What is GDPR?
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, applicable since 25 May 2018. It applies extraterritorially to any organisation — regardless of where it is established — that processes the personal data of individuals located in the EU, either by offering goods or services to them or by monitoring their behaviour. This makes GDPR a global concern for any Qatar organisation with EU customers, employees, or users.
GDPR is built on seven principles (lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability) and recognises six lawful bases for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests). It establishes enhanced data subject rights — including the right of access, rectification, erasure ('right to be forgotten'), restriction, portability, and objection — and imposes strict obligations on controllers and processors regarding security, breach notification (within 72 hours), Data Protection Impact Assessments, and (for qualifying organisations) the appointment of a Data Protection Officer.
GDPR's penalty regime is famously consequential: up to €20 million or 4% of total worldwide annual turnover, whichever is higher. Notable enforcement actions have included fines exceeding €1 billion, making GDPR one of the most heavily-enforced data protection regimes globally.
Who must comply with GDPR?
- 01Any organisation established in the EU that processes personal data
- 02Any organisation outside the EU offering goods or services to individuals in the EU
- 03Any organisation outside the EU monitoring the behaviour of individuals in the EU
- 04Joint controllers and processors are jointly liable for compliance
- 05Qatar-based exporters, e-commerce, SaaS, and travel operators with EU customers
GDPR structure at a glance
The GDPR framework is organised into the following control areas. Vantage GRC pre-maps each one so evidence collected once contributes to your compliance picture across overlapping frameworks.
Seven Principles (Article 5)
Data Subject Rights (Articles 12-22)
Controller & Processor Obligations
What GDPR requires you to do
- 1Identify a lawful basis for every processing activity (most commonly consent, contract, legal obligation, or legitimate interests).
- 2Maintain Records of Processing Activities (RoPA) covering categories of data, processing purposes, retention, and recipients.
- 3Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.
- 4Appoint a Data Protection Officer where required (public bodies, large-scale special-category processing, large-scale monitoring).
- 5Implement appropriate technical and organisational security measures.
- 6Notify supervisory authorities of breaches within 72 hours; notify data subjects without undue delay where rights are at risk.
- 7Use approved transfer mechanisms (SCCs, BCRs, adequacy decisions) for personal data leaving the EU/EEA.
GDPR works alongside
GDPR questions
Does GDPR apply to my Qatar-based business?
If you offer goods or services to individuals located in the EU (paid or free) or monitor their behaviour (e.g. via cookies, analytics, or behavioural advertising), GDPR applies regardless of where your business is established. Many Qatar e-commerce, SaaS, hospitality, and travel businesses are within scope.
What are the maximum GDPR penalties?
Up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements (e.g. violations of basic principles or data subject rights). Less serious infringements carry penalties up to €10 million or 2% of turnover. Notable enforcement actions have exceeded €1 billion.
How does GDPR differ from Qatar PDPPL?
GDPR recognises six lawful bases for processing (PDPPL is primarily consent-based), uses percentage-of-turnover penalties (PDPPL uses fixed QAR ranges), and includes the right to erasure and data portability (PDPPL is more limited). However, both share core principles around purpose limitation, data minimisation, security, and breach notification within 72 hours.
Do we need to appoint a Data Protection Officer?
DPO appointment is mandatory if you are a public body, your core activities involve large-scale systematic monitoring of individuals, or your core activities involve large-scale processing of special categories of data. Many organisations appoint a DPO voluntarily as best practice.
Ready to operationalise GDPR compliance?
Talk to a Vantage GRC consultant about your GDPR programme — pre-mapped controls, evidence management, and audit-ready dashboards. Doha-based.