy Office (NDPO) within the National Cyber Security Agency (NCSA). NCSA's individual-complaints guidance directs a person to first give the controller an opportunity to resolve the issue (with a template 30-day controller response) before raising the concern with NCSA's privacy/compliance function. This is a source-backed evidence profile. The law's Arabic text on Al Meezan controls; the English text is a reference translation. No Qatar-specific data-broker register or people-search opt-out route was located.
At a glance
- Full name
- Law No. 13 of 2016 on Protecting Personal Data Privacy
- Short code
- Qatar Law No. 13 of 2016
- Jurisdiction
- Qatar
- Enacted
- 2016
- Last major update
- In application since Official Gazette issue 15 (29 December 2016); no amendment located in the 5 September 2026 review
- Regulator
- National Data Privacy Office (NDPO) within the National Cyber Security Agency (NCSA)
- Private right of action
- Limited
- Statutory citation
- Law No. 13 of 2016 on Protecting Personal Data Privacy
Scope, who Qatar Law No. 13 of 2016 covers
Protected data
Data subject rights
Withdraw prior consent (Article 5)
Object where processing is unnecessary, excessive, discriminatory, unfair, or illegal (Article 5)
Request omission/erasure in the cases specified by Article 5
Request correction with supporting proof (Article 5)
Access and review personal data, and receive notice of processing and its purposes (Articles 5–6)
Obtain a copy of personal data for a fee not exceeding service cost (Article 6)
Stop electronic direct-marketing communications or withdraw consent to them (Article 22)
Notable features
The National Data Privacy Office (NDPO) sits within the National Cyber Security Agency (NCSA) rather than as a freestanding data-protection commission, reflecting Qatar’s cybersecurity-integrated regulatory structure.
Enforcement & penalties
Regulator: National Data Privacy Office (NDPO) within the National Cyber Security Agency (NCSA)
Penalties: The reviewed Al Meezan and NCSA materials for this research pass focused on rights and the complaint route rather than a consolidated fine schedule; verify current penalty provisions against the Arabic Gazette text before publication.
Private right of action: Article 26 lets an individual complain to the Competent Department, which may investigate and issue a reasoned, binding corrective decision; the Article’s 60-day periods concern a controller/processor grievance to the Minister, not a stated individual-complaint deadline.
Relevance to data brokers
No Qatar-specific data-broker register, people-search opt-out, or broker-specific public-record suppression route was located. The general controller-first complaint route and the direct-marketing stop/consent-withdrawal mechanism are the located routes; neither is a broker-specific removal mechanism.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Which language controls Qatar’s personal-data privacy law?+
The Arabic legal record on Al Meezan; the English text is a reference translation, and no source located this pass expressly states a controlling-language rule.
Who supervises Qatar’s data-privacy law?+
The National Data Privacy Office (NDPO) within the National Cyber Security Agency (NCSA), per current official reporting identifying NDPO as the competent department under Article 26.
Official sources & citations
Other international privacy regimes
Qatar Law No. 13 of 2016 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: