Qatar passed a data protection law, the Personal Data Privacy Protection Law (PDPPL) in 2016, mirroring several other nations in the region as they collectively try to pivot their economies more toward tech and innovation. While the PDPPL only imposes financial punishments, and does not, for example, carry criminal violations or place blame on individuals as is becoming increasingly realistic under the EU's GDPR, it's presence alone does act as a guardrail against improper data usage.
However, with millions of tourists flocking to Qatar for the World Cup over the next few weeks, there have been concerns over the apps fans need to download to register for and access events. The EU has called out the apps for excessive permissions required to use them, including location sharing and granting access to your phone's camera and microphone.
As there has yet to be a high-profile instance of PDPPL enforcement to show Qatar is fully invested in data protection, these concerns over the data of fans coming into the country for the World Cup should be taken seriously.