Privacy policy under the Personal Data Privacy Protection Law (PDPPL, Law No. 13 of 2016), in force since 2017 — the first national data-protection law in the Gulf, regulated by the National Data Privacy Office (NDPO) within the National Cyber Security Agency (NCSA); fines up to QAR 1 million, up to QAR 5 million for sensitive/children's data.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY (سياسة الخصوصية) — PDPPL
Legal entity name (Commercial Registration No. Commercial Registration (CR) number)
This policy is issued under the Personal Data Privacy Protection Law (PDPPL, Law No. 13 of 2016), in force since 2017 — the first national data-protection law in the Gulf. The regulator is the National Data Privacy Office (NDPO), part of the National Cyber Security Agency (NCSA, formerly under the Compliance & Data Protection Department of MOTC).
1. DATA WE COLLECT 1.1. Categories of data collected
2. WHY WE COLLECT IT 2.1. Purposes of processing 2.2. Legal basis: Legal basis — consent is the default legal basis under PDPPL; direct marketing is prohibited without prior consent.
3. RETENTION 3.1. Retention period
4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors
5. CROSS-BORDER TRANSFER 5.1. Cross-border transfer
6. DATA BREACH NOTIFICATION 6.1. Data breach notification procedure — regulator guidelines call for notification of a personal data breach within 72 hours.
7. CONTACT AND RIGHTS 7.1. Data protection contact: Data protection contact. 7.2. Data subject rights and request channel: Data subject rights and request channel. 7.3. Enhanced protection applies to children's data and other sensitive categories; violations can carry fines of up to QAR 1 million (up to QAR 5 million for sensitive data or children's data).
8. QFC NOTE 8.1. QFC carve-out — entities licensed in the Qatar Financial Centre (QFC) are subject to the QFC Data Protection Regulations instead of PDPPL.
Version date: Policy version date
— — — ⚠️ This is a boilerplate template, not legal advice. It is written under the Qatar Labor Law (Law No. 14 of 2004, as amended by the kafala-reform Laws No. 17, 18 and 19 of 2020 and by Law No. 9 of 2026) and related regulations and authorities (Ministry of Labour — MOL, formerly MADLSA/ADLSA; MOCI; MOPH; Baladiya municipalities; Qatar Tourism; PDPPL/NDPO-NCSA; the Wage Protection System) as in effect in July 2026 — these regulations and digital platforms change frequently; verify against the current text before use. Have this template reviewed by a Qatar-qualified lawyer and, for HR documents, checked against your own MOL/MADLSA-approved internal work regulation (اللائحة الداخلية) before use.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
Regulator guidance: notify within 72 hours
1 of 13 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.