Question 1

Does my business need a licence from the Communications Regulatory Authority?

Accepted Answer

It depends on what the business actually does rather than on how it describes itself. The Telecommunications Law prohibits the installation or operation of a telecommunications network and the provision of telecommunications services to the public except under an instrument issued in accordance with the Law. If the offering conveys the communications of others, is available to the public rather than used internally, or relies on network infrastructure, frequencies or numbers, the regime is engaged and the classification of the service should be settled with the Authority before launch.

Question 2

We are a software company with a connectivity feature. Are we caught?

Accepted Answer

Possibly, and this is one of the most common surprises in the sector. The Law looks at the activity, so a connectivity element embedded in a wider product, a reselling arrangement, voice carried over internet protocol or connectivity between devices can bring an undertaking within the regime even though it regards itself as a technology business. Being established outside the State does not by itself take a provider outside the regime where the service is offered to customers in Qatar.

Question 3

What does Law No. 13 of 2016 require of us as a controller?

Accepted Answer

In outline: process personal data for a legitimate purpose connected with your activity, fairly and transparently; rely on the consent of the individual or another basis the Law recognises; collect no more than the purpose requires and keep the data accurate; do not retain it beyond the purpose; take the precautions necessary to protect it; make the rights of the individual exercisable in practice; give special treatment to data of a special nature and to children's data; and be able to show what you do and why, because responsibility remains with the controller even where a supplier carries out the processing.

Question 4

How quickly must we report a data breach?

Accepted Answer

The Law requires the controller to notify the competent authority and the individual concerned of a breach of that individual's personal data causing serious damage, and the notification must be made within the period prescribed by the law, its executive regulations and the instructions of the competent authority. Because that period runs from the events the instruments specify and not from the date the business finishes its internal investigation, the practical answer is to have a plan that fixes who decides, what is recorded and who is notified before any incident occurs.

Question 5

Can we host our data outside Qatar?

Accepted Answer

Law No. 13 of 2016 does not publish a list of approved destinations; it places responsibility on the controller. Transfer or processing abroad must not expose the data to loss, damage, unlawful disclosure or a level of protection below what the Law requires, and the controller must be able to show the measures it relied on. Sector requirements may add restrictions independently of the data protection Law, so the assessment should be documented when the architecture is chosen, and the contract should name permitted locations, control sub-processing and provide for deletion at exit.

Question 6

What should we insist on in a cloud or software as a service contract?

Accepted Answer

Availability and support commitments with a defined method of measurement and real consequences; clear ownership of your data and its separation from other customers; security commitments you may verify; disclosure of sub-processors and of the locations used, with notice before they change; incident notification and assistance with the requests of individuals; control over unilateral changes to the service; and a workable exit, meaning the right to export data in a usable format, transition assistance and certified deletion afterwards.

Question 7

Our systems integration project has failed acceptance testing. What matters now?

Accepted Answer

The contract and the contemporaneous record. What the specification actually required, which of the customer's own dependencies were met, whether changes went through the agreed change control, what the test criteria were, how failures were categorised, how many correction attempts were permitted and what the contract says follows if they are exhausted. Any deemed acceptance provision needs to be examined at once, because silence can otherwise be treated as approval, and the project documents should be preserved rather than allowed to be overwritten.

Question 8

Where do disputes in this sector go?

Accepted Answer

Regulatory matters, licensing, interconnection, spectrum, numbering, quality of service and the treatment of subscribers, are taken to the Communications Regulatory Authority, and personal data complaints follow the route created by Law No. 13 of 2016. A regulator's decision is an administrative decision and is challenged as such, including under Law No. 7 of 2007, within the period prescribed. Contractual claims go to the competent court under Law No. 13 of 1990, or to arbitration under Law No. 2 of 2017 where the contract so provides, with enforcement abroad supported by the New York Convention ratified by Decree No. 29 of 2003.

Telecommunications & Information Technology

How we help

In Qatar

Discuss your matter with the firm