Qatar: technology regulation at a glance

Framework: Qatar Central Bank (QCB) Circular No. 6/2018 and Circular No. 46/2019 (financial institution ban on virtual assets); QFC Digital Assets Regulations 2024 and supporting rulebooks (QFCA + QFCRA), in force from 1 September 2024

Cryptocurrencies, stablecoins and CBDCs are 'Excluded Tokens' in Qatar — financial institutions are prohibited by the QCB from dealing in them, and there is no lawful path to run a crypto exchange, stablecoin issuer, or DeFi service. Since September 2024, the Qatar Financial Centre operates a Digital Assets Framework, but it authorizes only tokenization of real-world assets (equities, bonds, sukuk, commodities, real estate) through licensed Token Service Providers, not cryptocurrency businesses.

Framework: No comprehensive horizontal AI law. Qatar combines a National AI Strategy (2019) and voluntary national ethics/cybersecurity guidelines (MCIT, NCSA) with binding sector-specific rules, most notably the Qatar Central Bank's Artificial Intelligence Guideline for licensed financial entities (2024) and a 2026 judicial practice direction in the Qatar Financial Centre.

Qatar regulates AI through a layered approach rather than a single comprehensive statute: a National AI Strategy (2019) and voluntary ethical/security guidelines set the overall direction, while enforceable rules exist in specific sectors. The Qatar Central Bank's binding AI Guideline (Sept 2024) imposes mandatory governance, risk-management and authorisation requirements on financial-sector licensees, and a QFC judicial practice direction (Jan 2026) governs AI use in court proceedings. National-level ethics principles (MCIT) and cybersecurity guidance (NCSA) remain voluntary.

Framework: Law No. 13 of 2016 on Personal Data Privacy Protection (PDPPL), supervised by the National Cyber Governance and Assurance Affairs (NCGAA) within the National Cyber Security Agency (NCSA); the Qatar Financial Centre operates a separate GDPR-aligned regime (QFC Data Protection Regulations and Rules 2021).

Qatar has a comprehensive, generally applicable personal-data protection law, Law No. 13 of 2016 (PDPPL), in force since 2017, the first such statute in the Gulf region. It is enforced by the NCGAA under the NCSA and sets out controller/processor obligations, data-subject rights, breach notification, and penalties. The Qatar Financial Centre free zone applies its own separate, GDPR-aligned data-protection regime overseen by the QFC Data Protection Office.

Framework: Qatar Central Bank (QCB) Payment Services Regulation (effective 15 September 2021), Buy-Now-Pay-Later Regulation (2023), Digital Banks Regulatory Framework (2024), open-banking API requirements under the National Fintech Strategy 2023-2028, FAWRAN instant payment rail (2024); plus the Qatar Financial Centre (QFC) Digital Assets Framework 2024 administered by QFCA/QFCRA.

Qatar operates a dedicated licensing regime for digital payments and fintech under the Qatar Central Bank, anchored by the 2021 Payment Services Regulation (PSR) that requires any PSP — including e-money issuers, merchant acquirers, payment gateways and fund-transfer providers — to obtain a QCB licence. The regime has been expanded with the 2023 BNPL Regulations, the December 2024 Digital Banks Regulatory Framework, the FAWRAN instant payment service (launched March 2024), and an emerging open-banking API mandate; a parallel QFC Digital Assets Framework (Sept 2024) covers tokenised assets and token service providers. By early 2026, QCB had licensed roughly 15 fintechs, and Regulatory and Express Sandboxes are open to new entrants.

Framework: Qatar's sponsorship-based residency regime administered by the Ministry of Interior (Law No. 21 of 2015 on entry/exit/residency of expatriates), the Permanent Residency Law (Law No. 10 of 2018) and real-estate residency under Law No. 16 of 2018, plus the five-year 'Mustaqel' residence permit (administered by the government-owned Jusoor) for talented individuals and entrepreneurs.

Qatar has no dedicated digital-nomad or remote-work visa, and working remotely on a tourist/visit visa is not authorized under its sponsorship-based system. Relocators can instead use other routes: the employer-sponsored work residence permit, a five-year 'Mustaqel' residence permit for approved talents/entrepreneurs (launched Feb 2024), or residency by real-estate/business investment. There is therefore a pathway for some relocators and entrepreneurs, but not for ordinary salaried remote workers employed abroad.

Framework: Cybercrime Prevention Law No. 14 of 2014 (as amended by Law No. 11 of 2025), enforced alongside content filtering by the Communications Regulatory Authority (CRA) and state-controlled ISPs; no DSA/OSA-style online-safety statute exists.

Qatar does not have a comprehensive online-safety/platform regime modeled on the EU DSA or UK OSA; instead it regulates the internet primarily through a criminal-law and state-filtering approach. The Cybercrime Prevention Law criminalizes 'false news' and content deemed to harm national security, public order, religion or the ruling family, while the CRA and state-owned ISPs operate transparent block-page filtering of pornography, LGBTQ, political and circumvention content. A 2025 amendment added penalties for sharing images/videos of individuals without consent, framed as privacy protection but criticized as a further restriction on expression.

Framework: National Cyber Security Agency (NCSA), established by Emiri Decree No. 1 of 2021, governing through mandatory standards/frameworks rather than a single horizontal cybersecurity statute, anchored by the National Information Assurance (NIA) Standard, the National Information Security Compliance Framework (NISCF), the National Cybersecurity Strategy 2024-2030, plus the Personal Data Privacy Protection Law (Law No. 13 of 2016) and the Cybercrime Prevention Law (Law No. 14 of 2014).

Qatar does not yet have a single comprehensive NIS2-style cybersecurity statute; instead, cybersecurity obligations flow from the NCSA's mandate (Emiri Decree No. 1 of 2021) to issue and enforce binding standards and frameworks, applied to government agencies and critical infrastructure, alongside a data-protection law and a cybercrime law. The NCSA centralizes policy, regulation, certification/licensing and incident coordination, and in 2024 launched a National Cybersecurity Strategy 2024-2030 whose pillars include further legislation and law enforcement of cyberspace. Breach and incident reporting duties exist via the PDPPL (72-hour personal-data breach notification) and sector/critical-infrastructure incident-reporting requirements coordinated by the NCSA.

Framework: Foreign Investment Law No. 1 of 2019 (regulating investment of non-Qatari capital) and Executive Regulations No. 44 of 2020, administered by the Ministry of Commerce and Industry (MOCI) / Invest in Qatar Center; company forms under the Commercial Companies Law.

Since the 2019 Foreign Investment Law replaced the old 51% local-partner requirement, non-Qatari investors may own up to 100% of companies in most economic sectors, subject to MOCI approval. Formation runs through MOCI's Single Window platform with no fixed statutory minimum capital, but a few sectors remain restricted and the process still involves approvals, attestations and a resident manager, typically taking several weeks.