Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
These guidelines establish requirements and procedures for multinational business groups to create Binding Common Rules that ensure personal data transferred outside Saudi Arabia receives protection equivalent to the national standard. Controllers and processors must document their data transfer arrangements, implement protective measures, and cooperate with the Saudi Data & AI Authority. The rules apply to all cross-border transfers by entities located within the Kingdom to countries or organizations lacking adequate data protection.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
9 sections
Jump to a chapter
Introduction
This guideline is based on Saudi Arabia's Personal Data Protection Law and its amendments, addressing how controllers may transfer personal data outside the Kingdom. It sets out rules that apply when controllers receive exemptions from standard protection requirements under the law and related transfer regulations.
Purpose
These guidelines ensure that personal data transferred to countries or organizations without adequate protection maintains a standard equivalent to Saudi Arabia's law. They establish obligations for parties transferring or disclosing data and explain that binding common rules are one safeguard that controllers may use alongside other mechanisms such as standard contractual clauses or approved certifications.
Definitions
This section defines key terms used throughout the guidelines, including the law, competent authority (SDAIA), binding common rules, and various related concepts. It specifies that binding common rules are standards set by controllers for multinational groups to ensure personal data transferred outside the Kingdom receives protection meeting Saudi legal requirements.
Scope
Establishes requirements and guidance for Binding Common Rules that govern data controllers and processors handling personal information under controller direction. Applies when organizations move personal data to jurisdictions or entities outside the Kingdom lacking sufficient data protection safeguards, while preserving controller accountability to authorities and data subjects.
The Geographical Scope of Binding Common Rules
Binding common rules cover all personal data transfers by controllers located within Saudi Arabia to any destination outside the Kingdom.
Requirements for Binding Common Rules
Entity groups must ensure binding common rules incorporate controller obligations and data subject rights under the law, obtain internal authorization, achieve legal enforceability across all group members, and include supplementary policies on protection measures, rights, security, audits, and breach handling. The rules must comply with Saudi law and jurisdiction.
General guidelines
Controllers must prevent agreement provisions from conflicting with or limiting binding common rules, provide compliance evidence to the authority upon request, establish breach response procedures, notify the authority and data subjects of breaches, maintain updated member records with explanations for changes, and understand that exemption status is lost if implementation fails or the authority finds them inadequate.
Details of the Entity Implementing the BCR
Documentation on the entity implementing the BCR must include identifying information about the group and the Saudi Arabian entity (including legal form, commercial registration number, address, business sector, and confirmation of financial capability for compensation), list all group entities in Saudi Arabia, describe the implementing entity's role within the global group structure, and provide contact details for the BCR manager and point of contact. The BCR must describe communication means for making rules accessible to data subjects, employee training programs ensuring understanding of personal data protection obligations, efficient complaint handling mechanisms with prompt responses, auditing procedures ensuring group member compliance, and the group must cooperate with the competent authority through designated contact points, respond to requests within specified timelines, provide regular reports, comply with the authority's directives, and permit follow-up inspections. The BCR must detail appointment criteria and roles of data protection officers, cooperation mechanisms among officers within the group, transparency requirements for processing activities, compliance with purpose limitation and legal basis requirements, data minimisation practices, retention and deletion policies, additional protections for sensitive data, records management of processing activities, data protection impact assessment procedures, data quality measures, security measures, breach notification procedures, restrictions on subsequent transfers to third parties, and transfer impact assessment procedures, all in accordance with applicable law and regulations.
Appendix 1 Documentation of Details of the Entity Implementing the Binding Common Rules
An application to establish binding common rules must provide the competent authority with details of the group and its members including their legal structure, location, and contact information; describe personal data flows and categories being transferred; explain how the rules will be made legally binding on all group members, employees, and sub-processors; and demonstrate how data subjects will exercise their rights, how the rules will be transparently communicated, how employees will receive training, how complaints will be handled, and how audits will ensure compliance. The binding common rules must specify the group's structure and data transfers; guarantee data subject rights including information, access, correction and deletion; establish that a Saudi group member is responsible and liable for violations by any group member; provide that claims must be addressed in Saudi courts; require transparency to data subjects and employee training; establish complaint and audit mechanisms; appoint a personal data protection officer or team; require each group member and all members to cooperate with the competent authority and follow its instructions; require notification if foreign laws could negatively impact the rules; and incorporate standards for lawfulness, purpose limitation, data minimization, storage limits, sensitive data protection, impact assessments, security, breach notification, and transfer restrictions.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 6 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 2 of 4
- Data governance and quality, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 20 are shown.
Requirements for Binding Common Rules 5 controls
- ObligationApplies to: ProviderDrafted by the Index
Entity groups must incorporate controller obligations and data subject rights from the law into their binding common rules.
- ObligationApplies to: ProviderDrafted by the Index
Entity groups, including data importers, must collaborate with the competent authority, fulfil all its requests and queries, and supply necessary documents and information demonstrating adherence to binding common rules.
- ObligationApplies to: ProviderDrafted by the Index
An authorized representative within the entity group must internally approve binding common rules after reviewing and validating all data protection measures and compliance systems.
- ObligationApplies to: ProviderDrafted by the Index
Binding common rules must be legally binding on every group member and ensure uniform data protection standards that all members receiving personal data must follow.
- ObligationApplies to: ProviderDrafted by the Index
Binding common rules are governed by Saudi law, disputes fall under Kingdom courts, and data importers consent to submit to the jurisdiction of the Kingdom.
General guidelines 7 controls
- ObligationApplies to: ControllerDrafted by the Index
Signatories to a binding agreement must prevent any provision from contradicting or restricting binding common rules.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must produce proof to the competent authority on demand showing their adherence to binding common rules, the law and its regulations.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must put in place a swift and workable incident response strategy to handle personal data breaches, losses or unauthorized disclosures.
- ObligationApplies to: ProviderDrafted by the Index
Binding common rules must contain procedures for alerting the competent authority and data subjects when a breach is found that may damage transferred data, data subjects, their rights or interests.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must maintain current records of group members, data processors and sub-processors engaged in data handling and give data subjects access to the member list.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must keep a written account detailing why member records were changed or updated.
- ProhibitionApplies to: ControllerDrafted by the Index
A controller forfeits exemption status under binding common rules if implementation fails or the competent authority deems them inadequate.
Appendix 1 8 controls
- ObligationApplies to: OthersDrafted by the Index
Entities must submit an electronic copy of their binding common rules to the competent authority, with additional documents attached as needed.
- ObligationApplies to: OthersDrafted by the Index
Entities must provide details about the group, including name, headquarters address, legal form and registration information.
- ObligationApplies to: OthersDrafted by the Index
Entities must provide details of their Saudi Arabian address and registration with the competent authority.
- ObligationApplies to: OthersDrafted by the Index
Entities must identify all group members operating in Saudi Arabia, including their names, addresses and registration numbers.
- ObligationApplies to: OthersDrafted by the Index
Entities must name a personal data protection officer or point of contact and provide their full address, email and phone number.
- ObligationApplies to: OthersDrafted by the Index
Entities must describe the types or categories of personal data to be transferred and the categories of data subjects affected.
- ObligationApplies to: OthersDrafted by the Index
Entities must specify the purposes for data transfer, the destination countries, the frequency of transfers and any processor arrangements.
- ObligationApplies to: OthersDrafted by the Index
Entities must explain how the binding common rules apply to all group members and how controllers can enforce them against members who violate them.
Change history
No changes recorded since we began monitoring this policy.