Kindly fill up the following to try out our sandbox experience. We will get back to you at the earliest.
Discover Saudi Arabia's 2023 PDPL, its guidelines for data handling, individual rights, and penalties, ensuring privacy and security
Updated on
Saudi Arabia has enacted its first comprehensive data protection law. The Personal Data Protection Law (PDPL) seeks to secure the privacy of individuals' personal data and to regulate the acquisition, processing, disclosure, and retention of such data by organisations.
The PDPL lays out extensive requirements pertaining to processing principles, data subjects' rights, organisations' obligations when processing personal data of individuals, cross-border data transfer mechanisms, and penalties for non-compliance.
One of the most notable characteristics of the PDPL is that it does not interfere with any provision that grants a data subject a right or specifies a higher level of protection in any other law or international convention to which Saudi Arabia is a party.
In addition, the SDAIA, in collaboration with the National Data Management Office (NDMO), issued a draft version of the Executive Regulations on 10 March 2022.
The PDPL was initially scheduled to go into effect on March 23, 2022. However, the SDAIA has submitted proposed amendments to the PDPL for public comment between November 20 and December 20, 2022. The Saudi Council of Ministers approved amendments to the PDPL on March 21, 2023. According to the revised version's timeline, PDPL will go into effect on 14 September 2023, and organisations will have until 13 September 2024 to conform.
Therefore, who must comply with this law? What rights do subjects of data have? Who administers this new law? To learn more about these queries and many others to enhance your compliance efforts, continue reading:
The following describes how the new law applies to organisations based on their jurisdiction and the type of data involved:
The PDPL applies to the processing of personal and sensitive personal data pertaining to Saudi Arabian residents. The PDPL also applies to the deceased's personal information if it could be used to identify the deceased or a family member. The PDPL does not apply to the processing of personal information for domestic purposes.
The PDPL applies to any organisation, public or private, that processes personal data pertaining to individuals in Saudi Arabia. If a foreign organisation processes the personal information of Saudi Arabian citizens, the PDPL will also apply.
The PDPL imposes a number of responsibilities on controlling authorities (data administrators). Before processing personal data, data administrators (organisations) must ensure the data's accuracy, completeness, and relevance. The controlling authorities must also adhere to the data protection principles (limited collection, limited use, data security, accountability, limited retention, etc.).
The following are the essential PDPL obligations that organisations must fulfil to remain compliant:
The PDPL stipulates that organisations may not process personal data without the consent of the data's proprietor, with the exception of the circumstances outlined in the Draft Regulation.
Data subjects may revoke their consent to the processing of personal data at any time, and consent should not be required for the data controller to provide a service or benefit (unless the service or benefit is directly related to the processing activity for which consent is obtained).
The PDPL exempts the following scenarios from requiring consent:
Before collecting personal data, the PDPL mandates that organisations adopt a personal data privacy policy and make it accessible to data subjects. This policy shall include the purpose of its collection, the content of the personal data to be collected, the method of its collection, the means of its storage, the manner in which it will be processed, the manner in which it will be destroyed, the rights of its owner in relation to it, and the manner in which these rights will be exercised.
Before initiating the collection of a data subject's personal information, organisations that collect the data directly from the data subject are required to inform the data subject of the following:
The PDPL requires organisations to adopt the organisational, administrative, and technical measures and means necessary to ensure the protection of personal data, including when it is transferred, in accordance with the provisions and controls outlined in the Draft Regulations.
The PDPL stipulates that organisations must notify the regulatory authority within 72 hours of discovering a data breach. In addition, the data controller must provide the regulatory authority with a comprehensive analysis of the violation and the measures being taken to prevent a recurrence.
In addition, if the data intrusion poses a substantial danger to the personal information of the data subjects, the data controller must promptly notify them. The controller must also provide the contact information of the DPO the data subjects can contact to learn more about the compromised data.
The PDPL stipulates that organisations must appoint an individual (or multiple people) to be responsible for implementing its provisions.
According to the nature of their processing activities, the PDPL requires organisations to conduct an assessment of the consequences of processing personal data for any product or service offered to the public.
Under the PDPL, organisations are required to maintain records of their processing activities for the duration specified in the Draft Regulation. The records should contain at least the following information:
The PDPL stipulates that, when selecting the processing party, organisations must choose an entity that provides the necessary guarantees for enforcing the provisions of the PDPL and must continuously verify such entity's compliance with their instructions in all matters pertaining to the protection of personal data.
The PDPL permits transfers outside of Saudi Arabia, but stipulates that the recipient country must have regulations that guarantee the appropriate protection of personal data and a supervisory entity that requires controllers to implement appropriate procedures and mechanisms to protect personal data. To this end, SDAIA will establish evaluation criteria. In addition, Article 28 of the PDPL specifies that any of the following may serve as a transfer basis:
Preservation of the public interest, public health, public safety, or protection of the life or health of a specific individual or individuals; Performance of an obligation under an international agreement to which the Kingdom of Saudi Arabia is a party; or Performance of an obligation of the data subject under the Draft Regulations.
Previously, cross-border transmission was only permitted in exceptional circumstances and under certain conditions, such as in cases of extreme necessity to protect the life or vital interests of the data subject outside of Saudi Arabia, or to prevent, investigate, or treat an infection. In addition, SDAIA was compelled to approve each transfer individually.
As with the majority of other global data protection regulations, the PDPL ensures that all data subjects have certain rights. These rights, also known as data subject rights, guarantee that all users retain control over their collected data. Different data protection regulations provide a variety of rights for data subjects. Among those protected by the PDPL are the following:
Right to Know/Information - Data subjects have the right to know the contact information of the data controller, the precise reason the data is being collected, the methods being used to collect the data, and whether or not the collected data will be shared or sold.
Right to Request Correction - Data subjects have the right to request correction of any incomplete, inaccurate, or outdated data collected on them.
Data subjects have the right to request the eradication of data collected on them. The reasons can range from the user revoking their consent for data acquisition to the data no longer fulfilling its intended purpose.
Right to Limit/Restrict Processing - Data subjects have the right to limit or refuse the processing of their personal data by the organisation in limited circumstances and for a limited duration. This privilege is not expressly granted by the PDPL; however, the regulatory authority has published a set of Frequently Asked Questions (FAQs) that describe it.
Right to Data Portability: Data subjects have the right to obtain their personal data in a comprehensible and machine-readable format and to request the transmission of their personal data to another controller.
The data controller must ensure that all data subjects are adequately informed of these rights and establish channels for data subjects to exercise them. The data controller must respond to these requests within 30 days and document all requests received from data subjects.
Within Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA) will be primarily responsible for enforcing the PDPL. In addition to penalising organisations found to have violated the PDPL, the SDAIA is also tasked with advising organisations on internal data transfers and keeping track of data subject rights petitions received by organisations.
Nevertheless, the Saudi Data & Artificial Intelligence Authority (SDAIA) will only oversee the implementation of the new law for the first two years. Consideration will be given to transferring supervision to the National Data Management Office (NDMO) in 2024.
The PDPL stipulates that the penalty for disclosing or publishing sensitive personal data may be up to two years in prison and/or a fine of up to SAR 3 million ($800,000); therefore, both organisations and individuals can be punished.
For violations of other PDPL provisions, the maximum penalty is a warning letter or a fine of up to SAR 5 million ($1.3 million). In cases of repeated offences, the court may decide to double the sanction.
Organisations will be compelled to modify their status in accordance with the PDPL provisions within one year of the law's effective date.
Decube is one of the unified platform which is designed to efficiently manage Governance, PrivacyOps, Catalog and Observability. Not only you will be able to classify the data assets but also monitor for any incidents around that. We can help you stay compliant, schedule a demo here.
First step to AI Readiness
Table of Contents
Sneak peek from the data world.
_For%20light%20backgrounds.svg)
.svg){kind=small}
