Qatar’s New Cloud Computing Law and Business Data Compliance

Qatar-based businesses using cloud platforms need to understand how their data is stored, transferred, protected and retrieved when a contract ends. Qatar has a Cloud Policy Framework published in June 2022 and a specific Cloud Data Interoperability and Data Portability Regulation issued in 2024. The latter addresses contractual terms for moving data between cloud providers, rather than introducing one all-purpose law covering every aspect of cloud use.

For businesses reviewing the cloud computing law and its practical effects, the main task is to match cloud contracts and internal data practices with the rules that apply to their sector. 

Finsoul Network Qatar can support businesses with compliance planning and documentation, while legal interpretation should be confirmed with a qualified adviser.

What does Qatar’s cloud regulation cover?

The Communications Regulatory Authority (CRA) issued Regulation No. 34 of 2024 on cloud data interoperability and data portability. Its scope covers cloud services provided to customers in Qatar, without displacing Qatar’s Personal Data Privacy Protection Law No. 13 of 2016 or applicable international agreements.

The regulation aims to make it easier for customers to move data and digital assets from one cloud service to another or back to their own infrastructure. It sets contractual expectations for providers, including information about transferring data, assistance during the move and continuity of service.

The cloud computing law topic therefore matters to more than IT teams. Procurement, finance, legal, operations and data-protection staff should understand the cloud contract, the information being stored and the process for leaving the service.

What is cloud computing, and why does compliance matter?

If a business uses online software, remote storage or hosted computing resources rather than running everything on its own equipment, it is probably using cloud services. To answer what is cloud computing in practical terms, think of a company storing customer records in a hosted database or using an online accounting system accessed through a browser.

Cloud use can reduce the need to maintain local servers, but it does not remove responsibility for business data. Companies still need to decide who can access information, what happens if an account is compromised, how records are backed up and whether sensitive data can be transferred outside Qatar.

Qatar’s Personal Data Privacy Protection Law No. 13 of 2016 sets obligations for processing personal data. Article 8 requires controllers to process personal data lawfully and take appropriate administrative, technical and physical precautions to protect it. Article 11 also sets out responsibilities that include reviewing privacy procedures, identifying processors, training relevant staff and monitoring compliance. Read the law through the Qatar Legal Portal, Al Meezan.

The cloud computing law should not be treated as a substitute for data-protection duties. Businesses need to consider both the cloud contract and the nature of the data they handle.

Key requirements under the cloud data portability regulation

The 2024 regulation places emphasis on the ability to retrieve and move data. Businesses should check whether their cloud agreements explain the following points.

1. Data export and switching

The provider’s contract must explain how customer data can be transferred securely to the customer or, at the customer’s direction, to another provider. The regulation specifies that export information should be clear and available before the customer signs the contract.

The regulation also sets contractual requirements for the switching process, including a maximum period of 90 calendar days for completing a switch under the specified terms, alongside reasonable assistance and attention to business continuity. The exact process depends on the contract and applicable provisions.

2. Notice periods and exit arrangements

The regulation requires a contract to specify a maximum notice period for starting the switching process, which must not exceed two months. It also addresses the provider’s support for the customer’s exit strategy and the handling of exportable data and digital assets when the service ends.

Businesses should not wait until a dispute or contract expiry to ask how to retrieve their records. Test whether the exported files will remain usable and whether related metadata, permissions and application dependencies can be retained.

3. Interoperability between systems

Interoperability means that systems can exchange and use data. A company may need to transfer records from its cloud-based customer management system into a different platform without losing essential fields or relationships.

The regulation includes requirements intended to support interoperability. It also contains provisions specifically relevant to government procurement, so companies should not assume that every requirement applies identically to every private-sector contract.

Cloud computing service models and their compliance implications

The cloud computing service models commonly used by organisations are Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). Qatar’s Ministry of Communications and Information Technology describes all three in its Qatar Cloud service overview.

The division of responsibilities differs by service. A company using SaaS may have little control over the underlying infrastructure, but it still needs to manage users, permissions and the information entered into the system.

How cloud computing in business can create data risks

Cloud services can support remote teams, shared records, customer management and business continuity. Risks arise when a company signs a contract without checking the details of data storage, access, retention and transfer.

For example, a Qatar-based trading company might store customer details, invoices and supplier contracts in a cloud platform. Before signing, it should identify the personal data involved, restrict access to authorised staff, review backup arrangements and check how it can export its records if it changes provider.

Cloud computing solutions should be assessed against business needs as well as compliance requirements. A low monthly price may not reflect the cost of extracting data, rebuilding integrations or restoring operations if the service becomes unavailable.

A practical compliance checklist for Qatar businesses

Use the following steps before adopting a cloud service or renewing an existing contract.

1. Map the data. List the personal, financial, employee and commercially sensitive information stored in the service.
2. Check the provider and contract. Review data processing terms, security commitments, subcontractors, incident notifications, service availability and termination conditions.
3. Confirm export rights. Identify the formats available, the steps needed to request an export, the assistance the provider must offer and any charges stated in the contract.
4. Review access and security. Use appropriate access permissions, multi-factor authentication where available, logging and regular access reviews.
5. Set retention and deletion rules. Decide how long records must be kept and how copies should be handled when the contract ends, subject to legal retention obligations.
6. Prepare an exit plan. Assign responsibility for moving data, testing exported files, checking integrations and confirming that business operations can continue during the switch.
7. Keep evidence. Retain contracts, risk assessments, approvals, security reviews and records of decisions about personal data.

The cloud computing law is only one part of the assessment. A business may also need to consider sector-specific rules, contractual confidentiality duties and the requirements of Qatar’s personal data protection legislation.

How Finsoul Network Qatar supports compliance planning

Finsoul Network Qatar can assist businesses with compliance documentation, policy reviews, risk registers and internal procedures related to their use of cloud services. The work should begin with the company’s actual data flows, contracts and regulatory obligations, rather than a generic checklist.

Where personal data is involved, businesses should establish who acts as the controller and who processes information on its behalf. They should also confirm whether their industry has additional requirements. For example, Qatar Central Bank-regulated entities have separate cloud computing requirements, including restrictions and approval obligations that may not apply to an ordinary commercial company. Consult the relevant Qatar Central Bank cloud computing regulation if the organisation falls within its scope.

The cloud computing law and related rules can affect contract reviews, vendor selection, internal controls and exit planning. Businesses should seek legal or specialist advice where the application of a requirement is unclear.

Conclusion

Cloud compliance in Qatar requires more than choosing a secure platform. Businesses should understand the 2024 data portability regulation, meet applicable personal data protection duties and review any sector-specific rules before signing or renewing a cloud contract. Finsoul Network Qatar supports documentation and internal compliance planning, while qualified legal or technical specialists should advise on requirements specific to the organisation. Start by mapping the data held in each service, reviewing the contract’s exit provisions and recording who is responsible for security, retention and transfer decisions.

FAQs

Does Qatar have a cloud computing law?

Qatar has a Cloud Policy Framework from 2022 and a Cloud Data Interoperability and Data Portability Regulation issued by the CRA in 2024. Businesses should identify the specific instrument and other laws relevant to their circumstances rather than assume one law governs every cloud-related issue.

Must all business data stay inside Qatar?

Do not assume that every business is subject to the same data-localisation rule. The answer depends on the applicable law, sector requirements, data type and contractual obligations. Some regulated entities, including those covered by Qatar Central Bank rules, may face specific restrictions. Obtain advice for the relevant business and data.

What should a company check before changing cloud providers?

Review the contract’s data export provisions, notice period, switching assistance, continuity arrangements, data formats and deletion terms. Test whether the exported data can be used in the new system before shutting down the old service.