Personal Data Destruction, Anonymization, and Pseudonymisation Guideline
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
This non-binding guide from Saudi Arabia's data authority helps organizations understand when and how to eliminate, anonymize, or pseudonymize personal information under the country's data protection framework. It covers specific circumstances requiring data deletion, technical methods for each approach, and organizational practices that entities must follow to protect individual privacy while handling personal data.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
6 sections
Jump to a chapter
Introduction
The Saudi Data & AI Authority issued this guidance to help entities understand their legal obligations regarding personal data destruction and anonymization under the Personal Data Protection Law and its implementing regulations. This document provides technical examples to assist compliance, but is not legally binding and does not replace the law itself.
Objectives
This guideline aims to help entities implement legal requirements, encourage best practices for handling personal data, provide technical examples for controllers, empower data subjects to exercise their rights, and protect the privacy of individuals.
First: Personal Data Destruction
Controllers must ensure that personal data is permanently deleted and completely unrecoverable when required by law, such as upon data subject request or when data is no longer necessary. They must notify recipients of the data and destroy all copies, using techniques such as overwriting, secure erasure, degaussing, or physical destruction, while complying with cybersecurity standards.
Second: Anonymization
Controllers must irreversibly remove all identifying information so that individuals cannot be identified, and such data no longer qualifies as personal data. They must assess the risk of re-identification, implement and regularly review organizational and technical safeguards to maintain the irreversibility of the anonymization process.
Third: Pseudonymisation
Pseudonymisation replaces direct identifiers with codes that prevent identification without additional separate information, protecting personal data but remaining less effective than anonymization. Controllers must pseudonymise personal data when disclosing it or when processing for research without consent, using techniques such as data generalization, aggregation, encryption, or masking.
Fourth: General Guidelines
Controllers must comply with applicable law when conducting data operations, train employees on secure practices, ensure no data is lost or disclosed during processing, dispose of documents securely, maintain detailed records of all activities for authority review, and regularly update techniques to address new risks and technological changes.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 7 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 14 are shown.
First: Personal Data Destruction 4 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must permanently and irreversibly delete personal data when the data subject requests it, when it is no longer needed for its original purposes, when the data subject withdraws consent that was the sole basis for processing, or when the controller learns it is being processed unlawfully.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must inform other organisations and individuals who received the personal data and ask them to destroy it as well.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must destroy all copies of personal data in their systems, including backups, while respecting any applicable regulatory requirements.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should use destruction techniques such as data overwriting, secure erasure, or degaussing, and must comply with cybersecurity standards set by the National Cybersecurity Authority.
Second: Anonymization 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must irreversibly remove all direct and indirect identifiers so that individuals cannot be re-identified and the data no longer qualifies as personal data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must evaluate the risk that anonymised data could be re-identified under circumstances specified in relevant regulations and regularly update safeguards to maintain the irreversibility of the anonymisation process.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must apply appropriate organisational, administrative, and technical measures to prevent re-identification and keep them aligned with technology and anonymisation methods.
Third: Pseudonymisation 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers should employ techniques such as data generalisation, aggregation, encryption, or masking to pseudonymise personal data and must regularly review and update these techniques.
Fourth: General Guidelines 6 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must carry out anonymization, destruction, and pseudonymisation in accordance with personal data protection legislation, implementing rules, and requirements from relevant authorities.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must ensure that employees working on data security receive adequate training in secure pseudonymisation and anonymization practices.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must prevent personal data from being lost, misplaced, or disclosed to unauthorized parties during destruction, anonymization, or pseudonymisation.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must dispose of printed documents containing personal data in a manner making it impossible to retrieve (such as secure shredding and waste disposal) per regulatory requirements.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must keep detailed records of all anonymization and destruction activities, including the techniques applied and the reasons for choosing them, and provide these records to competent authorities upon request.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should periodically review and update their anonymization, destruction, and pseudonymisation techniques to manage emerging risks and keep pace with technological progress.
Change history
No changes recorded since we began monitoring this policy.