Qatar Compliance Is a Content Problem Too

Compliance gets handed to legal. Procurement gets handed to a bid team. Content gets handed to marketing. In Qatar that division of labour quietly produces three separate problems, because the rules touching data, tenders and advertising all change what your content library has to contain and what your lead funnel is allowed to do.

This is not an argument that marketers should practise law. It is an argument that three specific frameworks have content consequences, and that discovering them after a page is published or a bid is submitted is the expensive order to discover them in.

Standard disclaimer, meant seriously: we are not Qatari lawyers. What follows is orientation on frameworks that shape delivery, and anything with money or a signature attached needs Qatari counsel.

Tenders normally go in Arabic, which makes Arabic content a procurement asset

Start with the item most marketing teams have never been told.

Qatari public procurement runs under Law No. 24 of 2015 on the regulation of tenders and auctions. That law took effect on 13 June 2016 and superseded the previous framework, Law No. 26 of 2005. It disbanded the central tendering committee that had operated under the old regime and created a procurement department within the Ministry of Finance with oversight of most government tenders, along with a unified platform consolidating tender information.

Worth pausing on the date, because outdated references circulate. If a proposal or an agency deck cites the 2005 law as the governing framework, it is describing a regime replaced roughly a decade ago. The same goes for monetary thresholds attributed to earlier statutes, which have been superseded and should not be quoted as current.

The law has also been amended more than once. A decree law in 2018 amended the preamble and nine other articles including the definition of an emergency. Executive regulations followed in 2019. A cabinet decision in 2022 amended those regulations and introduced a definition of in-country value, described as the total expenditure a contractor or service provider makes within the country to develop national businesses, services or human resources. And a further amending law arrived in 2024, which among other changes gave tender committees the right to negotiate bid modifications after envelopes are opened and required decisions to be published on the state procurement platform within two working days.

Now the content consequence. According to the United States commercial guide for Qatar, bids should be in Arabic unless the tender document specifically indicates that English is required or accepted.

Read that as a content brief rather than a legal note. It means the Arabic version of your capability statements, case descriptions, methodology explanations, technical specifications and credentials is not a marketing nicety. It is the version that goes into a bid. Organisations that treat Arabic as a translation layer maintained at low priority discover this at the worst possible moment, when a submission deadline is in a week and the Arabic material either does not exist or reads like it was machine-generated.

The same commercial guide sets out the local presence position, and it is narrower than most summaries suggest. It states that foreign architectural, contracting and engineering firms are not required to have a local presence for the bid process, but that by the time a contract is ready to be signed, participating foreign firms may need to have satisfied local establishment requirements. Note the specific sectors named. That sentence is about those industries, not about service providers in general, and no rule we found singles out marketing or search services at all. The tender document controls.

Three frameworks, and what each one changes

Here is the whole picture in one place, with the third column being the one that matters for a content plan.

Framework	Scope	Content and delivery consequence
Law No. 13 of 2016 Personal Data Privacy Protection Law	Processing of personal data by electronic means in Qatar. Supervised by the National Cyber Security Agency through its National Cyber Governance and Assurance Affairs division, with the National Data Privacy Office as the enforcing body. The Qatar Financial Centre operates a separate regime outside it.	Consent and a working opt-out belong in every lead funnel by design, not retrofitted. Direct electronic marketing needs prior explicit consent. Privacy information needs to exist in both languages. Breach notification runs to a short fixed window under the executive guidelines.
Law No. 24 of 2015 Regulation of tenders and auctions, as amended in 2018 and 2024	Public procurement across ministries and state entities, administered through a procurement department at the Ministry of Finance and a unified tender platform. Certain state enterprises sit outside the law's scope.	Arabic becomes a bid language rather than a marketing option. Capability material, methodology and credentials need Arabic versions of publishable quality. In-country value is a defined concept in the regulations, so local contribution is describable rather than vague.
Advertising and public relations licensing Decree Law No. 16 of 1993, and Law No. 1 of 2012 as amended by Law No. 5 of 2025	Licensing of advertising and public relations activity, and the regulation and control of the placement of advertisements. Oversight involves the Ministry of Culture and the Ministry of Municipality. Non-Qatari individuals and agencies apply through an institution or sponsor.	Every deliverable needs classifying before production. Placement rules do not automatically extend to organic editorial content, and organic content is not automatically exempt when it functions as advertising, collects personal data or makes regulated claims.

Three separate authorities, three separate laws, one shared implication: the decision about what a deliverable is has to happen before somebody writes it.

Data protection, and the sentence that surprises people

Qatar was the first Gulf Cooperation Council state to enact a generally applicable data protection law. Law No. 13 of 2016 governs personal data processed by electronic means in Qatar, and the supervisory structure sits under the National Cyber Security Agency, with a governance and assurance division inside it and a data privacy office as the enforcing body within that.

Naming the structure precisely matters because secondary summaries disagree with each other, citing different departments and older ministry arrangements. If a compliance section in a proposal names an authority that no longer holds the function, that is a signal about how recently the proposal's research was done.

Now the part that surprises people who assume Gulf data rules mean localisation. Cross-border transfer is permitted in principle. The law expressly recognises cross-border data flow and provides that a controller is not to restrict the transfer of personal data outside the state, unless the processing would violate the law or risk serious damage to the personal data or to the individual's privacy.

There is no blanket data-localisation mandate for this kind of work. An overseas delivery team is workable, which is the answer to a question Qatari procurement teams reasonably ask early.

What that permission does not remove is accountability. A processor agreement with defined purposes, handling for special categories of data that carry additional permission requirements, and the notification obligations remain. Enforcement is also real rather than theoretical: compliance decisions have already been issued against operators, including in the information technology and e-commerce sectors.

One more nuance worth flagging because it is genuinely contested. Some sources describe the law as applying to foreign organisations processing the personal data of individuals located in Qatar. A major legal practice guide states that the law does not contain explicit provisions on extraterritorial application and is primarily focused on processing activities within Qatar. We are not going to resolve a disagreement between legal sources in a marketing article. The practical position is to treat processor obligations as arriving through your contract with the Qatari client regardless, which is both safer and simpler than betting on an interpretation.

What this means for a lead funnel, concretely

Marketing content generates data, and that is where the data framework meets the content plan.

Consent has to be designed in rather than added. A form with a pre-ticked box, a cookie banner with no genuine refusal path, or an analytics deployment that fires before any choice is made are all patterns that make retrofitting expensive. Building them correctly the first time costs almost nothing.

Direct electronic marketing needs prior explicit consent and a working way to withdraw it. That shapes list building, gated content strategy and nurture sequences, which are marketing decisions rather than legal ones.

Privacy information needs to exist in Arabic as well as English, which sounds obvious and is regularly missed on sites where the Arabic tree was added later and inherited only the commercial pages.

And for AI visibility work specifically there is a design choice worth making deliberately. Citation tracking can run on prompts you author and brand mentions you observe, which is not personal data. Keeping the monitoring layer on non-personal data keeps it clear of the obligations attaching to personal data entirely. Where reporting genuinely needs personal data, from lead forms or self-reported attribution, the processor agreement comes before the dashboard. We describe how that measurement is structured in our search practice for the Qatari market.

Advertising licensing, and the part that is easy to get wrong

Two instruments matter here and they do different things.

Decree Law No. 16 of 1993 covers the licensing of advertising and public relations activity. On 24 February 2025 Law No. 5 of 2025 substantially amended Law No. 1 of 2012 on the regulation and control of the placement of advertisements, statues and memorials, expanding the scope and strengthening enforcement, with oversight involving the Ministry of Culture and the Ministry of Municipality.

There is also a licensing route for content creators. The Ministry of Culture operates a licence to conduct advertising and public relations activity, under which registered content creators are classified as personal advertisers. Qatari nationals may apply independently, while non-Qatari individuals and agencies apply through an institution or sponsor. The purpose of the licence is described as covering designing advertisements, promoting the marketing of specific goods or services, running advertising campaigns and managing public relations activity.

That description is closer to what an agency does than most agencies realise, which is the point of raising it.

Now the classification trap, stated in both directions because both errors happen.

The first error is assuming advertisement placement rules extend automatically to organic editorial content. They are written about placement, and treating a blog article as a billboard produces unnecessary friction and bad advice.

The second error is assuming organic content is automatically exempt. It is not exempt when it functions as advertising, when it collects personal data, when it makes claims in a regulated area, or when it is distributed through licensed media. The label on the file does not determine the treatment.

The workable practice is boring and effective: classify each deliverable before producing it, write the classification down, and revisit it if the distribution plan changes. A piece written as editorial and later promoted as paid media has changed category, and somebody should notice at the point of change rather than afterwards.

The operating calendar, which is a delivery constraint not a footnote

One last framework, and it is the one that shapes day-to-day delivery more than any of the laws.

Qatar's working week runs Sunday to Thursday, with Friday and Saturday as the weekend, across government, private sector, banks and schools. Working hours are capped at eight per day and forty-eight per week, reducing during Ramadan under Article 73 of the Labour Law.

An agency working a Monday to Friday week shares four working days with a Qatari client. Monday through Thursday. Sunday is a full working day in Doha and a weekend day for the agency. Friday is the reverse.

Doha operates at three hours ahead of coordinated universal time. Indonesian operations span seven and eight hours ahead depending on the office, which puts the gap at four to five hours and places a Qatari morning inside an Indonesian afternoon. That is a workable window for live calls rather than a problem needing apology.

The commitments that follow are simple and are noticed immediately when they are absent. Deliverables due before end of business Thursday in Doha, not Friday. Sunday covered for approvals and urgent items. Calls scheduled in the Qatari morning. And review cycles during Ramadan planned in advance around the shortened statutory day rather than discovered mid-campaign.

An agency that treats Sunday as dead time and pushes work to Friday has misread the calendar, and a client feels that every single week. It is the least technical item in this article and probably the one that decides the most renewals.

The short version

Public procurement in Qatar runs under Law No. 24 of 2015, in force since June 2016 and amended in 2018 and again in 2024, administered through a department at the Ministry of Finance and a unified tender platform. Bids normally go in Arabic unless the tender document says otherwise, which turns Arabic capability material from a marketing option into a procurement asset. Local establishment requirements can apply before signature, and the specific guidance naming that requirement is about architecture, construction and engineering firms rather than service providers generally, so the tender document controls.

Law No. 13 of 2016 governs personal data processed electronically in Qatar, supervised through the National Cyber Security Agency with a data privacy office as the enforcing body. Cross-border transfer is permitted in principle and there is no blanket localisation mandate, so an overseas team is workable, but the processor agreement, purpose definitions and notification obligations remain, and enforcement decisions have already been issued.

Advertising and public relations activity is licensed, placement is separately regulated under a 2012 law substantially amended in February 2025, and non-Qatari agencies route licensing through an institution or sponsor. Classify every deliverable before producing it, in both directions, because placement rules do not automatically cover editorial content and editorial content is not automatically exempt.

Then the simplest thing: work the Qatari week. Four shared working days, Thursday deadlines, Sunday covered, Ramadan planned. For the wider technical and strategic picture around all of this, our team has documented the full scope for this market.

---

Frequently asked questions

Which law governs public tenders in Qatar, and does it matter if a proposal cites an older one?

Law No. 24 of 2015 on the regulation of tenders and auctions is the governing framework. It took effect on 13 June 2016 and superseded Law No. 26 of 2005, disbanding the central tendering committee that had operated under the previous regime and creating a procurement department within the Ministry of Finance alongside a unified tender platform. It has been amended more than once, including by a decree law in 2018 and a further amending law in 2024, with executive regulations in 2019 and a cabinet decision in 2022 that introduced a definition of in-country value. So yes, it matters: a document citing the 2005 law as current is describing a regime replaced roughly a decade ago, and monetary thresholds attributed to earlier statutes have been superseded and should not be quoted as current.

Do we have to submit bids in Arabic?

Normally yes. According to the United States commercial guide for Qatar, bids should be in Arabic unless the tender document specifically indicates that English is required or accepted. The practical consequence is a content one rather than a translation one: capability statements, methodology explanations, technical specifications and credentials all need Arabic versions of publishable quality, written natively rather than machine-translated, with consistent terminology maintained across documents. Organisations that keep Arabic as a low-priority translation layer discover this when a submission deadline is a week away, which is the most expensive moment to discover it.

Does our data have to stay inside Qatar to use an overseas agency?

No. Law No. 13 of 2016 expressly recognises cross-border data flow and provides that a controller is not to restrict the transfer of personal data outside the state, with intervention reserved for cases where the processing would violate the law or risk serious damage to the data or to the individual's privacy. There is no blanket data-localisation mandate covering this kind of work, so an overseas delivery team is workable. What the permission does not remove is accountability: a processor agreement with defined purposes, additional permission requirements for special categories of data, and notification obligations all remain. Note also that clients registered in the Qatar Financial Centre fall under that centre's separate regime rather than this law.

Which authority actually enforces Qatar's data protection law?

The supervisory structure sits under the National Cyber Security Agency, with a national cyber governance and assurance division inside it and a national data privacy office as the enforcing body within that. This is worth naming precisely because secondary summaries disagree with one another, citing different departments and older ministry arrangements, and a compliance section that names an authority no longer holding the function is a signal about how recently the research behind it was done. Enforcement is active rather than theoretical, with compliance decisions already issued against operators including in the information technology and e-commerce sectors.

Do we need an advertising licence for a content marketing programme?

It depends on what each deliverable actually is, which is why classification has to happen before production rather than after publication. Advertising and public relations activity is licensed under Decree Law No. 16 of 1993, and the placement and control of advertisements sits under Law No. 1 of 2012 as substantially amended by Law No. 5 of 2025 in February that year, with oversight involving the Ministry of Culture and the Ministry of Municipality. There is also a Ministry of Culture licence covering advertising and public relations activity under which registered content creators are treated as personal advertisers, with non-Qatari individuals and agencies applying through an institution or sponsor. Two errors are equally common: assuming placement rules extend to organic editorial content, and assuming organic content is exempt when it functions as advertising, collects personal data or makes regulated claims.

How does the Qatari working week change how an engagement should run?

Qatar works Sunday to Thursday with Friday and Saturday as the weekend, across government, private sector, banks and schools, with hours capped at eight per day and forty-eight per week and reducing during Ramadan under Article 73 of the Labour Law. An agency on a Monday to Friday week therefore shares four working days, Monday through Thursday. Doha sits three hours ahead of coordinated universal time while Indonesian operations span seven and eight hours ahead, a gap of four to five hours that places a Qatari morning inside an Indonesian afternoon. The commitments that matter are unglamorous: Thursday deadlines rather than Friday, Sunday covered for approvals, calls in the Qatari morning, and Ramadan review cycles planned ahead rather than discovered mid-campaign.

---