Qatar Outbound Calling Compliance: CRA (2026)

Qatar rewrote its telecom consumer rulebook in October 2024 and rolled out mandatory caller-name presentation across late 2025 and early 2026. Both land directly on outbound diallers, and the calling window is one of the few in the Gulf stated in plain terms.

Qatar outbound compliance at a glance

Who regulates outbound calling in Qatar

The CRA regulates the ICT sector under Decree-Law No. 34 of 2006 as amended by Law No. 17 of 2017. Its October 2024 Communications Consumer Protection Regulation binds Telecommunication Service Providers, so the calling-hours and consent rules bite on operators directly and on marketers through a contractual flow-down.

The instrument that reaches a third-party dialler directly is the Spam Regulation, binding on Service Providers and on any person or organisation providing, sending or using electronic communications. Voice is in scope: the definition runs through the PDPPL, which covers sound, and the Spam Regulation requires operators to disclose the length of calls from any number suspected of originating spam. Data protection is not with the ministry: under Amiri Decree No. 1 of 2021, National Cyber Governance and Assurance Affairs inside NCSA is the competent department for enforcing the PDPPL.

Consent and opt-out

PDPPL Article 22 forbids transmitting any electronic communication to an individual for direct marketing except after obtaining prior consent, and requires the communication to carry the originator's identity, state that it is direct marketing, and give a valid address through which the individual can ask to stop. Article 4's lawful-purpose alternative does not rescue marketing, because Article 22 is a specific prohibition.

The October 2024 Regulation makes consent narrow. It is given only for a specific sender and purpose identified when it was taken, the message must bear a direct relationship to both, and it is not transferable from one party to another, so a purchased or rented list cannot carry valid consent in Qatar. The party seeking consent must keep written, voice or electronic records showing its nature and extent and how and when it was obtained, identify the actual advertiser, and provide a callback number even where a call centre runs the campaign. Under the Spam Regulation the sender must be able to demonstrate a consent's validity at any point in time.

Withdrawal is time-bound: effect must be given without delay and at most within two business days, after which any further message counts as spam. Transactional messages are outside the restriction, and no maximum validity or expiry of consent appears in any of the three instruments.

Do Not Call

Qatar has no national Do Not Call register and no statutory scrubbing duty for marketers. The mechanism is an operator-side block: Service Providers must let customers block one, several or all direct-marketing providers for their numbers through a unified electronic channel or customer service, free of charge, with a confirmation.

Whether that unified channel is live, and who runs it, could not be confirmed. What is certain is the flow-down: Service Providers must ensure any party they supply with numbers, codes or a Sender ID for direct marketing is contractually bound to comply. The practical sanction for a noisy dialler is disconnection, since the CRA can require the operator to terminate the contract of service and suspend the customer's access.

Calling hours and days

Direct marketing messages or communications must be sent between 09:00 and 21:00, excluding email. The 2017 Spam Regulation states the same window from the other side as a prohibition on direct marketing between 21:00 and 09:00.

Neither instrument names a time zone, so treat any UTC mapping as inference and set the campaign zone to Qatar local time. No weekend or public-holiday restriction exists either: the rule is a clock rule with no day qualifier. There is also no numeric frequency cap, only the older requirement quoted inside the Spam Regulation that the frequency of contact for advertising be non-intrusive.

Caller ID and number presentation

Direct marketing must clearly identify its sender and purpose and must not carry deceptive subject headers. A reachable return number is required even where a call centre runs the campaign, so a non-routable or unanswered outbound CLI does not satisfy the rule.

Caller Name Presentation matters most operationally. CNAP is mandatory for all local corporate telephone numbers in Qatar, enrolment is automatic and not optional, and the displayed name comes from the operator's subscriber database populated from official registration certificates, so a business cannot choose its own display name. It is capped at 25 English characters, English only, and does not work for international or roaming calls or personal numbers. Phase 1 covers corporate fixed lines and Phase 2 extends to corporate mobiles with an opt-out for numbers not used for public calling. No effective date is published for either phase.

No dedicated anti-spoofing or CLI-withholding rule exists in the telecom consumer instruments. The only express CLI-presentation duty is accurate, real-time CLI for emergency calls.

Call recording and notices

No marketing-call recording notice or consent rule exists in the CRA consumer instruments, and neither carries any rule specific to automated diallers, pre-recorded messages, IVR broadcast or abandoned calls.

What applies instead is the confidentiality rule. Executive By-Law Article 91 bars Service Providers from intercepting, monitoring or altering the content of customer communications except with the customer's explicit consent or as the law permits, and Telecom Law Article 69(2) criminalises recording the content of a telecommunications message without a legal basis, with up to one year and a fine up to QAR 100,000. Recording is expressly contemplated as consent evidence, since the Regulation accepts voice records, but a recording of an identified individual is personal data. No retention period is published.

Messaging rules for SMS and WhatsApp

The messaging rules are the most prescriptive part of the regime. A marketing message must identify the person who requested its sending, carry accurate contact details in Arabic and English valid for at least 30 days, offer a free unsubscribe on the same channel the message used, name STOP and its Arabic equivalent as the keyword without case sensitivity, and confirm the unsubscription back. Sender IDs are allocated through the licensed operator under the flow-down clause; no CRA-operated Sender ID registry could be confirmed.

Data protection and retention

The PDPPL's lawful basis for marketing is prior consent, and direct marketing is defined medium-neutrally as sending advertising or marketing material by whatsoever means, so voice, SMS and email all fall in. Article 9 requires a pre-processing notice, Article 14 breach notification where serious damage may result, and Article 16 makes special-nature data processable only with the competent department's permission. Any contract made in violation of the PDPPL is null and void.

Cross-border transfer runs the opposite way to most of the region. Article 15 forbids a controller from taking any measure that may limit cross-border data flow unless the processing breaches the Law or may cause serious damage to the data or the individual's privacy, and there is no adequacy list, standard clauses requirement or transfer approval onshore. Retention is purpose-limited with no fixed period, and NCSA guidance asks for a documented retention policy and periodic review. The QFC is a separate, GDPR-shaped regime where the marketing rule is an absolute opt-out rather than an opt-in.

Penalties and enforcement

PDPPL Article 23 sets a penalty not exceeding QAR 1,000,000 for violating Articles 4, 8 to 12, 14, 15 and 22, so unconsented marketing sits at the top of that band. Article 24 raises the ceiling to QAR 5,000,000 for security and special-nature-data breaches, and Article 25 sets up to QAR 1,000,000 for a legal person where a crime is committed in its name.

On the telecom side there are two tracks. Criminally, Article 66 carries up to one year and QAR 50,000 for using a network to disturb or abuse a person, Article 69 up to one year and QAR 100,000 for unlawful recording, and Article 70 up to two years and QAR 100,000 for breaching the customer-information and fair-practice articles, doubled for a repeat within three years. Administratively, a Financial Sanctions Committee at the CRA can sanction a licensee under Schedule No. 1, where customer-protection instructions carry up to QAR 1,000,000 plus up to QAR 10,000 per day. Contracting out of the Regulation has no effect.

What changed in 2025 and 2026

The October 2024 Regulation's compliance clocks fell in 2025: nine months from entry into force to amend contracts and third-party contracts, then 30 days to notify the CRA. Measured from 2 October 2024 that ran to roughly mid-2025. The exact entry-into-force date is not published, so use the issuance date rather than a precise deadline.

CNAP rolled out across late 2025 and early 2026, the most consequential recent change for anyone dialling Qatari mobiles from a Qatari corporate number. Whether the 2017 Spam Regulation was formally repealed by the 2024 Regulation could not be confirmed: it is absent from the CRA's current Regulatory Framework index but still downloads. Treat both as applicable and comply with the stricter on each point; they agree on the window, and the Spam Regulation's two-business-day withdrawal and bilingual STOP keyword are stricter. No pending CRA consultation touches marketing, and the PDPPL has not been amended.

How DialerBee supports each rule

Qatar does not ship as a jurisdiction pack, so calling hours and suppression are configured per tenant. Compliance Autopilot checks each attempt against the suppression list, the calling-hours window, the consent record, the caller ID's ownership, the frequency limit and the phone format, which puts the 21:00 cut-off in the platform rather than in an agent's head.

Consent is tracked per contact with its source, timestamp and channel, and because Qatari consent is specific to one sender and purpose and cannot be transferred, per-tenant isolation does real compliance work: one client's consent record never becomes another client's calling list. Caller-ID pool control governs which number each campaign presents, which matters where CNAP shows the registered company name and the Regulation demands a reachable return number. Recording carries configurable retention per campaign and per tenant plus legal hold. WhatsApp and SMS run on your own tenant configuration and sender IDs with a template library, so the bilingual STOP keyword and the 30-day contact details can be built into the templates. These are compliance-supporting controls that help you meet your obligations; they do not replace legal review.

Qatar outbound compliance checklist

• Dial and message only between 09:00 and 21:00 Qatar local time, and set the campaign zone explicitly.
• Take prior consent before any direct-marketing communication, and record how and when it was obtained.
• Tie each consent to one named sender and purpose, never reuse it for another party, and reject bought lists.
• Give every marketing message and call an identified sender and a stated purpose.
• Publish a return number that is actually answered, even when a call centre runs the campaign.
• Action a withdrawal within two business days and send a confirmation back.
• Offer STOP and its Arabic equivalent, case-insensitive, on the same channel the message used.
• Keep message contact details valid and reachable for at least 30 days after sending.
• Get explicit consent or another lawful basis before recording, since unlawful recording is criminal.
• Check whether your entity falls under the QFC regime, where the marketing rule is an absolute opt-out.
• Comply with the stricter of the 2024 Regulation and the 2017 Spam Regulation on every point.

Sources

1. Communications Consumer Protection Regulation, ref CRACA/2024/10/02, October 2024 (CRA). cra.gov.qa
2. Spam Regulation (Amended), 6 August 2017, ref CRA-CA-4902-17 (CRA). cra.gov.qa
3. Telecommunications Law No. 34 of 2006 as amended by Law No. 17 of 2017, including Schedule No. 1 (CRA). cra.gov.qa
4. Executive By-Law No. 1 of 2009 to the Telecommunications Law (CRA). cra.gov.qa
5. Caller Name Presentation service page and FAQs, retrieved 11 September 2026 (CRA). cra.gov.qa
6. Law No. 13 of 2016 on Protecting Personal Data Privacy, issued 03/11/2016, English text published by NCSA. ncsa.gov.qa
7. QFC Regulation No. 6, Data Protection Regulations 2021, consolidated VER 3, December 2023. qfcra-en.thomsonreuters.com

Frequently asked questions

Who regulates outbound calling in Qatar?

The Communications Regulatory Authority, CRA, under the Telecommunications Law and its October 2024 Communications Consumer Protection Regulation. Personal data is supervised by the National Cyber Security Agency through National Cyber Governance and Assurance Affairs under the PDPPL, Law No. 13 of 2016, not by the ministry.

What are the permitted calling hours in Qatar?

Direct marketing messages or communications must be sent between 09:00 and 21:00, with email excepted, and the 2017 Spam Regulation states the same window as a prohibition on marketing between 21:00 and 09:00. Neither instrument names a time zone, so set the campaign to Qatar local time and treat any UTC mapping as inference.

Does Qatar have a national Do Not Call register?

No. The block runs at the operator instead: Service Providers must let customers block one, several or all direct-marketing providers for their numbers, free of charge and with a confirmation. Whether the unified electronic channel the Regulation mandates is live, and who runs it, could not be confirmed.

Can I use a purchased list for marketing calls in Qatar?

No. Consent is given only for a specific sender and purpose identified when it was taken, the message must bear a direct relationship to both, and consent is not transferable from one party to another. A purchased or rented list therefore cannot carry valid consent, and the sender must be able to demonstrate the validity of a consent at any point in time.

What is CNAP and does it affect outbound campaigns?

Caller Name Presentation displays the name behind a number before the call is answered, and it is mandatory for all local corporate telephone numbers in Qatar with automatic, non-optional enrolment. The displayed name comes from official registration certificates, so a business cannot choose it, and it is capped at 25 English characters. It does not apply to international or roaming calls. The CRA publishes no launch or phase date, so none should be quoted.

What fines apply in Qatar?

PDPPL Article 23 sets up to QAR 1,000,000 for breaching Article 22, the direct-marketing article. The Telecommunications Law's Schedule No. 1 lets the CRA's Financial Sanctions Committee impose up to QAR 1,000,000 plus up to QAR 10,000 per day on a licensee for customer-protection breaches, and Article 69 carries up to one year and QAR 100,000 for recording a communication without a legal basis.

Related reading

• Qatar outbound dialer overview
• Compliance Autopilot
• Caller-ID pool control
• MENA compliance guide

This article is for general informational purposes and is not legal advice. Confirm current requirements with the CRA, NCSA and qualified local counsel.