Qatar is a different case from its neighbours. While Saudi Arabia is tightening in-Kingdom storage, Qatar’s data protection law says outright that controllers should not restrict cross-border data flows except in defined cases. Does that mean it does not matter where AI runs in Qatar? Not quite. This article summarises what the sources say, and where the exceptions that change the decision sit.

First: the law allows transfers in principle

Law No. 13 of 2016 on Protecting Personal Data Privacy took effect in 2017. According to the Chambers Data Protection & Privacy 2026 guide, Qatar chapter (Alex Saleh, Asad Ahmad, Jehan Saleh and Mounir Hany, GLA & Company), Article 15 says a controller may not restrict the transfer of personal data outside the State unless the processing breaches the law or may cause serious damage to the data or to the individual’s privacy. There is no general localisation requirement and no prior approval for transfers, except for personal data of a special nature.

The same chapter notes that the Cloud Policy Framework issued by the Communications Regulatory Authority in June 2022 no longer makes data residency a general requirement, relying instead on data classification and encryption, with localisation expected to remain only for extremely sensitive data.

Second: special-nature data needs prior permission

This is where the calculation changes. Special-nature data under Qatari law covers ethnic origin, physical and mental health, religious beliefs, relationships and marital status, criminal records and children’s data. Processing it, cross-border transfers included, needs prior permission from the competent authority (Article 16). Hospitals, insurers, schools and any assistant that reads HR files all handle this kind of data every day.

Third: the QFC and the banking sector have their own rules

Entities registered in the Qatar Financial Centre fall under the QFC Data Protection Regulations 2021, not the State law, supervised by the QFC’s Data Protection Office. According to Chambers, a transfer to a country without adequate protection can require a permit. In banking, the Qatar Central Bank issued AI guidelines for licensed institutions in September 2024 which, according to Sultan Al-Abdulla & Partners, address corporate governance, risk management, outsourcing, human oversight and QCB approvals.

Fourth: the guidance asks for systems you can audit

Qatar has no standalone AI law and no EU-style risk classification. But the National Cyber Security Agency’s guidelines for the secure adoption and use of AI, according to Chambers, expect AI systems to follow data minimisation and purpose limitation, and to build in auditability, traceability and documentation. Data breaches are reported to the NCSA. How roles are split between the NCSA and the Ministry of Communications and Information Technology is still not fully settled on some points, so confirm the competent authority for your case.

When running AI on-premises is the sensible choice in Qatar

  1. When your systems read special-nature data: health records, children’s data or employee files. Keeping processing inside your premises makes the required permission simpler, because there is no transfer to justify.
  2. When your entity is in the QFC or licensed by the QCB. Outsourcing and approvals are part of the guidance, and a system that runs inside your environment is easier to document.
  3. When you operate in more than one Gulf country. One on-premises design works for Saudi Arabia, the UAE and Qatar together, instead of three designs for three transfer regimes.
  4. In every case, make decisions traceable: who asked, what the system saw, what action it took. That is what the guidance asks for wherever the system runs.

Where we stand

We will not tell you Qatari law forces you to run on-premises, because it does not. But when your systems read sensitive data, or you work in a regulated sector, or in more than one country, running locally becomes the simplest route. Orchestra, our Arabic model, runs inside your data centre or in an in-country private cloud, understands Gulf Arabic, and comes with the indexes, the logs and the safety layer, with every action recorded in a log that cannot be altered. For comparison, read about Saudi Arabia’s localisation draft and the UAE’s rules.

This article summarises public sources and is not legal advice. The regulatory picture is moving, so check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.