Qatar PDPPL and your CRM and ERP: a practical checklist

List each system and the personal data it holds, by category and by data subject: customers, employees, suppliers, visitors, candidates. Include attachments and integrations. Tools such as ManageEngine DataSecurity Plus discover personal data in file servers; CRM and ERP inventories are done from the data model.

Record the purpose for each category and the basis relied on. Where consent is the basis, capture it in the system: a consent field with date, source and scope on the contact, and marketing preferences honoured by campaigns. Web forms and WhatsApp opt-ins should write consent to the record automatically.

Configure roles so people see only the data their job needs: field-level restrictions on national ID and bank details, HR data limited to HR, sensitive attachments restricted. Enable audit logs of views and changes. For file servers and endpoints, ManageEngine ADAudit Plus and Endpoint Central add auditing and device control.

Define retention per category: candidate data after a decision, ex-employee data after statutory periods, inactive customer data, visitor logs. Configure scheduled anonymisation or deletion, and a process to answer access, correction and deletion requests from the system rather than by searching.

Know where each system stores data and whether it leaves Qatar, including backups, integrations and support access. Where policy or the law requires, choose in-country hosting; see ERP data residency. Review vendor and processor terms.

Log and monitor access, define who is notified and how fast, and keep the evidence to notify the regulator and individuals where required. ManageEngine Log360 provides the monitoring layer for larger organisations.