My company works in Qatar. What does the law ask of us when an AI agent reads our data?
The short answer
Law No. 13 of 2016 on Protecting Personal Data Privacy applies. Consent is the default basis, unless the processing is necessary for a legitimate purpose. The law does not stop data from crossing borders, but every other duty stays with you, and data of a special nature needs a permit before you process it. Fines reach 5 million riyals. I found no Qatari AI law as of October 2026.
The law that applies
Law No. 13 of 2016 on Protecting Personal Data Privacy was published in the Official Gazette on 29 December 2016. It gave companies 6 months to comply, and a Cabinet decision of January 2018 extended that window by 6 more months from 29 July 2017. The law covers personal data that is processed electronically, or collected so that it can be processed electronically. It does not cover processing by individuals for personal or family purposes.
The law gives its powers to a department of the Ministry of Transport and Communications. In 2021 an Amiri decision created the National Cyber Security Agency, NCSA, and listed among its tasks implementing the laws, regulations and decisions on personal data privacy.
Companies in the Qatar Financial Centre, a financial free zone, also have their own Data Protection Regulations 2021, supervised by the centre’s Data Protection Office. If your company sits there, read those regulations too.
Can the agent read personal data at all?
Yes, with consent, or without it if the processing is necessary to achieve a legitimate purpose of your company or of the party the data is sent to. The person may withdraw consent at any time. They may also object to processing that is not necessary for its purpose, that goes beyond what the purpose needs, or that is discriminatory, unfair or unlawful.
Three rules matter most for an agent:
- Review before you add new processing. The law requires you to review your privacy procedures before you introduce new processing operations. Connecting an agent to your data is a new processing operation.
- Only what the purpose needs. The data must be relevant to the purpose and sufficient for it, and you may not keep it longer than the purpose needs.
- Data of a special nature. This covers ethnic origin, children, health or physical or psychological condition, religious beliefs, marital relationship and criminal offences. You may process it only after you obtain a permit from the competent department.
The law has no article on decisions made only by machine.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider processes that data on your behalf. The law requires you to check that the provider follows your instructions and protects the data, and to monitor this continuously. The provider must tell you as soon as it learns of any breach of the protections or any risk to the data.
On data sent abroad, the law takes an unusual position. It forbids you from taking any decision or step that limits the flow of personal data across borders, unless the processing breaks the law or could cause serious harm to the data or to the person’s privacy. So the law does not stop the agent from calling a model abroad. But every other duty in the law still applies to that data.
When something goes wrong
If a breach of your protections could cause serious harm to the personal data or to a person’s privacy, you must inform the person and the competent department. The law sets no deadline in hours.
The fines are high. Breaking the rules on legal basis, the controller’s general duties, notice, data quality, internal procedures, disclosure to processors, breach notice, cross-border flows or direct marketing can bring a fine of up to 1 million riyals. Breaking the security duty, the permit rule for data of a special nature, or the rules for children’s websites can bring a fine of up to 5 million riyals. A company can be fined up to 1 million riyals for an offence committed in its name and for its account. Any contract that breaks the law is void.
What Qatar says about AI itself
I found no Qatari AI law as of October 2026. For an agent that handles personal data, the binding rules are the data privacy law.
Sector rules
The Qatar News Agency reported that the Qatar Central Bank issued an AI guideline for the financial sector in September 2024. I could not open the guideline itself, so I do not summarize it here. If you are licensed by the central bank, read it before you deploy an agent.
What this means for you
- Record, for each kind of data the agent reads, whether you rely on consent or on a legitimate purpose.
- Review your privacy procedures before the agent goes live, and keep a written record of that review.
- Keep data of a special nature away from the agent until you hold the permit.
- Put in your contract with the model provider that it follows your instructions and tells you at once of any breach.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- Al Meezan, Law No. 13 of 2016 on Protecting Personal Data Privacy
- Qatar Official Gazette, Issue 15 of 2016, full text of Law No. 13 of 2016
- Al Meezan, Cabinet Decision No. 1 of 2018 extending the compliance period under Law No. 13 of 2016
- Al Meezan, Amiri Decision No. 1 of 2021 establishing the National Cyber Security Agency
- Qatar Financial Centre, Data Protection
- Qatar News Agency, Qatar Central Bank issues Artificial Intelligence Guideline, September 2024