Back to Frameworks

Qatar DPL

Self-Assess
Qatar
vLaw No. 13 of 2016 (issued 3 November 2016); NCGAA guidelines v2.0 September 2022
4 domains
19 controls

Qatar's Law No. 13 of 2016 on Protecting Personal Data Privacy (PDPPL), the first national data protection law in the Gulf, administered today by the National Cyber Security Agency's National Data Privacy Office: processing only on consent or necessity for a lawful purpose; the rights to withdraw consent, object, have data erased or corrected, be notified of processing and of disclosures of inaccurate data, and obtain a copy; controller duties of honest processing, privacy by design, precautions and policies, a privacy notice before processing, relevance, accuracy and retention limits, and the eight article 11 procedures (pre-processing review, processor identification and monitoring, training, complaints and rights systems, a personal data management system with breach reporting, direct-access technologies, audits); security precautions on controller and processor with processor-to-controller breach notice; notification of the individual and the regulator of breaches that may cause serious damage; no restriction of cross-border flows unless unlawful or seriously harmful; a permit for special-nature data (ethnic origin, children, health, religion, marital relations, criminal offences); duties on websites addressing children; and prior consent for electronic direct marketing. Fines up to QAR 1,000,000 and QAR 5,000,000. The NCGAA guidelines add the 30-calendar-day response to rights requests and the DPIA where processing may cause serious damage.

Verified

Qatar DPL is a compliance framework from Qatar with 4 domains and 19 controls that map to 119 other frameworks. The largest domains are Chapter Three: Liabilities of controller and processor – Qatar DPL (13 controls), Chapter Two: Rights of individuals – Qatar DPL (3 controls), Chapter Four: Personal data of a special nature and children – Qatar DPL (2 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

Chapter Four: Personal data of a special nature and children – Qatar DPL

2 controls
Controls in the Chapter Four: Personal data of a special nature and children – Qatar DPL domain of Qatar DPL: 2 controls
CodeTitle
qatar-dpl::16Personal data of a special nature: permit from the Competent Department
qatar-dpl::17Websites addressing children

Chapter Six: Electronic communication for direct marketing – Qatar DPL

1 controls
Controls in the Chapter Six: Electronic communication for direct marketing – Qatar DPL domain of Qatar DPL: 1 controls
CodeTitle
qatar-dpl::22Electronic direct marketing only with prior consent, identified and with an opt-out address

Chapter Three: Liabilities of controller and processor – Qatar DPL

13 controls
Controls in the Chapter Three: Liabilities of controller and processor – Qatar DPL domain of Qatar DPL: 13 controls
CodeTitle
qatar-dpl::10Relevance, adequacy, accuracy and retention
qatar-dpl::11(1)Review of privacy protection measures before new processing (DPIA)
qatar-dpl::11(2)-(8)Identification and verification of processors
qatar-dpl::11(3)Training and awareness of processors and staff
qatar-dpl::11(4)-(6)Internal systems and technologies for complaints, rights requests and direct access
qatar-dpl::11(5)Personal data management system and internal breach reporting
qatar-dpl::11(7)Comprehensive audits and reviews of compliance
qatar-dpl::12Disclosure or transfer to a processor in line with lawful purposes
qatar-dpl::13Security precautions by controller and processor, and processor breach notification
qatar-dpl::14Notification of the individual and the Competent Department of a breach
qatar-dpl::15No restriction of cross-border data flows except where unlawful or seriously harmful
qatar-dpl::8Honest and legitimate processing, privacy by design, precautions and privacy policies
qatar-dpl::9Information to the individual before processing (privacy notice)

Chapter Two: Rights of individuals – Qatar DPL

3 controls
Controls in the Chapter Two: Rights of individuals – Qatar DPL domain of Qatar DPL: 3 controls
CodeTitle
qatar-dpl::4Consent or lawful purpose as the basis of processing
qatar-dpl::5Withdrawal of consent, objection, erasure and correction
qatar-dpl::6Access, notification of processing and disclosure of inaccurate data, and copies

Your Compliance Coverage

If you comply with Qatar DPL, you already cover:

Vietnam PDPD

19%

5 controls mapped

Compare →

Vietnam Law on Cybersecurity (No. 116/2025/QH15)

19%

5 controls mapped

Compare →

Turkey KVKK

19%

5 controls mapped

Compare →

+ 116 more: Barbados Data Protection Act 2019 (19%), Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) (19%)

See all 119 mapped frameworks ↓

Maps to 119 other frameworks

27 total controls
Vietnam PDPD
5 source controls mapped|3 target controls covered
19%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
5 source controls mapped|3 target controls covered
19%
Turkey KVKK
5 source controls mapped|3 target controls covered
19%
Barbados Data Protection Act 2019
5 source controls mapped|7 target controls covered
19%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
5 source controls mapped|9 target controls covered
19%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
5 source controls mapped|23 target controls covered
19%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
5 source controls mapped|9 target controls covered
19%
South Korea ISMS-P
5 source controls mapped|8 target controls covered
19%
Bahrain PDPL
5 source controls mapped|13 target controls covered
19%
TEFCA - Trusted Exchange Framework and Common Agreement
4 source controls mapped|1 target controls covered
15%
APPI
4 source controls mapped|9 target controls covered
15%
ISO/IEC 27400:2022
4 source controls mapped|7 target controls covered
15%
AICPA Privacy Management Framework (PMF)
4 source controls mapped|6 target controls covered
15%
COSO Internal Control - Integrated Framework (2013)
4 source controls mapped|4 target controls covered
15%
UK Open Banking Standard
4 source controls mapped|5 target controls covered
15%
FTC GLBA Safeguards Rule (16 CFR Part 314)
4 source controls mapped|3 target controls covered
15%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
3 source controls mapped|2 target controls covered
11%
Russia Federal Law on Personal Data (152-FZ)
3 source controls mapped|2 target controls covered
11%
Albania Law No. 124/2024 on Personal Data Protection
3 source controls mapped|3 target controls covered
11%
Australian Privacy Principles (APPs)
3 source controls mapped|4 target controls covered
11%
GDPR
3 source controls mapped|10 target controls covered
11%
Authorised Economic Operator (AEO) Programmes - Global Standards
3 source controls mapped|3 target controls covered
11%
Armenia Law on Protection of Personal Data (2015)
3 source controls mapped|3 target controls covered
11%
Azerbaijan Law on Personal Data (2010)
3 source controls mapped|4 target controls covered
11%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
3 source controls mapped|4 target controls covered
11%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
3 source controls mapped|5 target controls covered
11%
BSI IT-Grundschutz
3 source controls mapped|10 target controls covered
11%
IEC 62443
3 source controls mapped|7 target controls covered
11%
NIST SP 1800-32
3 source controls mapped|7 target controls covered
11%
NIST SP 800-53 Rev 5
3 source controls mapped|12 target controls covered
11%
API 1164
3 source controls mapped|7 target controls covered
11%
ISO/IEC 27019:2024
3 source controls mapped|7 target controls covered
11%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
3 source controls mapped|4 target controls covered
11%
Annex 11 to EU GMP - Computerised Systems
3 source controls mapped|3 target controls covered
11%
ITU-T X.805 - Security Architecture for End-to-End Communications
3 source controls mapped|2 target controls covered
11%
NIST Cybersecurity Framework 2.0
3 source controls mapped|6 target controls covered
11%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
3 source controls mapped|3 target controls covered
11%
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
3 source controls mapped|4 target controls covered
11%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
3 source controls mapped|2 target controls covered
11%
APRA CPS 230 Operational Risk Management
3 source controls mapped|2 target controls covered
11%
EASA Part-IS - Information Security in Aviation
3 source controls mapped|5 target controls covered
11%
SANS Incident Handler's Handbook and PICERL Methodology
3 source controls mapped|4 target controls covered
11%
ASIS SPC.1-2009 - Organizational Resilience Standard
3 source controls mapped|2 target controls covered
11%
NIST SP 800-190
3 source controls mapped|6 target controls covered
11%
ASD Strategies to Mitigate Cyber Security Incidents
3 source controls mapped|4 target controls covered
11%
Regulation on the European Health Data Space (EHDS)
2 source controls mapped|4 target controls covered
7%
Voluntary Principles on Security and Human Rights (VPs)
2 source controls mapped|1 target controls covered
7%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
2 source controls mapped|2 target controls covered
7%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
2 source controls mapped|1 target controls covered
7%
Singapore Cybersecurity Act 2018
2 source controls mapped|1 target controls covered
7%
Protective Security Policy Framework (PSPF) Release 2026
2 source controls mapped|3 target controls covered
7%
PSD2 SCA
2 source controls mapped|4 target controls covered
7%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
2 source controls mapped|5 target controls covered
7%
ISO/IEC 27010:2015
2 source controls mapped|4 target controls covered
7%
ISO 27799:2025
2 source controls mapped|9 target controls covered
7%
ISO 28001:2007 Supply Chain Security Management
2 source controls mapped|2 target controls covered
7%
ISO/IEC 27011:2024
2 source controls mapped|6 target controls covered
7%
FFIEC Cybersecurity Assessment Tool (CAT)
2 source controls mapped|3 target controls covered
7%
ISO/IEC 20000-1:2018
2 source controls mapped|2 target controls covered
7%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
2 source controls mapped|5 target controls covered
7%
ITIL 4
2 source controls mapped|2 target controls covered
7%
ICAO Annex 17 - Aviation Security (AVSEC)
2 source controls mapped|2 target controls covered
7%
FFIEC IT Examination Handbook
2 source controls mapped|5 target controls covered
7%
PCI PIN Security
2 source controls mapped|5 target controls covered
7%
PCI P2PE
2 source controls mapped|5 target controls covered
7%
PCI SSF
2 source controls mapped|5 target controls covered
7%
Canada ITSG-33 - IT Security Risk Management
2 source controls mapped|1 target controls covered
7%
ISO 22320:2018
2 source controls mapped|3 target controls covered
7%
APRA CPS 234
2 source controls mapped|2 target controls covered
7%
ISO/IEC 30111:2019
2 source controls mapped|2 target controls covered
7%
Nevada Gaming Control Board Cybersecurity Requirements
2 source controls mapped|1 target controls covered
7%
FBI CJIS Security Policy
2 source controls mapped|3 target controls covered
7%
Vermont Data Privacy and Online Surveillance Act
2 source controls mapped|3 target controls covered
7%
South Africa Promotion of Access to Information Act (PAIA)
2 source controls mapped|1 target controls covered
7%
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
2 source controls mapped|1 target controls covered
7%
Connecticut Data Privacy Act (CTDPA)
2 source controls mapped|1 target controls covered
7%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
2 source controls mapped|6 target controls covered
7%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
2 source controls mapped|3 target controls covered
7%
ISO/IEC 29134:2023
2 source controls mapped|3 target controls covered
7%
Azure Security Benchmark
2 source controls mapped|1 target controls covered
7%
ISO/IEC 29100:2024
2 source controls mapped|3 target controls covered
7%
ISO/IEC 23894:2023
2 source controls mapped|5 target controls covered
7%
Florida Digital Bill of Rights (FDBR)
2 source controls mapped|2 target controls covered
7%
Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)
2 source controls mapped|1 target controls covered
7%
IAIS Insurance Core Principles (ICPs)
1 source controls mapped|1 target controls covered
4%
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)
1 source controls mapped|1 target controls covered
4%
PTES
1 source controls mapped|2 target controls covered
4%
ISO/IEC 27043:2015
1 source controls mapped|7 target controls covered
4%
IEC 62351 - Power Systems Communication Security
1 source controls mapped|2 target controls covered
4%
ISO/SAE 21434
1 source controls mapped|7 target controls covered
4%
IATA Operational Safety Audit (IOSA) Standards Manual
1 source controls mapped|1 target controls covered
4%
FedRAMP Rev 5
1 source controls mapped|3 target controls covered
4%
ISO/IEC 23837:2023
1 source controls mapped|3 target controls covered
4%
OWASP SAMM
1 source controls mapped|1 target controls covered
4%
FIDO2 / WebAuthn
1 source controls mapped|1 target controls covered
4%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
1 source controls mapped|1 target controls covered
4%
ISO 8000 - Data Quality
1 source controls mapped|1 target controls covered
4%
Section 508 - ICT Accessibility (Revised)
1 source controls mapped|2 target controls covered
4%
Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018)
1 source controls mapped|1 target controls covered
4%
ISO 14001:2015
1 source controls mapped|1 target controls covered
4%
ISO 45001:2018
1 source controls mapped|1 target controls covered
4%
FedRAMP High
1 source controls mapped|1 target controls covered
4%
FedRAMP Moderate
1 source controls mapped|1 target controls covered
4%
ISO 22000:2018
1 source controls mapped|2 target controls covered
4%
SQF Code Edition 9 - Safe Quality Food
1 source controls mapped|2 target controls covered
4%
ISO/IEC 27031:2011
1 source controls mapped|1 target controls covered
4%
ISO 26262:2018 - Functional Safety for Road Vehicles
1 source controls mapped|1 target controls covered
4%
ISO/IEC 27003:2017
1 source controls mapped|1 target controls covered
4%
ISO/IEC 29147:2018
1 source controls mapped|1 target controls covered
4%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
4%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
1 source controls mapped|2 target controls covered
4%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
1 source controls mapped|1 target controls covered
4%
Kuwait National Cybersecurity Framework
1 source controls mapped|1 target controls covered
4%
French Sapin II Law (Law No. 2016-1691)
1 source controls mapped|2 target controls covered
4%
ISO 26000:2010
1 source controls mapped|1 target controls covered
4%
ISO/IEC 25012:2008 - Data Quality Model
1 source controls mapped|3 target controls covered
4%
Nebraska Data Privacy Act
1 source controls mapped|2 target controls covered
4%
South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics
1 source controls mapped|1 target controls covered
4%
Singapore AI Governance Framework
1 source controls mapped|1 target controls covered
4%
Compare Qatar DPL with Vietnam PDPD

Coverage is not the same as your position

This page shows what Qatar DPL overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Qatar DPL and who does it apply to?

Qatar DPL is a compliance framework from Qatar with 4 domains and 19 controls. Qatar's Law No. 13 of 2016 on Protecting Personal Data Privacy (PDPPL), the first national data protection law in the Gulf, administered today by the National Cyber Security Agency's National Data Privacy Office: processing only on consent or necessity for a lawful purpose; the rights to withdraw consent, object, have data erased or corrected, be notified of processing and of disclosures of inaccurate data, and obtain a copy; controller duties of honest processing, privacy by design, precautions and policies, a privacy notice before processing, relevance, accuracy and retention limits, and the eight article 11 procedures (pre-processing review, processor identification and monitoring, training, complaints and rights systems, a personal data management system with breach reporting, direct-access technologies, audits); security precautions on controller and processor with processor-to-controller breach notice; notification of the individual and the regulator of breaches that may cause serious damage; no restriction of cross-border flows unless unlawful or seriously harmful; a permit for special-nature data (ethnic origin, children, health, religion, marital relations, criminal offences); duties on websites addressing children; and prior consent for electronic direct marketing. Fines up to QAR 1,000,000 and QAR 5,000,000. The NCGAA guidelines add the 30-calendar-day response to rights requests and the DPIA where processing may cause serious damage. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Qatar DPL actually require?

Qatar DPL has 19 controls organised across 4 domains. The largest domains are Chapter Three: Liabilities of controller and processor – Qatar DPL (13 controls), Chapter Two: Rights of individuals – Qatar DPL (3 controls), Chapter Four: Personal data of a special nature and children – Qatar DPL (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Qatar DPL do I already cover?

Qatar DPL maps to 119 other compliance frameworks. The top mapping partners are Vietnam PDPD (19% coverage), Vietnam Law on Cybersecurity (No. 116/2025/QH15) (19% coverage), Turkey KVKK (19% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Qatar DPL?

Start your Qatar DPL compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Qatar DPL requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 19 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required