DevOps Doha Lusail 2 — multi-cloud managed ops

Data residency

The PDPPL imposes no blanket data-localisation requirement and does not restrict cross-border transfer by destination country, but the CRA Cloud Policy Framework's data-classification regime and Qatar Central Bank rules push government, critical and regulated financial data toward in-country hosting.

What shapes cloud procurement here

Qatar is a small, highly concentrated market where the significant cloud buyers are the state, state-linked energy companies, banks and a handful of large groups, all headquartered in Doha, and procurement typically runs through formal multi-stage tenders with long cycles rather than self-serve or land-and-expand motions. Two data-protection regimes coexist: the PDPPL (Law 13/2016) enforced by NCSA for onshore entities, and the separate QFC Data Protection Regulations 2021 administered by the QFC's own Data Protection Office for QFC-registered entities, so the applicable rules depend on the counterparty's registration. The CRA's Cloud Policy Framework establishes a cloud-first posture tied to data classification, and in-country options are narrower than in the UAE — Google Cloud Doha (me-central1) and Azure Qatar Central are live, but AWS and Oracle have no Qatari region, so residency-sensitive multi-cloud designs generally fall back to Bahrain or the UAE. Qatar had still not introduced VAT as of mid-2026, so pricing and invoicing assumptions carried over from Saudi or UAE engagements do not transfer directly.

Sector regulators