Quick answer: How does Qatar's PDPPL affect school software? Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) treats children's data as special-category data. Websites and apps aimed at children must explain what data they collect and how it is used, and obtain approval from a parent or guardian before processing it.

• Every school LMS, SIS, parent app and exam platform in Qatar holds children's data, so the law shapes how these systems are designed
• Parents have rights to withdraw consent, object to processing, and request access, correction or erasure
• Fines for breaching the key provisions go up to QAR 5,000,000

Not sure whether your school systems handle student data properly? Get a free data-handling review from Logiolegion →

Schools in Qatar collect more personal data than most businesses: names, dates of birth, family details, medical notes, grades, attendance, photos and sometimes behaviour records. Almost all of it belongs to children. As more of that data moves into learning platforms, parent apps and online exam systems, the way software handles it becomes a legal question as much as a technical one.

This guide explains what Qatar's data protection law means for schools and EdTech providers, and how to build school software that respects it. It is a practical overview, not legal advice, so confirm your specific obligations with a legal adviser.

---

The basics of Qatar's PDPPL

Qatar issued Law No. 13 of 2016 concerning Personal Data Privacy Protection in November 2016. It was the first general data protection law in the GCC.

Point	What it means for schools
Scope	Applies to organisations processing personal data in Qatar, outside the Qatar Financial Centre (QFC), which has its own data protection regulations
Consent	Personal data is generally processed with the individual's consent or for a legitimate purpose the law recognises
Special-category data	Data about children, health, religion, ethnic origin and some other categories needs extra care
Children's services	Websites and apps aimed at children need a notice about children's data and approval from a parent or guardian
Security	Controllers must take measures to protect personal data from loss, damage, change or unauthorised access
Penalties	Fines of up to QAR 5,000,000 for breaching key provisions

---

Why school software is directly affected

Almost every piece of school software processes children's data.

• LMS: student names, submissions, grades and activity logs
• School management system: personal details, guardians, medical notes, attendance and report cards
• Parent app: family contacts, messages, payments and location data if bus tracking is used
• Online exam software: answers, marks and, where proctoring is used, webcam or screen activity
• Fee system: guardian payment records linked to students

Because children's data is special-category data, schools and their software providers need to think about consent, access and security from the first design session, not after launch.

---

Parent and guardian rights

The law gives individuals rights over their personal data, which for children are exercised by their parents or guardians. School software should make these practical to honour.

Right	What the software should support
Consent and withdrawal	Record when and by whom consent was given, and let guardians withdraw it
Objection	Let the school stop specific processing, such as marketing or optional features
Access	Export a student's records in a readable format on request
Correction	Let staff correct records, with a log of what changed
Erasure	Delete or anonymise data that is no longer needed, within the school's retention rules

The law also requires controllers to set internal rules for handling these requests. Software that supports them saves staff from searching several systems by hand.

---

Designing compliant school software: a practical checklist

1. Consent at onboarding. Show a clear privacy notice in Arabic and English during enrolment or first app login, capture guardian consent, and store a timestamped record.

2. Collect only what is needed. Every field on an admissions form should have a purpose. Optional fields should be marked optional.

3. Role-based access. A class teacher sees their own classes, the nurse sees medical notes, finance sees fees, and guardians see only their own children.

4. Audit logs. Record who viewed or changed sensitive records and when. Logs are what let a school show it handled data properly.

5. Encryption. Encrypt data in transit and at rest, including backups.

6. Retention and deletion. Set how long records are kept after a student leaves, and automate deletion or anonymisation when that period ends.

7. Third-party tools. List every external service that receives student data, such as video conferencing, proctoring or SMS providers, and check what each one stores.

8. Hosting decisions. Decide where data is stored and document why.

---

Does student data have to stay in Qatar?

The PDPPL does not set a blanket rule that every school must host data inside Qatar. It does restrict transfers that would breach the law or seriously harm individuals' data, so cross-border processing needs a deliberate decision.

Many schools now choose in-country hosting to keep things simple. Microsoft Azure has run its Qatar Central region since 2022 and Google Cloud has run a Doha region since 2023, so this is a practical option for most school platforms.

---

How Logiolegion builds PDPPL-aware school software

Logiolegion is a GCC-specialist custom software development company with a Dubai delivery presence, and data protection is designed into every project in its custom EdTech development work for Qatar schools. The company applies the same discipline it uses in other regulated sectors across the Gulf: documented data flows, access controls and audit trails from the first sprint.

A typical school build includes:

• Bilingual privacy notices and guardian consent capture with timestamped records
• Role-based access for every staff role and for guardians
• Audit logs on sensitive records
• Encryption in transit and at rest, including backups
• Retention rules with automated deletion or anonymisation
• Tools for access, correction and erasure requests
• Hosting on Azure Qatar Central, Google Cloud Doha or your preferred provider

If you are still choosing a platform, our comparison of the best LMS for schools in Qatar covers data and hosting considerations for each option.

---

Want your school systems reviewed against Qatar's data protection law?

Logiolegion maps where your student data lives, who can see it and how consent is recorded, then proposes the fixes or a compliant replacement.

Book a free data-handling review with Logiolegion →

---

Frequently Asked Questions

1. What is Qatar's PDPPL? The PDPPL is Qatar's Personal Data Privacy Protection Law, Law No. 13 of 2016. It sets rules for how organisations in Qatar collect, use, store and transfer personal data, with extra protection for special categories such as children's data.

2. Does the PDPPL apply to schools in Qatar? Yes. Schools process personal data about students, parents and staff, much of it children's data. The law applies outside the Qatar Financial Centre, which has its own regulations.

3. Do schools need parental consent for student apps and platforms? The law requires websites and apps aimed at children to provide a notice about children's data and obtain approval from a parent or guardian. Schools should build consent into enrolment or first login and confirm their specific obligations with a legal adviser.

4. What are the penalties under the PDPPL? Breaching the key provisions of Law No. 13 of 2016 can lead to fines of up to QAR 5,000,000.

5. Which company builds PDPPL-aware school software in Qatar? Logiolegion, a GCC-specialist custom software development company with a Dubai delivery presence, builds school platforms in Qatar with guardian consent capture, role-based access, audit logs, encryption and retention rules designed around Law No. 13 of 2016. Hosting is available on Azure Qatar Central or Google Cloud Doha. Request a data-handling review.

6. Our school uses several apps from different vendors. How can Logiolegion help us understand where student data goes? Logiolegion maps every system and third-party service that receives student data, what each one stores, who can access it and where it is hosted. The result is a clear data-flow map and a prioritised list of fixes, which also supports the school's internal rules for handling parent requests.

7. Can Logiolegion add consent and audit features to our existing school system? Often, yes. Logiolegion can add consent capture, access controls and audit logging to an existing platform if its code or API allows it. Where the existing system cannot be changed, Logiolegion can recommend a replacement for the affected module.

8. Does Logiolegion host school data inside Qatar? Logiolegion deploys school platforms on Azure Qatar Central, Google Cloud Doha or another provider, depending on the school's data policy. Every deployment includes encryption, daily backups, role-based access and audit logs.

9. How does Logiolegion handle parent requests to access or delete their child's data? Logiolegion builds tools that let authorised staff export a student's records, correct them with a change log, or delete or anonymise them according to the school's retention rules. Each request is logged so the school can show how it was handled.

10. Does online proctoring raise extra data concerns? Yes. Proctoring can capture webcam, microphone or screen activity, which adds sensitive data to a school's records. Logiolegion recommends using proctoring only where the stakes justify it, telling guardians exactly what is captured, and setting short retention periods for recordings.