Qatar: Employers to comply with a new data protection law
24 February 2017
In November 2016, Qatar announced a new Data Protection Law (Law No. (13) of 2016). Companies in Qatar have to ensure compliance with this law on or before 29 June 2017.
Data and data processing are both very widely defined (as would be expected). Data must be related to an individual whose identity is determined, or is reasonably able to be determined though the data or though linking this data with other data. Compliance with the Data Protection Law is of key importance to HR departments. Specific consent from the employee for processing data should be sufficient to allow compliance in most respects.
However, special permission is required for the processing of sensitive personal data which includes data on ethnicity, children, health, physical and psychological conditions, religious beliefs, marital relationship and criminal offences, some or all of which we would expect most HR departments to be involved in processing. The regulations underpinning the Data Protection Law are not available at the time of writing and it is not clear what this will mean in practice.
In addition, data subjects, including employees, have certain rights under the Data Protection Law including the right to withdraw consent to processing, to be notified of material security breaches, to obtain a copy of their data (for a fee) and to request the deletion or correction of their data.
Implementation of the Immigration Law
Law No. (21) of 2015 came into effect at the end of December last year. The changes brought in by the new law have been widely reported, particularly in relation to changes in the system for exit permits and for expatriates looking to change jobs. Whilst for now the exit permit process remains in the hands of employers, recent announcements from the Ministry of Labour suggest initial restrictions on transfer of sponsorship have been loosened.