The Qatar Financial Centre ('QFC') issued, on 21 December 2021, the new QFC Data Protection Rules ('the 2021 Rules'), along with the new Data Protection Regulations 2021 ('the 2021 Regulations'), following a revision of the 2005 Data Protection Rules and the 2005 Data Protection Regulations (collectively 'the 2005 Legislation') in 2021, which saw the QFC propose changes to the same. In this regard, the proposed changes to the 2005 Legislation were launched for public consultation for a period ending on 16 September 2021. In particular, the 2021 Rules add to controllers' transparency obligations towards data subjects in Articles 14 and 15 of the 2021 Regulations and correspond and supplement some of the changes introduced in the 2021 Regulations, including details with regards to: 

• information that a data subject has the right to obtain with regards to their right of access in Article 16 of the 2021 Regulations;
• what must to be included in a Data Protection Imapct Assessment for the purposes of Article 27 of the 2021 Regulations;
• what must be included in the contract between a controller and processor;
• information that complainants need to provide when lodging complaints with the Data Protection Office as established by Article 32 of the 2021 Regulations; and
• what must be included in a notification of a data breach required by Article 31 of the 2021 Regulations.

You can access the 2021 Rules here. 

UPDATE (12 December 2023)

QFC publishes updated Data Protection Rules introducing requirements for BCRs

On 12 December 2023, the Qatar Financial Centre ('QFC') issued version 3 of the QFC Data Protection Rules ('the 2023 Rules'). In particular, the 2023 Rules are broadly similar to the 2021 Rules, with the only change being the introduction of new requirements for the use of Binding Corporate Rules ('BCRs') for transfers of personal data outside the QFC.

You can access the 2023 Rules here.