Cybersecurity law & regulation in Qatar (2026)
Cybersecurity in Qatar: sectoral rules.
Qatar does not yet have a single comprehensive NIS2-style cybersecurity statute; instead, cybersecurity obligations flow from the NCSA's mandate (Emiri Decree No. 1 of 2021) to issue and enforce binding standards and frameworks, applied to government agencies and critical infrastructure, alongside a data-protection law and a cybercrime law. The NCSA centralizes policy, regulation, certification/licensing and incident coordination, and in 2024 launched a National Cybersecurity Strategy 2024-2030 whose pillars include further legislation and law enforcement of cyberspace. Breach and incident reporting duties exist via the PDPPL (72-hour personal-data breach notification) and sector/critical-infrastructure incident-reporting requirements coordinated by the NCSA.
Legal framework
National Cyber Security Agency (NCSA), established by Emiri Decree No. 1 of 2021, governing through mandatory standards/frameworks rather than a single horizontal cybersecurity statute, anchored by the National Information Assurance (NIA) Standard, the National Information Security Compliance Framework (NISCF), the National Cybersecurity Strategy 2024-2030, plus the Personal Data Privacy Protection Law (Law No. 13 of 2016) and the Cybercrime Prevention Law (Law No. 14 of 2014).
Key points: cybersecurity in Qatar
Central regulator (NCSA)
The National Cyber Security Agency was established by Emiri Decree No. (1) of 2021 under the Prime Minister, with authority to propose legislation, issue cybersecurity policies/standards, supervise and protect national critical infrastructure, and monitor compliance.
Mandatory baseline standard (NIA)
The National Information Assurance (NIA) Standard (v2.1, updated from Policy v2.0) sets a national data-classification methodology and baseline security controls across 26 domains; designated baseline controls are mandatory and agencies are audited annually for compliance.
Personal-data breach notification
Under the Personal Data Privacy Protection Law (Law No. 13 of 2016) and NCSA guidelines, controllers must notify the Competent Department of security incidents, guidelines set a 72-hour window from detection, with administrative fines up to QAR 1-5 million; the NCSA's National Cyber Governance and Assurance Affairs acts as the supervisory authority.
Critical infrastructure & national incident management
Critical infrastructure operators are subject to NCSA cybersecurity standards, incident-reporting duties and periodic assessments; in February 2025 Qatar launched a National Incident Management Framework (seven elements covering detection, investigation, strategic response, recovery and review) to coordinate response to nationally significant cyber incidents.
National Cybersecurity Strategy 2024-2030
Launched September 2024, the strategy is built on five pillars including 'legislation, regulation and law-enforcement of cyberspace,' signalling that a fuller legislative framework is still being developed beyond current standards and frameworks.
Cybercrime law & provider licensing
The Cybercrime Prevention Law (Law No. 14 of 2014), overseen by the Ministry of Interior, criminalizes unauthorized access, online fraud and identity theft; separately the NCSA has moved to license and accredit cybersecurity service providers (including penetration-testing accreditation) under its compliance framework.
Timeline of decisions
- DecisionNCSA Joins ISASecure to Certify Industrial OT Cybersecurity
Qatar's National Cyber Security Agency officially joined ISASecure, the globally recognised certification programme for ISA/IEC 62443 compliance in industrial automation and control systems. The move makes Qatar an active certifying authority for OT/ICS cybersecurity standards in critical infrastructure sectors.
ISA (International Society of Automation)
- Guidance · officialNational Cybersecurity Strategy 2024-2030 Launched
The NCSA unveiled Qatar's second national cybersecurity strategy, built on five pillars: ecosystem resilience, legislation and law-enforcement, data-driven economy, cyber workforce culture, and international partnerships. The strategy targets positioning Qatar as a global cybersecurity leader aligned with Qatar National Vision 2030.
Government Communications Office – State of Qatar
- DecisionCabinet Formally Adopts National Cyber Security Strategy
Qatar's Council of Ministers officially adopted the National Cyber Security Strategy, giving the NCSA a formal governmental mandate for cybersecurity and data protection regulation ahead of its public launch later in 2024. Cemented NCSA's authority to enforce the PDPPL and issue binding guidance.
The Peninsula Qatar
- Guidance · officialNational Cyber Security Strategy 2024-2030 Launched by NCSA
The National Cyber Security Agency unveiled a six-year strategic framework built on five pillars, ecosystem resilience, legislation, data-driven economy, R&D/innovation, and international cooperation, aligning Qatar's cybersecurity posture with Qatar National Vision 2030 and targeting global leadership in the field.
Qatar National Cyber Security Agency (NCSA)
- Decision · officialQatar Achieves ITU Global Cybersecurity Index Tier 1 'Role Model' Status
The ITU's GCI 2024 placed Qatar among 46 Tier 1 'role model' countries, recognising excellence across all five cybersecurity pillars (legal, technical, organisational, capacity-building, cooperation). Qatar was one of eight Arab states to reach Tier 1.
ITU – International Telecommunication Union
- Guidance · officialNCSA Issues Operational Technology Security Standards for Electricity and Water Sector
The NCSA published mandatory OT security recommendations for Qatar's electricity and water sector, implementing ISA/IEC 62443 standards in partnership with KAHRAMAA (Qatar General Electricity and Water Corporation). This was the first sector-specific OT cybersecurity directive under the NCSA framework.
National Cyber Security Agency (NCSA) – State of Qatar
- IncidentFIFA World Cup 2022: Qatar Activates $1.1 Billion Cybersecurity Infrastructure at Scale
For the duration of the tournament (Nov 20-Dec 18 2022) Qatar deployed its threat intelligence centre, malware analysis lab, and automated monitoring systems coordinated by Q-CERT and NCSA, with Interpol Project Stadia support, the first operational stress-test of the nation's full online-safety ecosystem and a catalyst for lasting institutional capability.
InCyber News
- IncidentFIFA World Cup 2022 Triggers Largest Cybersecurity Mobilisation in Qatar's History
Q-CERT and the NCSA deployed a threat intelligence centre, automated threat-monitoring systems, and coordinated with INTERPOL's Project Stadia to protect World Cup infrastructure against phishing, ransomware, and state-sponsored threats. No successful APT attacks on tournament infrastructure were reported.
InCyber (France Cybersecurity)
- Law · officialEmiri Decree No. 1 of 2021 Formally Establishes the National Cyber Security Agency (NCSA)
Emiri Decree No. 1 of 2021 created the NCSA and vested in its National Cyber Governance and Assurance Affairs (NCGAA) division full supervisory and enforcement authority over the PDPPL. Gave Qatar's data protection framework a permanent, dedicated regulatory home for the first time since the law's 2016 enactment.
Qatar National Cyber Security Agency (NCSA)
- Law · officialNational Cyber Security Agency (NCSA) Established by Amiri Decree No. 1 of 2021
Amiri Decree No. 1 of 2021 created the NCSA under direct supervision of the Prime Minister, consolidating all national cybersecurity authority into a single body. The NCSA absorbed Q-CERT and became responsible for policy, standards, compliance certification, incident response, and legislative oversight.
National Cyber Security Agency (NCSA) – State of Qatar
- GuidanceQatar Cybersecurity Framework (QCF) for FIFA World Cup 2022 Published
The Supreme Committee for Delivery & Legacy released the first event-specific cybersecurity framework in Qatar's history, mandating prevention, detection, and breach-response capabilities for all organisations in the World Cup ecosystem and accelerating enterprise-level cybersecurity adoption across the country.
Securiti (documenting Supreme Committee QCF)
- Guidance · officialQatar 2022 Cybersecurity Framework Published for Government and Critical Infrastructure
Qatar introduced a comprehensive cybersecurity framework for government entities, critical infrastructure operators, and World Cup-affiliated businesses, mapping controls to NIST SP 800-53, ISO 27001, ISA 62443, PCI-DSS, and GDPR. It established the baseline mandatory security posture for organisations participating in or supporting the 2022 World Cup ecosystem.
U.S. International Trade Administration – Qatar Cybersecurity Sector
- Law · officialCybercrime Prevention Law No. 14 of 2014 Promulgated
Qatar's foundational cybercrime statute criminalised unauthorised system access, data tampering, identity theft, online fraud, and electronic financial crimes. Penalties range from fines to long-term imprisonment, providing the primary enforcement instrument for digital offences in Qatar.
Al Meezan – Qatar Legal Portal (Official)
- Guidance · officialQatar's First National Cyber Security Strategy Published (2014-2018 Action Plan)
Qatar issued its inaugural National Cyber Security Strategy, establishing governance structures, defining roles across ministries, and outlining a 2014-2018 action plan. The strategy aligned national agencies for the first time under a unified cybersecurity mandate and set the foundation for all subsequent policy.
ITU National Strategies Repository – State of Qatar
- Decision · officialQ-CERT Established, First Computer Emergency Response Team in the Middle East
Qatar Computer Emergency Response Team (Q-CERT) was created by CERT/CC and ictQATAR in December 2006, making it the first CERT in the Middle East. Q-CERT provided national incident response, threat intelligence, and cyber awareness capabilities until it was absorbed into the NCSA in 2021.
Q-CERT – National Cyber Security Agency (NCSA) – State of Qatar
Sources
- ncsa.gov.qa/en
- assurance.ncsa.gov.qa/en
- gco.gov.qa/en/media-centre/top-news/the-national-cyber-security-strategy-2024-20
- trade.gov/market-intelligence/qatars-new-cybersecurity-strategy-2024-2030
- assurance.ncsa.gov.qa/sites/default/files/publications/policy/2023/NCSA_CSGA_%20National_In
- assurance.ncsa.gov.qa/sites/default/files/library/2020-11/Law%20No.%20(13)%20of%202016%20%2
- assurance.ncsa.gov.qa/sites/default/files/library/2022-09/Personal%20Data%20Breach%20Notifi
- thepeninsulaqatar.com/article/18/02/2025/qatar-launches-management-framework-in-event-of-na
- cra.gov.qa/en/document/cybercrime-prevention-law-no-14-of-2014
- qatarlaw.com/news/the-national-cyber-security-agency-set-to-license-cyber-security
- bsigroup.com/globalassets/localfiles/en-ae/digitaltrust/niap/ictqatar-nia_policy_e
- nationalvision2030.com/sectors/digital/cybersecurity-strategy/
Next for Qatar: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026