Implementing Regulation of the Personal Data Protection Law

Article 1 Definitions

Defines key terms used in the regulation including direct marketing, personal data breach, vital and legitimate interests, pseudonymisation, anonymization, and explicit consent, drawing from the underlying Personal Data Protection Law and establishing meanings for this regulation.

Article 2 Personal or family use

The law does not apply when individuals process personal data solely within their family or close social circle for personal or family activities. Publishing data publicly or using it for professional or commercial purposes falls outside this exemption.

Article 3 General provisions for Data Subject Rights

Controllers must respond to data subject requests to exercise their rights within 30 days without delay, with possible extension of up to 30 additional days if disproportionate effort is required. Controllers must verify identity, document requests, and may refuse repetitive or unfounded requests, while legal guardians may exercise rights on behalf of those lacking capacity.

Article 4 Right to be informed

When collecting data directly from the individual, the controller must inform them beforehand or at the time of collection about: their contact details and communication channels; the data protection officer's contact details if one exists; the legal basis and specific purpose for collection and processing; the storage period or criteria for determining it; mechanisms for exercising rights; how to withdraw consent; and whether providing data is mandatory or optional. These requirements do not apply if the information is already known to the individual or conflicts with local laws. When data is collected from another source, the controller must provide the individual with the same information within 30 days, plus details about what categories of data are being processed and where it came from, unless the information is already known, providing it would be impossible or overly burdensome, the collection is required by law, the controller is a public entity processing for security or judicial purposes or public interest, or the data is subject to professional secrecy laws.

Article 5 Right of access to Personal Data

Data subjects may access their personal data held by controllers, except where doing so would harm others' intellectual property or trade secrets. Controllers may provide access directly through established channels or upon request, ensuring no identifying data of other individuals is disclosed.

Article 6 Right to Request Obtaining Personal Data

Data subjects may request their personal data in a readable, commonly used electronic format, or in printed form if practical, provided this does not expose identifying information about other individuals or harm their rights such as intellectual property.

Article 7 Right to Request Correction of Personal Data

Data subjects may request processing restrictions while contesting data accuracy, allowing controllers time to verify. Controllers may request supporting documents to correct data and must notify previously disclosed parties of corrections without undue delay.

Article 8 Right to Request Destruction of Personal Data

Controllers must delete personal data upon request, when no longer necessary, when consent is withdrawn as the sole legal basis, or when processing was unlawful. Controllers must notify recipients of disclosed data and destroy all copies including backups, though other legal retention requirements may apply.

Article 9 Anonymisation

Controllers applying anonymization must ensure re-identification is impossible, evaluate risks including re-identification potential, implement organizational and technical safeguards accounting for technological developments, and regularly assess anonymization technique effectiveness. Anonymized data is no longer considered personal data.

Article 10 Means of Communication

Controllers must provide multiple communication methods for data subject requests including email, text messages, national address, electronic applications, or other lawful means, allowing data subjects to choose their preferred option.

Article 11 Consent

Controllers must obtain consent to process personal data through various means, ensuring consent is freely given without deception and explaining purposes clearly beforehand. Consent requires full legal capacity and must be documented for verification, with separate consent obtained for each purpose. Explicit consent is required for sensitive data, credit data, and solely automated decisions.

Article 12 Consent withdrawal

Data subjects may withdraw consent at any time through available means. Controllers must establish withdrawal procedures that are as easy as obtaining consent and cease processing without delay upon withdrawal. Notification and destruction requests must be sent to recipients, though withdrawal does not retroactively affect prior lawful processing based on that consent.

Article 13 Legal Guardian

Legal guardians of persons lacking full legal capacity may exercise rights and provide consent in their best interests, subject to verification of guardianship. Guardians' consent must not harm the ward's interests, and wards retain the right to exercise their own rights once they gain legal capacity.

Article 14 Processing to serve Actual Interest of Data

When processing data based on the data subject's actual interest, controllers must retain evidence proving such interest exists and that contacting the subject is not feasible.

Article 15 Collecting Data from Third Parties

When processing personal data from sources other than the data subject, controllers must ensure processing is necessary and proportionate to the purpose and does not affect the subject's rights and interests. Data from public sources must be lawfully available, and anonymised data collection must comply with anonymisation provisions.

Article 16 Processing for Legitimate Interest

Non-public entities may process personal data for legitimate interests such as fraud prevention or network security, provided purposes comply with kingdom law and do not harm data subject rights or include sensitive data. Controllers must assess and document the processing impact, evaluating legitimacy, necessity, and potential harms, and may modify or abandon processing if risks emerge.

Article 17 Processor selection

Controllers must ensure processors provide adequate data protection and include contractual requirements covering processing purposes, data categories, duration, breach notification, foreign regulations, mandatory disclosures, and subcontractors. Controllers issue instructions, periodically assess compliance, and may appoint third parties for monitoring. Processors violating instructions become controllers and bear direct accountability.

Article 18 Processing data for a purpose other than the one

When repurposing personal data, controllers must clearly define new purposes and document procedures including data maps linking each dataset to its purpose. Controllers must apply data minimization principles and ensure collection is limited to the minimum necessary, identifying data types and appropriate processing safeguards.

Article 19 Data Minimisation

Controllers must collect and retain only the minimum personal data necessary for the processing purpose, using data maps or similar means to verify necessity and ensuring no unnecessary data is gathered. Retention must be limited to what is required for the specified objective.

Article 20 Disclosure of Personal Data

Disclosure of publicly available data is permitted if not made public in violation of law. Controllers disclosing other data must relate it to specific purposes, minimize amounts, and protect privacy. Disclosures to authorities for security, legal requirements, health or safety must be documented with identification of required data types.

Article 21 Controls for Processing Personal Data for Public

When public entities obtain personal data indirectly, use it for a different purpose, or disclose it to serve the public interest, they must ensure necessity, implement organizational and technical safeguards, record the processing, and collect only the minimum data required.

Article 22 Correction of Personal Data

Controllers must verify accuracy, notify previously-informed parties and the data subject after correction, document all updates, and if data is inaccurate or incomplete and may harm the subject, suspend processing until corrected. Controllers must also develop procedures enabling correction requests and periodically review data accuracy.

Article 23 Information Security

Controllers must implement organizational, administrative, and technical measures to secure personal data and protect privacy, including technical safeguards against breaches and adoption of cybersecurity controls from the National Cybersecurity Authority or recognized best practices.

Article 24 Notification of Personal Data Breach

Controllers must notify the competent authority within 72 hours of discovering a breach that potentially harms data or the subject's rights, providing incident details, affected data categories, risks, and contact information. Controllers must also notify data subjects without undue delay in clear language with risk descriptions and recommendations.

Article 25 Impact Assessment

Controllers must document potential impacts and risks from processing in cases involving sensitive data, linked datasets, large-scale processing of vulnerable persons, monitoring operations, new technologies, or products likely to cause serious privacy harm. Assessments must cover purposes, data types, scope, context, necessity, risk severity, mitigation measures, and suitability of safeguards.

Article 26 Processing Health Data

Controllers handling health data must adopt organizational, technical, and administrative measures required by health regulators, incorporate legal provisions into internal policies, distribute employee responsibilities to prevent overlapping access, document all processing stages, require processors to comply with these standards, and limit processing to what is necessary for providing healthcare or insurance services.

Article 27 Processing Credit Data

Controllers must implement organizational, technical, and administrative safeguards to prevent unauthorized handling of credit data, including its misuse, inappropriate access, or disclosure for unintended purposes. Controllers must comply with directives from the Saudi Central Bank and other competent authorities that specify employee roles and responsibilities, and must obtain data subject consent before responding to requests to reveal their credit information.

Article 28 Processing Data for Advertising or Awareness

Controllers must obtain free and uncoerced consent before sending advertising or awareness materials when no prior interaction exists, allow targeted recipients to specify preferences, document consent, clearly identify the sender, and provide a simple mechanism to stop receiving materials at no cost.

Article 29 Direct Marketing

Controllers must obtain data subject consent before direct marketing, clearly disclose the sender's identity in marketing messages, and provide a simple mechanism enabling subjects to stop receiving materials at any time and must cease sending without delay upon withdrawal of consent.

Article 30 Collection and Processing of Data for Scientific

When organizations collect or process personal data for scientific, research, or statistical purposes, they must document those purposes clearly, collect only the minimum data needed, use pseudonymisation where possible, and ensure processing does not harm data subjects' rights or interests.

Article 31 Photographing or Copying Official Documents

Controllers must avoid photographing or copying official government documents containing identifiable persons, except when requested by a public authority or required by law. They must protect such documents adequately and destroy them once no longer needed unless legal obligation requires retention.

Article 32 Data Protection Officer

Controllers must appoint one or more data protection officers when they are public entities processing data at large scale, regularly monitor data subjects, or primarily process sensitive data. Officers monitor compliance, coordinate with authorities, oversee assessments, enable data subject rights, report breaches, handle complaints, and maintain processing records.

Article 33 Records of Personal Data Processing Activities

Controllers must maintain written, accurate and current records of all processing activities for five years after processing ends. Records must include officer details, purposes, data categories, retention periods, recipient categories, cross-border transfers, and security measures, and controllers must provide access to the competent authority upon request.

Article 34 National Register of Controllers

The competent authority shall establish rules governing registration in a national register of controllers, specifying which controllers must register.

Article 35 Accreditation bodies

The Competent Authority shall establish regulations for licensing bodies that certify Controllers and Processors, and shall work with the Digital Government Authority on licensing requirements for entities delivering services to government organizations.

Article 36 Auditing and Controlling

Auditing aims to verify adequate personal data protection through checks of processing activities and identification of compliance gaps. Auditors must operate independently following professional standards and maintain procedures ensuring accuracy of their work. The competent authority shall issue licensing rules for auditing entities, coordinating with Digital Government Authority for those serving government agencies.

Article 37 Submitting and processing complaints

Data subjects may file complaints with the competent authority within 90 days of learning of a violation. The authority receives complaints, maintains a register, examines them with supporting documentation, communicates with complainants as needed, and informs them of outcomes. Complaints must include time, location, names, entity details, and clear violation description with evidence.

Article 38 Publication and Enforcement

This Regulation enters into force on the date the Law takes effect and shall be made available in the official gazette and on the Competent Authority's public website.