The Qatar Financial Centre ("QFC"), a business center located on-shore in Qatar with its own regulations that are separate and distinct from those of the State of Qatar, implemented QFC Regulation No. 6 of 2005 on QFC Data Protection Regulations ("DPL").

Additionally, under the powers granted to the QFC Authority under Article 32(6) of the DPL, the QFC Authority has issued the Data Protection Rules 2005 (DPR).

The QFC updated the DPL and DPR on 6 December 2023. This note reflects the position under the DPL and DPR as amended. As a general comment, the changes provide increased clarity around the DPL and DRP as well as creating certain new obligations and bring the QFC more closely in line with the position under the GDPR and other similar laws, which should assist international businesses in taking a relatively uniform approach to their data compliance activities.

The DPL and DPR apply to the processing of personal data of living natural persons. Such processing may be by automated means or non-automated means. The DPL and DPR apply to data controllers and processors incorporated or registered in the QFC and to those that are not if, as part of ongoing arrangements, the data controller or processor process personal data through a data controller or processor that is incorporated or registered in the QFC unless it does so on an occasional basis.