Qatar Central Bank’s Data Handling and Protection Regulation

Right to Consent: Customers must be informed and provide explicit consent before their data is collected, processed, shared, or retained, except where required for legal, regulatory, or contractual reasons. Use cases requiring consent include sharing data with third parties, using data for marketing, and processing sensitive personal information.

Right to Review and Withdraw Consent: Customers have the right to refuse or withdraw consent at any time, except where processing is necessary for legal, regulatory, or contractual obligations. Financial institutions must provide mechanisms to manage consent, including a consent management portal where customers can view and update granted permissions.

Right to Access and Confirmation : Customers have the right to confirm whether their data is being processed and to access a copy of their data in a structured, commonly used, and machine-readable format.

Right to Rectification : If personal data is incorrect or incomplete, customers have the right to request corrections or completion of their data.

Right to Restriction of Processing : Customers may request to restrict the processing of inaccurate personal data.

Right to Deletion : Customers can request the deletion of their personal data, provided it does not conflict with regulatory requirements, contractual obligations, or the financial institution’s business continuity. A defined policy must be in place to ensure compliance with data retention rules.