Personal Data Protection Law in Saudi Arabia

Saudi Arabia’s first comprehensive data protection legislation, the Personal Data Protection Law (PDPL) came into effect on 14 September 2023, with enforcement due to start on the first anniversary of that date. Whilst it was initially due to come into force in March 2022, it had been delayed to allow for the Saudi Data and Artificial Intelligence Authority to include additional amendments.

The PDPL was developed to address increasing demand to bring Saudi Arabia in line with global standards relating to privacy of personal data, prevention of data misuse and regulation of data controllers, as seen recently in other jurisdictions. One week before the PDPL came into effect, the implementing regulations were also published.

Data Subject Rights

Under the PDPL, data subjects' rights include the following:

Right to access their personal data held by data controllers.
Right to be informed about the legal basis and purpose of the collection of their personal data.
Right to obtain their personal data held by the controller in a readable and clear format.
Right to request correcting, completing or updating of their personal data held by the controller.
Right to request destruction of their personal data held by the controller when such data is no longer needed.

Obligations on Data Controllers

The PDPL's obligations on data controllers include:

Notifying the regulator within 72 hours of becoming aware of a data breach and notifying, without delay, data subjects of a data breach.
Carrying out a data protection impact assessment where sensitive personal data is processed.
Providing guarantees to protect personal data and following the mandatory requirements specified in the implementing regulations for data processing agreements.
Maintaining a record of all its personal data processing in accordance with the implementing regulations.
Appointing a data protection officer, in certain circumstances.
Obtaining consent before sending advertising material where there is no prior interaction with the recipient.

Grace period and next steps

With a 12-month grace period from the date that the PDPL came into effect, data controllers still have some time to ensure compliance.

Data controllers should start to review the nature of personal data they handle and how that data is stored to understand how they will need to evolve to comply with the PDPL and the implementing regulations. Senior management should be made aware of the PDPL as soon as possible so they can start to plan changes to their processes and policies and request external support if necessary. Staff training and manuals should be updated to take account of the changes and, where necessary, a data protection officer should be appointed before the grace period expires. Data controllers should become familiar with the PDPL and, in particular, with the cross-border personal data transfer regulation if their business involves data transfers outside of Saudi Arabia.