Qatar's Law No. 13 of 2016 sets duties for anyone processing personal data in Qatar. Much of what it asks, a privacy programme already does. Purplecop maps the law onto the controls you run for GDPR and other frameworks, so you add the difference instead of starting again.
How Qatar's law joins a programme you already have.
Another law added to one programme, not another tool.
The PDPPL is not a ready-made framework in the library yet. Our practitioners author its clauses in the platform and map them to the controls you already run, so you start from existing work.
A control shared across frameworks is created once in the library, not rebuilt for each one. The work you do for the PDPPL counts toward everything else you hold.
Privacy notices, retention, rights handling and more, tagged to the laws they serve.
A policy exception carries a justification, risk tier, compensating control and expiry date, so a temporary waiver cannot become permanent by accident.
Corrective actions run through a tracked workflow with 5-Whys and fishbone analysis, ageing buckets and three escalation tiers.
External auditors get read-only access enforced on the server, across four roles from Lead Auditor to Observer — with one exception: they can raise a correction request when a requirement is not met.
Privacy laws across jurisdictions on one records-and-rights engine, on the same control library as Purplecop GRC.
The team that runs your engagement works inside the same system, so the work they do stays with you.
Also on the platform
Onboard, assess, score and continuously monitor every vendor in one workflow.
Asset discovery, network monitoring and the audit log in one module, so every asset’s data lives in one place.
Live phishing campaigns with per-user risk scores, run entirely in-house.
Role-based security awareness training for every employee, tracked to completion.
A directory of the people in scope for training, policy sign-off and access reviews.
Role-based access control with granular permissions, on a least-privilege model.
Not as a ready-made framework. Our practitioners build it into the platform on top of your existing privacy controls.
Qatar's law is usually abbreviated PDPPL: the Personal Data Privacy Protection Law.
No. Where a control serves both laws, it is done once.
It scales with how much you integrate: the more connectors you turn on, the more evidence is collected automatically, saving up to 70% of the time you used to spend preparing for each audit.
We will walk the product against your scope and show you what runs on day one and what needs configuring.
