Skip to content

Evidence request lists

Qatar DPL

Evidence request list. 8 controls, 8 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 12 September 2026. Published by The Art of Service.

Breach and Enforcement

QATAR-8
Breach Notification, Compliance, Enforcement

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: breach + enforcement. Requirements include (a) breach notification to NDPC (Qatar Cyber Security Office) + affected subjects + (b) incident response + (c) regulator cooperation + (d) penalties awareness + (e) breach log + tabletops.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-8
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Consent and Notice

QATAR-2
Consent, Notice, Sensitive Data

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: consent + notice + sensitive data. Requirements include (a) obtain valid consent + (b) provide privacy notice + (c) implement sensitive data safeguards + (d) maintain records of consent + (e) change management.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-2
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Governance

QATAR-7
DPO, Records, Retention, Marketing, Training

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: governance. Requirements include (a) DPO designation + (b) records of processing + (c) retention + (d) marketing safeguards + (e) training + (f) accountability framework.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-7
Where this commonly fails
  • NDPC notification + transfer + DPO partial

High-Risk Processing

QATAR-4
Children's Data, DPIA, Privacy by Design

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: heightened safeguards. Requirements include (a) children's data protections + (b) DPIA for high-risk + (c) privacy by design + (d) documented safeguards.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-4
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Individual Rights

QATAR-3
Data Subject Rights

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: data subject rights. Requirements include (a) Access + Rectification + Erasure + Object + Portability + (b) automated decision protections + (c) mechanism + (d) records of requests.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-3
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Scope and Lawful Basis

QATAR-1
Scope, Lawful Basis, Purpose Limitation (Qatar)

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: scope + lawful basis + purpose. Requirements include (a) determine applicability + (b) establish lawful basis for processing + (c) apply purpose limitation + (d) document applicability + lawful basis + (e) align with NDPC (Qatar Cyber Security Office) guidance.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-1
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Security

QATAR-5
Security of Processing

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: security. Requirements include (a) appropriate technical + organisational measures + (b) encryption + pseudonymisation + (c) access control + (d) regular testing + (e) integrate with broader InfoSec.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-5
Where this commonly fails
  • NDPC notification + transfer + DPO partial

Transfer and Processor

QATAR-6
Cross-Border Transfer and Processor Management

Per Qatar Law No. 13 of 2016 on Personal Data Privacy Protection: cross-border + processor. Requirements include (a) transfer restrictions + (b) processor agreements + (c) cross-border safeguards + (d) inventory + (e) supplier due diligence.

Artefacts an auditor will ask for
  • Qatar Law 13/2016 evidence for QATAR-6
Where this commonly fails
  • NDPC notification + transfer + DPO partial
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the Qatar DPL framework page.