Elaboration and Developing Privacy Policy Guideline
Saudi Arabia · Guideline · SDAIA
Our summary
This guideline assists organizations covered by Saudi Arabia's Personal Data Protection Law in creating and implementing privacy policies that comply with regulatory requirements. It specifies ten key elements that privacy policies must address, including data collection methods, processing purposes, retention periods, and data subject rights. The document provides a standard template to help entities inform individuals about personal data handling practices before collection occurs.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
14 sections
Jump to a chapter
Introduction
This guideline supports entities in preparing privacy policies that comply with the Personal Data Protection Law, particularly the requirement to inform data subjects about collection purposes, data types, processing methods, storage, deletion, and how to exercise rights. It applies to controllers collecting or processing personal data within or outside the Kingdom if it concerns individuals residing in the Kingdom.
Objective
The guideline aims to help entities implement the Law, adopt privacy protection best practices, develop effective privacy policies, enable data subjects to exercise their rights, and safeguard individual privacy.
Privacy Policy Key Elements
A privacy policy must disclose what personal data is collected, why it is processed, how it is used, the legal justification for collection, which parties receive the data, where processing occurs, how long data is kept, how it is destroyed, what rights individuals have, and how to contact the organization about these matters.
First: Entity Name and Activity
Controllers must include their official registered name and a description of their tasks, specializations, services, and target audience in the policy, referencing the Law's provisions on legal bases for processing.
Second: Contact Information and Update Record
Controllers must provide contact details such as phone, website, and address, and if required to appoint a data protection officer, must identify that officer and provide their contact information for inquiries about data processing and rights.
Third: Personal Data to Be Collected
Controllers must describe all personal data they will collect, categorized by type or source such as account data, payment data, location data, and data from third parties or cookies, and indicate whether each type is mandatory or optional.
Fourth: Collecting Personal Data Methods and Purposes
Controllers must distinguish between data collected directly from individuals and data collected indirectly, clearly state the purposes for collection related to their activities, specify which legal basis they rely on, ensure collected data is limited to what is necessary, and ensure consent is not improperly required for access to services.
Fifth: Personal Data Processing
Controllers must precisely explain how they process personal data to fulfill stated purposes, potentially using a structured approach that maps general objectives to specific operations across the data lifecycle stages, and may present this in tables or clear text.
Sixth: Personal Data Sharing
Controllers must disclose whether personal data is shared with other organizations inside or outside the Kingdom, identify those recipients, describe them, and specify whether sharing occurs once or repeatedly.
Seventh: Personal Data Storage, Retention Period, and Destruction
Controllers must describe where and how personal data is stored, specify how long each data type is retained according to law, explain destruction methods that prevent recovery, and detail the administrative, technical, and organizational security measures used to protect data from loss, damage, or unauthorized access.
Eighth: Personal Data Subjects Rights
Controllers must inform data subjects of their rights under the law, explain how to exercise those rights through accessible channels such as email, text or apps, and specify response timeframes. Data subjects have rights to receive notification about data collection, access their information in clear formats, request corrections or deletion, withdraw consent, submit complaints to authorities, and seek compensation for violations.
Ninth: Complaint and Objection Filing Mechanism
Controllers must establish a process for data subjects to file complaints or objections, including when controllers fail to honor data subject rights or when data subjects object to processing. Controllers must identify the responsible department, provide contact information and processing timelines, and inform data subjects about escalation to the Saudi Data and AI Authority if dissatisfied.
Tenth: Availing and Providing Access to Privacy Policy
Controllers must make privacy policies readily accessible in plain language suited to all data subject categories and periodically review and update them. Controllers should notify individuals of the policy through notifications, SMS, email or forms before collecting data, and may enhance clarity through visual aids, logical organization, targeted design for special groups, appropriate languages, and links to related documents.
Detailed Model for Privacy Policy
Entities must develop a privacy policy disclosing their responsibilities, services, contact information, and update dates, specifying what personal data they collect, how and for what purposes, how they use and disclose it, the legal basis for processing (consent, contractual obligations, statutory requirements, vital interests, public interest or legitimate interests), and where and how long they store it before secure disposal. Entities must inform data subjects of their rights to be informed about data collection and processing, to access their data in readable format, to request correction and destruction in certain circumstances, and to withdraw consent at any time, and must respond to rights requests within a specified number of days at no cost. Data subjects may file complaints with the entity's designated department or, if unsatisfied within a specified number of days, escalate to the Saudi Data and AI Authority.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 8 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 2 of 4
- Automated decision-making rights, not covered
- Biometric identification and surveillance, not covered
Roles and organisation 1 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Objective 4 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers should implement the provisions of the Personal Data Protection Law.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should adopt best practices to ensure the privacy and protection of personal data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should develop privacy policies with appropriate content and design.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should enable data subjects to exercise their rights as stipulated in the Law.
Privacy Policy Key Elements 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must disclose in their privacy policy the categories of personal data collected, the purpose and legal basis for processing, the method of use, which parties receive the data, where processing takes place, how long data is retained, how it is destroyed, data subject rights and how to exercise them, and the means to contact the organization about these matters.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must commit to making individuals' personal data accessible to them in formats that are transparent and presented in a usable manner, such as through links on websites or within applications.
First: Entity Name and Activity 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers must include their official registered name and a brief overview of their tasks, specializations, activities, services and target group in their privacy policy.
Second: Contact Information and Update Record 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must provide their phone number, website, and postal address.
- ObligationApplies to: ControllerDrafted by the Index
Controllers required to appoint a data protection officer must identify that officer and provide their contact details.
Third: Personal Data to Be Collected 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must describe all personal data they will collect, organized by type or source such as account data, payment data, location data, and data from third parties or cookies.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must tell individuals whether collection of each type of personal data is mandatory or optional.
Fourth: Collecting Personal Data Methods and Purposes 4 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must distinguish between methods of collecting personal data directly from individuals and methods of collecting personal data from other sources.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must explicitly state the purposes for collecting personal data, ensure such purposes are related to their activities and lawful, and specify which legal basis they rely on.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must limit personal data collected to the minimum necessary and ensure data is accurate and collected through clear, direct, and honest methods.
- ProhibitionApplies to: ControllerDrafted by the Index
Controllers must not make access to a service conditional on consent unless the service is directly related to the personal data being processed.
Fifth: Personal Data Processing 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must clearly explain how they process personal data to achieve the purposes they have stated.
- Applies to: ControllerDrafted by the Index
Controllers may present processing operations in a table format or clear text that maps purposes through stages of the data lifecycle such as collecting, storing, using, sharing, and destroying.
Sixth: Personal Data Sharing 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers must inform data subjects whether their personal data will be shared with other organizations inside or outside the Kingdom, identify those organizations, describe them, and specify whether sharing occurs once or repeatedly.
Seventh: Personal Data Storage, Retention Period, and Destruction 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must describe where and how personal data is stored, including whether it is kept at their own headquarters or with external providers such as cloud service operators, whether inside or outside the Kingdom.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must specify how long each type of personal data is retained according to applicable law and clarify the methods used to destroy personal data after it is no longer needed, ensuring it cannot be viewed or recovered.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must explain the administrative, technical and organizational measures they have implemented to protect personal data from loss, damage or unauthorized access, including encryption, anonymization and coding, scaled to the sensitivity and volume of data collected.
Eighth: Personal Data Subjects Rights 8 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must explain to data subjects which rights the law grants them regarding their personal data and provide accessible channels such as email, text messages or electronic applications through which data subjects can exercise those rights.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must set and communicate the timeframe within which they will respond to requests from data subjects related to their rights.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to be informed of the legal basis and purpose of data collection and to be notified if their personal data will be used for a purpose different from its original purpose without their prior consent.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to obtain a copy of their personal data held by the controller upon request or through automatic means that the controller provides without requiring a formal request.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to request that their personal data be provided in a readable and clear format, either in a commonly used digital format or as a printed copy.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to request that their personal data held by the controller be corrected, completed or updated.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to request deletion of their personal data when it is no longer needed to fulfil the purpose for which it was collected.
- RightApplies to: OthersDrafted by the Index
Data subjects have the right to withdraw consent for processing their personal data at any time, except where a legal basis other than consent authorizes the processing, and controllers must provide accessible means for withdrawal.
Ninth: Complaint and Objection Filing Mechanism 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must establish a mechanism for data subjects to file complaints or objections when they are unable to exercise their rights or when they object to processing.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must identify the responsible department for receiving and processing complaints, provide its contact details and processing timeline, and inform data subjects about escalation to the Saudi Data and AI Authority if dissatisfied.
Tenth: Availing and Providing Access to Privacy Policy 7 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must make privacy policies available using clear, straightforward language that is understandable to all categories of data subjects they serve.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must notify individuals about their privacy policies and the collection of their personal data through methods such as app notifications, text messages, emails or standalone forms before or during data collection.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must periodically review their privacy policies and maintain a documented record of any amendments or updates made to them.
- Applies to: ControllerDrafted by the Index
Controllers should enhance privacy policy clarity by using visual elements such as pictures and icons that help readers quickly understand the content.
- Applies to: ControllerDrafted by the Index
Controllers should improve readability by organizing clauses and paragraphs in a logical sequence with clear titles that encourage rapid comprehension.
- Applies to: ControllerDrafted by the Index
When targeting special groups such as children, elderly people or persons with disabilities, controllers should design privacy policies in language and format tailored to their specific needs.
- Applies to: ControllerDrafted by the Index
Controllers may include related links within privacy policies to documents such as terms and conditions, cookie policies and data protection law references.
Detailed Model for Privacy Policy 5 controls
- ObligationApplies to: ControllerDrafted by the Index
A privacy policy template must include the controller's name, an outline of its activities and services, target audience served, contact information and the date of last update along with access to the update history.
- ObligationApplies to: ControllerDrafted by the Index
A privacy policy template must list the categories of personal data collected and their classification, the methods by which direct collection occurs, and the purposes for which each category is collected.
Change history
No changes recorded since we began monitoring this policy.