Qatar
e-commerce licence: what websites
must show
- Topic
- E-commerce
- Published
- Reading time
- 12 min
- Written by
- Xsofty editorial team
Qatar's e-commerce licence comes with a short list of things a licensed website must show and do, and older laws on personal data, consumer protection and the Arabic language add more. This checklist takes each rule, links its source, names the page or template where it belongs, and gives a test to run before launch. It is written for store owners and the developers who build for them.
A build checklist for website owners and developers, not legal advice. Confirm how the rules apply to your business with MOCI or a Qatar-qualified adviser. Last checked against the sources on September 28, 2026.
What Decision 25 of 2026 says
Ministerial Decision No. 25 of 2026 sets the conditions for trading through websites in activities that do not need a physical location. Issued on 4 March 2026 and published in issue 5 of the Official Gazette on 15 March, it took effect the next day under its Article 7. Al Meezan, the government's legal portal, carries its seven articles in Arabic and marks its copy as unofficial. The English wording here is our working translation.
Article 2 bars trading through a website without an e-commerce licence from the Ministry of Commerce and Industry (MOCI). Article 3 requires the applicant to be in the commercial register, to hold any approvals its activity needs, and to name both the activity and the website. Article 5 lists what a licensee must do, and almost all of it lands on the site; it fills rows 1 to 8 of the checklist below. Article 6 excludes personal-use purchases that are not in commercial quantities.
MOCI launched the licence on 17 September 2026, announcing 194 approved activities, a QAR 500 issuance fee and electronic applications.
Who needs the licence, and what is still unclear
The title limits the Decision to activities that do not need a physical location. It does not say whether a business already trading from a shop under its CR also needs an e-commerce licence to sell the same range online, and the launch announcement does not settle it. If you have premises, ask the ministry before you apply, or before you assume you are exempt.
Article 1 defines a website as any technology that helps parties communicate or transact, and it names social media platforms. Article 4 requires a separate licence for each website a business trades through, and each licence records its website by name. Read together, a store taking orders on its own domain and on Instagram may need two licences. That is our reading, so confirm it with the ministry.
Because the licence names the website and changes need approval, settle the domain and the store platform before applying, not after the design is signed off.
The checklist: rule, source, where it lives, how to test it
Each row is one obligation: the primary text it comes from, the page, template or setting that meets it, and a check one person can run on a staging site or the live store.
| Rule | Primary source | Where it lives on the site | How to test it |
|---|---|---|---|
| Show the CR and e-commerce licence numbers | Decision 25/2026, Art. 5(4)(a) (opens in a new tab) | Footer on every page in both languages, and the order email | On a phone, logged out, open three pages in each language. Both numbers show and match the licence. |
| Show contact numbers, email and customer service | Decision 25/2026, Art. 5(4)(b) (opens in a new tab) | Footer, Contact page and a help link at checkout | Call and email during business hours. A person replies, and the address is not a no-reply inbox. |
| Describe the goods and services | Decision 25/2026, Art. 5(4)(c) (opens in a new tab) | Product templates, with required description fields in the CMS | Try to publish a product with no description. The CMS stops you. |
| Publish the exchange and return policy | Decision 25/2026, Art. 5(4)(c) (opens in a new tab) | A returns page linked from product pages, the cart, checkout and the order email | Reach the policy in one tap from any product page, in both languages. |
| Publish consumer protection measures and the complaints procedure | Decision 25/2026, Art. 5(4)(d) (opens in a new tab) | A complaints page with the steps, the channel and who responds, linked from the footer | File a test complaint. A named person receives and acknowledges it. |
| Offer electronic payment | Decision 25/2026, Art. 5(3) (opens in a new tab) | Checkout, through a provider authorized by Qatar Central Bank (our payments guide) | Pay for a low-value order with a Qatar-issued debit card, then refund it. |
| Trade only through the licensed website, with one licence per website | Decision 25/2026, Arts. 4 and 5(1) (opens in a new tab) | Every domain, subdomain or social account that takes orders | List every place a customer can order. Each one maps to a licence. |
| Get approval before changing licence details | Decision 25/2026, Art. 5(2) (opens in a new tab) | The release process for the domain, the site's name and any other detail recorded on the licence | Releases that touch any of these wait for the ministry's approval. |
| Show prices clearly and issue a dated invoice | Consumer Protection Law 8/2008, Art. 8 (opens in a new tab) | Product page, cart and the invoice sent after purchase | Place a test order. The invoice shows the date, item, price and quantity. |
| Give product, price, invoice and service details in Arabic | Consumer Protection Law 8/2008, Art. 17 (opens in a new tab) | Arabic fields for product attributes and prices, and an Arabic invoice template | Switch to Arabic on a product page, the cart and the invoice. No English-only field remains. |
| Disclose instalment terms before the contract | Consumer Protection Law 8/2008, Art. 15 (opens in a new tab) | The pay-later widget and the instalment step at checkout | Pick instalments. The cash price, instalment price, period, number and amount of instalments, total cost and any down payment show before you pay. |
| Write trade names and trademarks in Arabic, with Arabic more prominent | Law 7/2019 on the Arabic language, Art. 10 (opens in a new tab) | The header wordmark and the legal name in the footer | Check the Arabic name appears on both versions, and ask your adviser how prominence applies to a logo. |
| Give a privacy notice before processing personal data | PDPPL (Law 13/2016), Art. 9 (opens in a new tab) | Arabic and English privacy pages, linked from the footer and beside every form | Open each form in both languages. A privacy link sits by the submit button. |
| Get prior consent for marketing, name the sender and offer an easy opt-out | PDPPL (Law 13/2016), Art. 22 (opens in a new tab) | Opt-ins at sign-up and checkout, and every email and SMS template | Sign up with a test address. The box is unticked, consent is timestamped, and the first email names the sender, says it is marketing and has an unsubscribe link that works without a form. |
| Load advertising cookies only after the visitor opts in | NCSA direct marketing guideline, v2.0 (opens in a new tab) | The cookie banner and the tag manager's firing rules | In a private window, ignore the banner. No advertising pixels fire until you accept. |
| Tell affected people and the regulator about a breach that may cause serious damage | PDPPL (Law 13/2016), Art. 14 (opens in a new tab) | Not a page: logs, backups, admin accounts and a named incident contact | Run a tabletop test. Who spots a leak, who judges it serious, and who tells customers and NCSA? |
| Follow the extra rules for websites addressing children | PDPPL (Law 13/2016), Art. 17 (opens in a new tab) | A children's data notice and a guardian consent step, only where the site addresses children | If any section targets children, collection waits for a guardian's explicit consent. |
PDPPL in practice: forms, cookies and the privacy notice
Qatar's data protection law, the PDPPL, is Law No. 13 of 2016. The National Cyber Security Agency (NCSA) enforces it, and its guidelines on privacy notices and on direct marketing, both version 2.0 from September 2022, draw their examples from web forms, pop-up notices and cookies.
Article 9 lists what people must be told before processing starts: who the controller is, the purposes, what processing takes place and how widely the data is disclosed. The privacy notice guideline adds two points for the site: the notice should exist in each language the business serves customers in, so an Arabic checkout needs an Arabic notice, and people should be pointed to it where their data is collected rather than left to find a policy page.
The direct marketing guideline reads like a specification. No pre-ticked boxes. A consent notice above an email field and its submit button can make signing up the consent itself. One consent per channel, so email and SMS are separate choices, and no discount offered in exchange for consent. Keep a record of each consent, ideally timestamped, and name the provider that sends messages for you in the privacy notice. After someone clicks unsubscribe, do not ask them to fill in a lengthy form or send more personal data.
The guideline says advertising cookies the site does not need may load only after the visitor clicks accept. It does not settle analytics, so the simplest build holds every non-essential tag until consent, and your adviser can say whether analytics may load earlier.
Article 23 sets fines of up to QAR 1 million for breaching Articles 9, 14 and 22, among others. Article 24 sets fines of up to QAR 5 million for breaching Article 17, on children's data.
Consumer protection and the Arabic language laws
Law No. 8 of 2008 on Consumer Protection predates most online stores and makes no exception for them. Article 17 requires the information in Articles 7, 8 and 11, which cover product details, prices, the dated invoice and service terms, to be in Arabic, with other languages allowed alongside. That makes Arabic a data requirement rather than a translated interface: product attributes, price labels and invoice templates need Arabic fields that editors cannot skip.
Article 15 covers instalment sales. A pay-later widget may show only the amount of each instalment, so check your provider's widget against the six items in row 11 before you switch it on.
Law No. 7 of 2019 on the Protection of the Arabic Language covers names. Article 10 requires trademarks and trade names to be written in Arabic, allowing another language beside them only if the Arabic is more prominent, and Article 11 sets fines of up to QAR 50,000. The law does not mention websites, so how prominence applies to a logo on the English site is a question for your adviser. The build question is simpler: can the header and footer carry the Arabic name on both versions?
The Theqa trustmark criteria, mapped to pages
Theqa is Qatar's e-commerce trustmark, run under the Ministry of Communications and Information Technology (MCIT). Membership is by application, and all B2C online shops registered in Qatar are eligible. Its criteria for small and medium-sized businesses list 19 requirements, nearly all of them site elements, so they work as a second, government-written checklist even if you never apply.
| Criterion | What it asks for | Where it lives on the site |
|---|---|---|
| 1. Terms and conditions | Easy-to-find terms in dedicated sections | A terms page with general, shipping and returns sections |
| 2. Member information | Name, address, contact details and Qatar CR number | About page |
| 3. Product information | Accurate descriptions and photos of the actual item | Product template |
| 4. Pricing | Delivery, tax and other fees broken down at each step | Product page, cart and checkout |
| 5. Delivery | Times and fees in the terms and at checkout, and the exact time after ordering | Terms, checkout and order email |
| 6. Payment terms | Methods, fees, restrictions and when cards are charged | Checkout and terms |
| 7. Cancellation | A defined window for cancelling | Terms and order email |
| 8. Returns | Return, refund and exchange terms and process | Returns page |
| 9. Damage and defects | A dedicated policy and process | A terms section |
| 10. Warranty | Scope, duration and process, where offered | Product page and terms |
| 11. Privacy policy | A dedicated policy linked at the bottom of the homepage | Footer |
| 12. Personal data | A consent tick box, minimal data and SSL | Sign-up and checkout forms |
| 13. Payment data | Secure, PCI-compliant gateways | Payment fields hosted by the provider |
| 14 to 16. Sharing and storage | Marketing and third-party sharing, where data is stored and for how long | Privacy page |
| 17. Cookies | What cookies store and why | A cookies section linked from the banner |
| 18. Contact information | A physical address, phone and email | Contact page |
| 19. Complaint handling | A simple process in one dedicated section | Complaints page |
Two criteria need care. Criterion 18 asks for a physical address, which a seller without premises may not have, so ask Theqa what it accepts. Criterion 7 says Qatari law lets customers cancel for a full refund when an order is not delivered within 30 days. We have not traced the provision behind that statement, so treat it as Theqa's requirement until its source is confirmed.
Payments: electronic payment is a licence condition
Article 5(3) makes electronic payment a condition of the licence. Under Qatar Central Bank's Payment Services Regulation, merchant acquiring, meaning accepting and processing payments for a merchant, needs prior QCB authorization; the regulation names online payment gateways as an example. So ask any gateway for that authorization first, and then whether it takes cards issued in Qatar. QCB's list of retail payment systems includes QPAY, a centralized gateway launched in 2005 for e-commerce payments with debit and prepaid cards issued by banks in Qatar. Choosing a provider for your store platform is covered in our payments guide, linked from row 6.
The .qa domain: reported at launch, not yet in published text
Press reports of the 17 September launch, including The Peninsula and Qatar Living, said licensed stores must use a .qa or .com.qa domain registered through one of eight providers regulated by the Communications Regulatory Authority (CRA). The condition is not in the Decision's seven articles, and MOCI's English announcement does not mention domains. Treat it as reported at the MOCI launch and pending confirmation in published text, and check with the ministry, or in the online application itself, before you buy or move a domain.
CRA's own pages settle two related points. Anyone can register a .qa domain, while .com.qa is for companies and businesses registered in Qatar, and both go through CRA's accredited registrars. The press said eight providers, but CRA listed nine local registrars when we checked on 28 September 2026, so work from CRA's list.
Moving a store from .com to .qa
If the rule is confirmed and your store runs on a .com, treat the change as a site migration. Register the new domain early and keep the old one, which carries your links and search history.
- Map every old URL to its new equivalent and redirect each with a permanent (301) redirect. Sending everything to the homepage discards each page's history.
- Keep the redirects as long as possible; Google's site move guidance says generally at least a year.
- Point canonical tags, internal links and sitemaps at the new domain. Each Arabic and English pair needs hreflang on the new URLs, with each version listing itself and the other.
- Verify the new domain in Search Console and file a Change of Address from the old one.
- Update what lives outside the site: gateway callback and webhook URLs, Apple Pay domain verification, social profiles, ads, and SPF and DKIM records if email moves too.
- Expect the cookie banner again. A consent cookie set on the .com cannot be read on the .qa, so returning visitors are asked afresh.
- Change the domain on the licence, which under Article 5(2) needs the ministry's approval.
Keep the checklist true after launch
These rows break quietly: a rebuilt footer drops the licence number, a product goes live without Arabic fields, or a tag pasted into the theme fires before consent. Re-run the tests after any release that touches templates, checkout or tags, and re-check the sources every quarter. The domain condition is unconfirmed and the ministry may yet publish guidance; the note at the top of this article shows when we last checked.
How Xsofty can help
Xsofty is a web design and development agency, and our work for clients in Qatar is delivered remotely from Islamabad. We build the parts of this checklist that live on the site: bilingual Arabic and English stores with right-to-left layouts, footer and policy templates with required fields, consent banners wired to the tag manager, timestamped marketing opt-ins, integration with the payment provider you contract, and domain moves with page-level redirects and hreflang.
We are not lawyers, and no lawyer has reviewed this checklist. The licence application, and any question about whether a rule applies to you, belong with MOCI or a Qatar-qualified adviser; we turn their answers into templates, fields and tests. Our Qatar work includes the English and Arabic right-to-left site for Badria Kafood Architecture in Doha, GWC Directory and The Closet. Online stores start from our Commerce package at USD 4,900, and an Arabic version is an additional language at USD 450, with the translation supplied separately. Both are estimates until the scope is reviewed.
Sources
- Al Meezan: Ministerial Decision No. 25 of 2026 on e-commerce without a physical location (Arabic text) (opens in a new tab)
- MOCI: e-commerce licence launch announcement, 17 September 2026 (opens in a new tab)
- The Peninsula: press report of the launch and the .qa domain condition, 17 September 2026 (opens in a new tab)
- Qatar Living: press report of the launch and the .qa domain condition (opens in a new tab)
- CRA: Qatar domain zones and who may register them (opens in a new tab)
- CRA: accredited registrars (opens in a new tab)
- Theqa, Qatar's e-commerce trustmark (MCIT) (opens in a new tab)
- Theqa: criteria for small and medium-sized enterprises (PDF) (opens in a new tab)
- Al Meezan: Law No. 13 of 2016 on Protecting Personal Data Privacy, English translation (PDF) (opens in a new tab)
- NCSA: Privacy Notice guidelines for regulated entities, version 2.0 (PDF) (opens in a new tab)
- NCSA: Electronic Communications for Direct Marketing guidelines for regulated entities, version 2.0 (PDF) (opens in a new tab)
- Al Meezan: Law No. 8 of 2008 on Consumer Protection (opens in a new tab)
- Al Meezan: Law No. 7 of 2019 on the Protection of the Arabic Language (PDF) (opens in a new tab)
- Qatar Central Bank: retail payment systems, including QPAY (opens in a new tab)
- Qatar Central Bank: Payment Services Regulation (PDF) (opens in a new tab)
- Google Search Central: site moves with URL changes (opens in a new tab)
- Google Search Central: localized versions of your pages (hreflang) (opens in a new tab)
- Google Search Console Help: Change of Address tool (opens in a new tab)
