NCSA's seven PDPPL principles, applied to your website

Published 2026-10-20 · 5 min read · Samtaro Security & Legal

On 6 September 2026 The Peninsula reported an NCSA awareness post, under the slogan "Data Privacy Starts with You", setting out seven principles drawn from Law No. 13 of 2016 (The Peninsula). We checked each article reference against the law text. Below, each principle is paired with what a visitor, or an automated scan, can actually see on your website.

Principle	Where it comes from	What it looks like on a website
1. Transparency, honesty and respect for human dignity	Art. 3	A clear privacy notice linked next to every form and in the footer. Article 9 says people must be told who you are, why you process their data and who receives it before processing starts.
2. Integrity and confidentiality	Arts. 3, 8(3) and 13	HTTPS everywhere, security headers, MFA on admin accounts, no exposed backup or config files. Article 13 asks for precautions proportionate to the nature and importance of the data.
3. Purpose limitation	Arts. 5(3) and 10	Data from a contact or booking form is used for that purpose only. Adding someone to a newsletter needs its own consent.
4. Data minimisation	Art. 10	Forms ask only for what you need. A quote request rarely needs a date of birth or ID number.
5. Accuracy	Art. 10	An easy way for people to correct their details, such as an account page or a named contact address.
6. Storage limitation	Art. 10	Old form submissions, abandoned carts and CV uploads are deleted on a schedule, and the privacy notice says how long you keep them.
7. Accountability	Art. 11(5)	Internal systems for managing personal data and reporting breaches of protection measures. On the website that means a working contact route for privacy requests and a security contact such as security.txt.

Where small businesses usually slip

• A privacy policy copied from another site that names the wrong company or none at all
• Contact forms that send data over plain HTTP or to an unknown third-party form service
• Marketing pixels that load before any notice or consent (cookie consent in Qatar)
• No visible way to ask for access, correction or deletion

What a website scan can and can't tell you

An automated scan sees the public side only: whether a privacy notice exists and is linked, whether pages use HTTPS and security headers, and which trackers load. It can't see your retention schedule, staff training or internal breach procedures. Those need your own review, and NCSA publishes free guidelines and templates for them on its Personal Data Privacy Protection Department page. For compliance questions, NCSA lists [email protected] as its contact.

Start with the free mini-scan, or see the full PDPPL checklist.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.