Personal Data Protection Law

Purpose and scope

• Protects individuals' privacy by regulating the collection, processing, disclosure and transfer of personal data, and sets the data subject's rights and the obligations of those who process it.
• It applies to any processing of personal data relating to individuals in the Kingdom by any party inside or outside the Kingdom, but not to an individual's use of data for purely personal or family purposes.
• It is supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).

Key rules, rights and obligations

• The data subject has core rights: to be informed of why data is collected and the legal basis for processing, to access it and obtain a copy, to correct it, and to request its destruction once no longer needed.
• Processing is based on the data subject's consent or another legal basis such as performance of a contract or a legal obligation, and consent may be withdrawn.
• Data is collected directly from the subject and only to the extent needed for the purpose, and is not used for another purpose inconsistent with the stated one.
• The controller must have a clear privacy policy, take the necessary security measures, and notify the competent authority and the data subject of a harmful breach within the periods set by the regulation.
• Sensitive data such as health, genetic, credit and religious data receives stricter protection, and transfer outside the Kingdom is restricted under rules set by the regulation.
• Sending advertising and marketing material without the recipient's consent, and without an easy way to stop it, is prohibited.

Violations, penalties and common problems

• Disclosing or publishing sensitive data to harm the subject or for personal gain is among the most serious violations, punishable by up to imprisonment and a large fine.
• Other violations carry fines that can reach millions of riyals and are doubled on repetition, and proceeds of the violation may be confiscated.
• Common problems: posting customers' photos or data on social media, sharing phone lists for marketing, collecting more data than needed, and websites and apps with no privacy policy.
• Anyone harmed by a violation may claim compensation before the competent court.

Procedures and key deadlines

• The data subject submits his request to the controller first, which must respond within the period set by the regulation.
• Complaints go to the competent authority through its online platforms within the period set by the regulation from the violation or knowledge of it.
• Businesses must keep records of processing activities and appoint a data protection officer in the cases set by the regulation.

An advisory summary prepared by Al-Bayan Al-Wadih Law Firm. It is not an official text and does not replace the law, its implementing regulations, or advice from a specialised lawyer. The official published text and its amendments prevail.