Qatar Central Bank Cloud Computing Regulation (2024) 21: Protect data on a need-to-know basis, segregate tenants, protect data at rest, in motion and in memory, keep PII and financial data in Qatar and obtain QCB approval

What does 21 require?

An entity lets service providers reach its information only where the arrangement requires them to know or hold it; segregates its data where the arrangement uses a multi-tenant environment; implements technical and process controls protecting the integrity and confidentiality of data at rest, in motion and resident in memory as the Sector-Specific Security Regulations define; processes PII and financial information within Qatar only; obtains QCB approval before entering a cloud arrangement; and, when personal data is processed in the cloud, complies with all applicable personal data law and requires the CSP to comply with the same requirements as apply to the entity.