Personal Data Protection Law

Article 1 Definitions part 1

The law defines personal data as any information allowing direct or indirect identification of an individual and processing as any manual or automated operation on such data. Sensitive data includes information on racial or ethnic origin, religious or political belief, security or criminal convictions, biometric or genetic data for identification, health condition, or unknown parents. Key actors are public entities (ministries, departments, public institutions, public authorities and independent public entities in the Kingdom), controllers who determine the purpose and manner of data handling, and processors who handle data on behalf of controllers.

Article 2 1-The Law applies to any Processing of Personal Data related to individuals that takes place in the Kingdom by any means, including the Processing of Personal Data related to

The law applies to any processing of personal data concerning individuals in the Kingdom by any means, including processing of data about Kingdom residents from outside the Kingdom. It also covers deceased individuals' data if it would identify them or a family member. The law does not apply to personal data processed only for individual or family purposes that the data subject has not made public.

Article 3 Non-derogation clause

The law does not override any other provision granting data subjects rights or better personal data protection under other laws or international agreements binding the Kingdom.

Article 4 Data subject rights

Data subjects have the right to be informed of the legal basis and purpose of data collection; to access their personal data held by a controller in accordance with regulations and subject to article 9 limitations; to obtain their data in a readable and clear format under specified controls; to request correction, completion or updating of their data; and to request destruction of their data when no longer needed, subject to article 18 limitations.

Article 5 1-Except for the cases stated in this Law, neither Personal Data may be processed nor the purpose of Personal Data Processing may be changed without the consent of the Data

Processing of personal data and any change of processing purpose requires data subject consent except in cases specified in the law, with regulations to set consent conditions, cases requiring explicit consent, and procedures for consent of legal guardians when data subjects lack legal capacity. Data subjects may withdraw consent at any time under procedures set out in regulations.

Article 6 Processing without consent

Processing does not require data subject consent when serving the data subject's actual interests but communication is impossible or difficult; when required by another law or prior agreement the data subject is party to; when the controller is a public entity and processing is for security or judicial purposes; or when necessary for the controller's legitimate interest without prejudicing data subject rights and interests and not involving sensitive data, with related provisions and controls in regulations.

Article 7 The consent referred to in paragraph (1) of Article (5) of this Law may not form a condition of providing a service or a benefit, unless such service or benefit is directly related to the

Article 8 Subject to the provisions of this Law and the Regulations regarding the Disclosure of

The controller must select only processors providing necessary guarantees to implement the law and regulations, and must monitor their compliance with those provisions without being relieved of its own responsibility to data subjects or the competent authority. Regulations will establish necessary provisions including those concerning any subsequent contracts the processor enters into.

Article 9 1-The Controller may set time frames for exercising the right to access Personal Data stated in Paragraph (2) of Article (4) herein as stipulated in the Regulations

Controllers may impose timeframes for data subject requests to access personal data and limit such access when necessary to protect the data subject or others from harm, or when the controller is a public entity and restriction serves security, legal or judicial enforcement purposes. Controllers must deny access in situations covered by six specified paragraphs of Article 16.

Article 10 The Controller may only collect Personal Data directly from the Data Subject and may only process Personal Data for the purposes for which they have been collected

Data may be collected only directly from data subjects and processed only for the original collection purpose, except when the data subject consents; data is publicly available or from a public source; the controller is a public entity collecting or processing for public interest, security, legal implementation, or judicial purposes; compliance would harm the data subject or their vital interests; collection or processing is necessary for public health or safety or to protect specific individuals' life or health; data is not recorded in a form allowing direct or indirect identification; or collection is necessary for the controller's legitimate interests without prejudicing data subject rights and interests and not involving sensitive data, with regulations to set relevant provisions and procedures.

Article 11 Purpose, methods, and content of data collection

Controllers must ensure collection purposes relate to their legitimate functions and comply with law. Collection methods must be legal, appropriate to circumstances, and use direct, clear and secure means without deception or coercion. Data must be limited to what is necessary and identifying information must be avoided once the purpose is achieved.

Article 12 Privacy policy requirements

Controllers must establish and provide a privacy policy to data subjects before collection, specifying the collection purpose, what data is collected, collection and processing methods, storage and destruction arrangements, and the data subject's rights and how to exercise them.

Article 13 Information to provide at collection

When collecting data directly from subjects, controllers must inform them of the legal basis, whether data provision is mandatory or optional, the collector's identity and representative address unless for security, which entities receive the data and whether it transfers outside the Kingdom, risks of non-provision, and the subject's rights and other elements set out in regulations.

Article 14 The Controller may not process Personal Data without taking sufficient steps to verify the

Controllers must verify that collected personal data is accurate, complete, timely and relevant to its collection purpose.

Article 15 Permitted disclosure situations

Controllers may only disclose personal data when the subject consents, data comes from public sources, a public entity requests it for public interest or legal purposes, disclosure protects health or safety, processing renders identification impossible, or it serves the controller's legitimate interests without harming the subject or processing sensitive data. Regulations shall detail provisions and procedures for situations 2 through 6.

Article 16 Prohibited disclosure circumstances

Controllers must not disclose personal data under Article 15 paragraphs 1, 2, 5 or 6 if it would threaten security, harm the Kingdom's reputation or interests, affect relations with other states, hinder crime detection or fair trial rights, compromise individual safety, violate another person's privacy, breach professional duties, violate legal obligations, or expose confidential sources.

Article 17 Notification of amendments

When controllers correct, complete or update personal data, they must notify all entities that received the data and make amendments available to them. Regulations shall establish timeframes for corrections and procedures to prevent harm from inaccurate or outdated data.

Article 18 1- The Controller shall, without undue delay, Destroy the Personal Data when no longer necessary for the purpose for which they were collected

Controllers must promptly destroy personal data when no longer needed for its collection purpose, though they may retain anonymized data. Controllers may retain data longer if required by law for a specific period or if needed for ongoing judicial proceedings, destroying it upon expiry or conclusion of proceedings, whichever is later.

Article 19 Data protection measures

Controllers must implement all necessary organizational, administrative and technical safeguards to protect personal data, including during transfers of data outside the controller, as specified in the regulations.

Article 20 Breach notification obligations

Controllers must inform the competent authority when they discover any breach, damage or unlawful access to personal data. Controllers must also notify data subjects of breaches, damage or unlawful access that would harm the data or infringe on their rights and interests, all according to regulatory requirements.

Article 21 Responding to data subject rights requests

Controllers must respond to requests from data subjects concerning their rights under this law within the period and in the manner specified in the Regulations.

Article 22 Data processing impact assessment

Controllers must conduct an assessment of the impact of personal data processing for any product or service they offer, based on the nature of their activities and in accordance with the Regulations.

Article 23 Controls for health data processing

The Regulations shall establish additional controls for processing health data to ensure data subject privacy and rights protection, including limiting access to health data and processing operations to the minimum employees and workers necessary to provide health services or insurance programs.

Article 24 Controls for credit data processing

Article 25 With the exception of the awareness-raising materials sent by Public Entities, Controller may not use personal means of communication, including the post and email, of the Data

Controllers may not send advertising or awareness-raising materials through personal communication means unless they obtain prior consent from recipients and provide a clear mechanism for recipients to stop receiving such materials; public entities are exempt from this requirement. The Regulations shall specify controls and conditions for such consent.

Article 26 With the exception of Sensitive Data, Personal Data may be processed for marketing purposes, if it is collected directly from the Data Subject and their consent is given in

Personal data may be processed for marketing if it is collected directly from the data subject and their consent is obtained, except for sensitive data; the Regulations shall establish controls for such processing.

Article 27 Personal data may be collected or processed for scientific, research, or statistical purposes without the consent of the Data Subject in the following situations

Personal data may be collected or processed for scientific, research, or statistical purposes without data subject consent if it does not specifically identify the subject, or the subject's identity will be destroyed before disclosure to another entity, or the processing is required by law or pursuant to an agreement to which the subject is party. The Regulations shall set out required controls.

Article 28 It is not permissible to copy official documents where Data Subjects are identifiable, except where it is required by law, or when a competent public authority requests copying such

Article 29 1-Subject to the provisions of Paragraph (2) of this Article, a Controller may Transfer

Controllers may transfer or disclose personal data outside the Kingdom to perform international obligations, serve Kingdom interests, fulfill data subject obligations, or for other Regulations-specified purposes, provided the transfer or disclosure does not prejudice national security or Kingdom vital interests, meets at least equivalent data protection standards verified by the Competent Authority, and involves only the minimum necessary data. Paragraph restrictions do not apply to emergencies to preserve data subject life or vital interests or to prevent and treat disease. The Regulations shall set out implementation provisions, criteria, and procedures including exceptions for controllers.

Article 30 1- Without prejudice to the provisions of this Law and the powers of the Saudi Central

The Competent Authority shall oversee implementation of this law and the Regulations. The Regulations shall specify when controllers must appoint data protection officers and define their responsibilities. Controllers must cooperate with the Competent Authority and follow its directions.

Article 31 Personal data processing records

Controllers must maintain records of their personal data processing activities for periods set by regulations, based on the type of activity, and make them available to the competent authority upon request. Records must include controller contact details, processing purposes, categories of data subjects affected, entities receiving disclosed data, whether data transfers occur outside the Kingdom, and expected data retention periods.

Article 32 Repealed

Article 33 Regulation of data protection activities

The competent authority shall set requirements for commercial, professional and non-profit personal data protection activities in coordination with other authorities. It may license entities to issue accreditation certificates to controllers and processors, and may license entities to audit or check personal data processing. The competent authority shall also establish mechanisms to monitor and enforce this law for controllers and processors outside the Kingdom who process data concerning Kingdom residents.

Article 34 A Data Subject may submit to the Competent Authority any complaint that may arise out of the implementation of this Law and the Regulations

A data subject may submit complaints to the Competent Authority regarding implementation of this law and its regulations.

Article 35 1-Without prejudice to any harsher penalty stipulated in another law, any individual discloses or publishes Sensitive Data, in violation of the provisions of the Law, with the

Any person who unlawfully discloses or publishes sensitive data intending harm or personal gain faces imprisonment up to two years, a fine up to three million Riyals, or both. The Public Prosecution investigates and prosecutes such violations. In cases of recidivism, courts may double the fine penalty up to twice its maximum limit.

Article 36 1-In cases that are not covered in Article (35) herein and without prejudice to any harsher penalty stipulated in another law, a warning or a fine not exceeding (five million) Riyals shall

Any person covered by the law who violates its provisions faces a warning or a fine not exceeding five million Riyals, which may be doubled for repeat violations up to double the maximum. A committee of at least three members, including a technical specialist and legal advisor, examines violations and issues penalties based on type, seriousness and impact, subject to the Competent Authority president's approval. Decisions may be appealed to the competent court.

Article 37 1-Employees and workers appointed by a decision of the president of the Competent

Employees and workers appointed by the Competent Authority president have authority to control and inspect violations of the law and regulations; they may seek assistance from criminal or other competent authorities. The Competent Authority may seize means or tools used in committing violations pending a decision.

Article 38 1-Without prejudice to the rights of bona fide third parties, the competent court may order the confiscation of funds obtained as a result of committing the violations stipulated in the

The competent court may order confiscation of funds obtained from violations, subject to rights of good faith third parties. The court or the committee may require the violator to publish a summary of the penalty judgment or decision in local newspapers or through other appropriate means, based on violation type, seriousness and impact, after the judgment becomes final or appeals lapse.

Article 39 Without prejudice to the provisions of Article (35) and Paragraph (1) of Article (36) of this

Public entities shall discipline their employees who violate the law or regulations according to applicable disciplinary provisions and procedures, without prejudice to criminal or administrative penalties.

Article 40 Without prejudice to the penalties stated in this Law, any individual that suffers a damage as a result of any of the violations stated in this Law or the Regulations may apply to a

Any individual damaged by a violation of the law or regulations may apply to the competent court for proportionate compensation for material or moral harm, without prejudice to other penalties.

Article 41 Confidentiality obligation

Any person engaged in processing personal data must maintain confidentiality of that data even after their occupational or contractual relationship ends.

Article 42 Issuance of regulations

Article 43 Commencement

The Law comes into force 720 days after its publication in the Official Gazette.