Qatar Financial Centre issues consultation paper on proposed changes to its data protection regulations

The Qatar Financial Centre Authority (QFCA) has issued a consultation paper requesting feedback on changes it proposes to its Data Protection Regulations (Regulations) and the Data Protection Rules (Rules).

The proposed amendments seek to bring the Qatar financial Centre (QFC) more closely in line with the position under the GDPR and other similar data protection laws, which should assist international businesses operating in the QFC in taking a relatively uniform approach to their data compliance activities, and in turn reduce compliance costs.

What changed?

The most notable changes that the QFCA is seeking to introduce include:

1. further clarity around the applicability of the Regulations and Rules, to personal data pertaining to natural persons, and to processing of that personal data by QFC entities for reasons that do not purely relate to personal or household reasons;
2. clarity on what qualifies as “consent” and how consent can be used as a legal justification for the processing of personal data;
3. new requirements around how QFC entities must communicate with data subjects in relation to their rights;
4. expanding data subjects right to have inaccurate personal data rectified;
5. widening data controllers’ responsibilities in relation to the measures they adopt and implement to ensure compliance with the data protection framework;
6. introducing mandatory requirements on data controllers to ensure that data protection is considered at the start and end of the processing activities;
7. requiring firms to undertake a data protection impact assessment in relation to 'high' risk processing and automated processing activities; and
8. a requirement on firms to notify the QFCA on 'high risk' personal data breaches.

Further details on the changes can be found here.

What next?

The consultation period expires on 15 September 2021.

If you are based in the QFC, responses from QFC Firms can be submitted through the “Consultation Notification” in the QFC Portal under the Legislation & Compliance functionality.

Responses from non-QFC individuals, advisors, businesses and groups or anyone wishing to submit comments, please see here.

DLA Piper’s Middle East Data Protection team has in depth experience in assisting regional and international businesses with their compliance requirements.

Please contact Eamon Holley or Elias Al-Far if you would like further details or require assistance in responding to the QFCA on its consultation paper or any other Middle East data protection law.