Biometric Attendance and Access Control in Qatar: A Data Privacy Checklist for Employers

This checklist summarizes Qatar’s Personal Data Privacy Protection Law and published guidance on it. It is not legal advice. For your own processing, consult a data protection adviser.

The short answer

Fingerprint, face and palm readers process personal data, so Qatar’s Personal Data Privacy Protection Law (Law No. 13 of 2016) applies to biometric attendance and access control systems. Biometric data is not on the law’s list of “special nature” data. Even so, the law requires lawful processing, privacy by design, appropriate security and breach notification, and its penalties reach QAR 5 million. Employers should complete an impact assessment, keep biometric data to a minimum, secure it and delete it when an employee leaves.

Why a biometric reader is a data protection decision?

The law defines personal data as information about a person whose identity can be determined, directly or by combining it with other data. It applies to personal data processed electronically. A biometric reader exists to identify a specific person, so the data it records falls within that definition. Biometric data also differs from a password. A password can be changed after a leak; a fingerprint or a face cannot. ISO/IEC 24745:2022, the international standard for biometric information protection, addresses this by setting out how biometric references can be protected and, if compromised, revoked and replaced.

Is biometric data “special nature” data in Qatar?

Article 16 of the law lists personal data of a special nature: data about ethnic origin, children, health, physical or psychological condition, religious beliefs, marital relations and criminal offenses. Processing it requires permission from the competent department. The Minister can add categories where misuse could cause serious harm. Biometric data is not on the list. If your system also records information in one of the listed categories, such as health information from temperature screening, the special-nature rules apply to that information.

What the law and the regulator expect

Obligations in the law

Lawful processing and privacy by design (Article 8). Process personal data honestly and lawfully, take privacy into account when designing or changing systems, and adopt appropriate administrative, technical and financial safeguards.
Security (Article 13). Protect personal data against loss, damage, alteration, and unauthorized access or disclosure, with safeguards that match the data’s sensitivity. Processors must alert the controller promptly to any breach.
Breach notification (Article 14). Notify the affected individual and the competent department of a breach that may cause serious damage.
Penalties (Articles 23 to 25). Fines of up to QAR 1 million for breaching Articles 8 or 14, and up to QAR 5 million for breaching Article 13.

Guidance from the regulator

The law is now enforced by the National Cyber Security Agency (NCSA). Data protection guidelines issued in 2020 expect a data protection impact assessment (DPIA) before new processing that may cause serious damage. They list processing of employees’ personal data in that category. They also expect breaches to be reported to the regulator and affected individuals within 72 hours. In September 2026 the NCSA set out seven principles for handling personal data: transparency and fairness, integrity and confidentiality, purpose limitation, data minimization, accuracy, storage limitation and accountability. Its 2026 individuals’ rights guidelines say requests to erase personal data should be answered within 30 days. The NCSA also enforces the law. In February 2026 its National Data Privacy Office issued a binding decision against a company in the sports sector after a personal data breach. It found the company’s technical, administrative and physical safeguards inadequate and ordered it to strengthen them.

The 10-point checklist

Write down the purpose. Attendance, door access or both. Do not reuse the data for another purpose without a fresh assessment.
Complete a DPIA before installation, and keep it on file.
Tell employees in plain language what is collected, why, where it is stored and for how long.
Offer an alternative. Provide a card, PIN or mobile credential for anyone who should not or cannot enroll.
Store templates, not images, where the device supports it, so that raw fingerprint or face images are not kept.
Encrypt biometric data at rest and in transit, and choose systems whose protection follows ISO/IEC 24745.
Limit access. Only named administrators manage enrollments, and every change is logged.
Set a retention rule. Delete biometric data when an employee leaves, and keep attendance records only as long as payroll and legal duties require.
Know where the data goes. For cloud-hosted software, confirm the hosting country and provider in the contract.
Plan for a breach. Decide who notifies the NCSA and affected staff, and how quickly.

Questions to ask your vendor

Does the reader store template or images, and can image storage be switched off?
Is matching done on the device or on a server, and is the data encrypted in both places?
Can biometric data be deleted for one person or in bulk, and is deletion logged?
Which standards does the product follow for biometric information protection?
Where is cloud data hosted, and who at the vendor can access it?
What happens to our data if we end the contract?

Where CCTV fits

If your access system works with CCTV, for example to capture an image at each door event, Qatar’s CCTV law applies as well. Law No. 9 of 2011 requires the establishments it covers to keep recordings unaltered for 120 days. It also bans cameras in bedrooms, physiotherapy rooms, restrooms, changing rooms and areas designated for women, and forbids sharing recordings without the competent authority’s approval. For the payroll side of attendance, see Qatar working hours and overtime.

Frequently asked questions

Q. Is biometric data sensitive personal data under Qatar law?

A. It is not on the list of special-nature data in Article 16 of Law No. 13 of 2016. The law’s general duties still apply: lawful processing, privacy by design, security and breach notification.

Q. What happens if biometric data is breached?

A. Article 14 requires the employer to notify the affected employees and the competent department when a breach may cause serious damage. The 2020 guidelines expect that notice within 72 hours.

Q. What should happen to biometric data when an employee leaves?

A. Delete it as part of the exit process and keep a record of the deletion. The NCSA lists storage limitation among its core principles.

Design it right from the start

Axle Systems supplies access control systems and time attendance systems with fingerprint, face, palm, card and mobile options, including mobile access control for sites that prefer to avoid biometrics. Contact us for a privacy-first design review before you enroll your first employee.