Qatar PDPPL readiness check

Qatar’s baseline is the Personal Data Privacy Protection Law — Law No. 13 of 2016, the GCC’s first comprehensive data protection statute: consent-centric processing, transparency duties, a 72-hour breach window under the 2020 guidelines, and fines reaching QAR 5 million. On top of it, the Qatar Central Bank adds the region’s sharpest AI rules for the financial sector: the QCB AI Guideline (4 September 2024) requires prior QCB approval before launching any AI system, an AI-systems register and human oversight, and the QCB Data Handling & Protection Regulation (16 February 2025) sets the data-handling bar for licensed institutions. Twelve questions — the financial-sector ones are marked.