Personal Data Disclosure Cases Guideline
Saudi Arabia · Guideline · Saudi Data and AI Authority
Our summary
This guideline clarifies when entities may disclose personal data under Saudi Arabia's Personal Data Protection Law, covering six lawful bases including subject consent, publicly available sources, public entity requests, health and safety protection, anonymized processing, and legitimate business interests. It establishes restrictions on disclosure that threaten security or national interests, and requires controllers to document all disclosures while implementing safeguards to protect individual privacy.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
9 sections
Jump to a chapter
Introduction
SDAIA issues this guideline to help entities understand their disclosure obligations under the Personal Data Protection Law and its implementing rules. The guideline provides clarifications on disclosure restrictions but is not legally binding and does not replace the law itself.
Objectives
This guideline aims to support entities in applying the law, encourage best practices for data disclosure, clarify controller obligations regarding disclosure, and protect data subject privacy.
Personal Data Disclosure Cases
Controllers may only disclose personal data in specific permitted situations defined by the law.
First: Consent of the Personal Data Subject
Controllers may disclose personal data when the data subject has provided valid consent in accordance with the law's requirements.
Second: Personal Data Collected from a Publicly Available Source
Controllers may disclose data obtained from public sources if that source itself complied with the law, the disclosure serves a specific purpose, and the controller minimizes data shared while protecting the privacy of the data subject and any other individuals mentioned in the data through due diligence and, where feasible, anonymization.
Interest, for Security Purposes, to Implement Another Law, or to Fulfill Judicial Requirements
Public entities may request disclosure for public interest, security, legal implementation, or judicial purposes, provided they document the request, specify what data is needed, ensure necessity and appropriateness, limit data to the minimum required, and record the disclosure.
Fourth: Disclosure is Necessary to Safeguard Public Health, Public Safety, or the Life or Health of Specific Individuals
Controllers may disclose data when necessary to protect public or individual health and safety with documentation, or when disclosure is limited to processing that does not identify anyone, provided they specify the purpose, exercise due diligence, minimize data shared, and protect other individuals' privacy through appropriate safeguards.
Sixth: Disclosure is Necessary to Achieve the Controller’s Legitimate Interests
Controllers may disclose personal data to achieve legitimate interests when the data is not sensitive, disclosure is limited to the minimum necessary, data subject rights are not prejudiced, and an impact assessment is conducted and documented covering proposed activities, purposes, data types, necessity of processing, potential harms to data subjects, and required risk mitigation measures. Controllers must not disclose personal data when doing so poses security threats, harms national interests or international relations, impairs criminal proceedings, endangers individual safety, violates third-party privacy, conflicts with incompetent persons' interests, breaches professional obligations, violates judgments, or reveals confidential sources. These restrictions do not apply when public entities request disclosure for public interest, security, legal implementation, or judicial purposes, or when disclosure is necessary to protect public health or individual life.
General Guidelines
Controllers must record all disclosure activities with dates, methods, and purposes, and must comply with cross-border transfer requirements when disclosing data outside the kingdom.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 9 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 3 of 4
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 2 of 4
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 21 are shown.
Objectives 3 controls
- Applies to: AnyoneDrafted by the Index
Entities should implement the law's provisions on personal data disclosure.
- Applies to: AnyoneDrafted by the Index
Entities should adopt best practices for personal data disclosure.
- Applies to: ControllerDrafted by the Index
Controllers should implement the law's personal data disclosure provisions.
Personal Data Disclosure Cases 1 control
- ProhibitionApplies to: ControllerDrafted by the Index
Controllers must not disclose personal data except in cases permitted by law.
First: Consent of the Personal Data Subject 1 control
- Applies to: ControllerDrafted by the Index
Controllers may disclose personal data when the data subject provides valid consent in accordance with the law's requirements.
Second: Personal Data Collected from a Publicly Available Source 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers should disclose personal data from public sources only if the source complied with the law, the disclosure serves a specific and clearly defined purpose, and the controller restricts the data to the minimum needed.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should conduct due diligence and apply safeguards to preserve privacy of the data subject and any other individuals in the disclosed data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should anonymize personal data that identifies other individuals when feasible, and weigh the rights of the data subject against those of other individuals in each case.
Interest, for Security Purposes, to Implement Another Law, or to Fulfill Judicial Requirements 4 controls
- Applies to: Public authorityDrafted by the Index
Public entities may request disclosure for public interest, security, law implementation, or judicial purposes.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should record all disclosure requests with documentation and detail what types of personal data are being shared.
- ObligationApplies to: Public authorityDrafted by the Index
When a public entity requests disclosure for public interest, it should verify the disclosure is strictly necessary for that purpose and linked to its powers and duties.
- ObligationApplies to: Public authorityDrafted by the Index
Public entities should apply administrative and technical controls to ensure personnel comply with legal safeguards, mitigate potential harms, and disclose only the minimum data required.
Fourth: Disclosure is Necessary to Safeguard Public Health, Public Safety, or the Life or Health of Specific Individuals 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers should document disclosure requests made for health or safety protection and specify the types of personal data being shared.
- ObligationApplies to: ControllerDrafted by the Index
When disclosure is limited to processing that does not identify data subjects or any other individual, controllers should ensure the request serves a specific and clearly defined purpose.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should conduct due diligence, restrict data to the minimum necessary, and safeguard the privacy of other individuals through anonymization or balancing individual rights.
Sixth: Disclosure is Necessary to Achieve the Controller’s Legitimate Interests 4 controls
- Applies to: ControllerDrafted by the Index
Controllers may disclose non-sensitive personal data to serve their legitimate interests.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should ensure disclosure serves a specific and clearly defined purpose, limit data to the minimum required, and apply safeguards protecting privacy of other individuals.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should verify that the disclosure purpose complies with the law and does not contravene any regulations.
- ObligationApplies to: ControllerDrafted by the Index
Before disclosing personal data for legitimate interests, controllers should conduct and document an impact assessment evaluating the processing purpose, data types, necessity, and potential harms to data subjects' rights.
General Guidelines 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must record all disclosure activities in their processing records, noting the dates, methods, and purposes of each disclosure.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must follow laws and regulations governing the movement of personal data across borders when disclosing data internationally.
Change history
No changes recorded since we began monitoring this policy.