Regulation on Personal Data Transfer Outside the Kingdom
Saudi Arabia · Regulation · Saudi Data and Artificial Intelligence Authority
Our summary
This regulation establishes the framework and procedures for transferring personal data outside Saudi Arabia. It applies to controllers handling personal data and specifies conditions under which such transfers are permitted, including requirements for appropriate safeguards through standard contractual clauses, binding common rules, or accreditation certificates. The regulation mandates risk assessments, allows exemptions in specific cases with conditions, and grants the competent authority powers to evaluate protection standards in destination countries.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
9 sections
Jump to a chapter
Article 1 Definitions
Defines key terms used in the regulation, including appropriate safeguards (requirements from the competent authority ensuring adequate protection standards for data transferred outside the Kingdom), operational processes (controller-related procedures like HR and accounting), standard contractual clauses (mandatory protective provisions in standard form), and binding common rules (intra-group rules for multinational entities ensuring equivalent protection standards).
Article 2 Other Purposes for Transferring or Disclosing
Permits controllers to transfer or disclose personal data to external parties for specific purposes: conducting central processing operations necessary for the controller's business, delivering services or benefits to data subjects, and undertaking scientific research and studies.
Article 3 Procedures and Standards for Evaluating the
Requires the competent authority to maintain and publish a list of countries and international organizations that provide adequate personal data protection, reviewing it every four years based on criteria including domestic safeguarding laws, supervisory bodies, cooperation readiness, and consistency with Kingdom requirements. The authority may suspend transfers to listed jurisdictions or exclude those no longer meeting standards, and these standards also apply to special economic zones and trade centers.
Article 4 Exemptions from protection requirements for data transfers
Controllers transferring or disclosing personal data outside the Kingdom may be exempt from certain protection conditions if they implement one of three types of safeguards: standard contractual clauses, binding common rules, or accreditation certificates. The article specifies five categories where transfers remain subject to safeguards: transfers between public bodies to implement international agreements or Kingdom interests must include standard data protection provisions; non-recurring or limited-duration transfers involving limited data subjects must use standard contractual clauses or recipient approval certificates if data is non-sensitive; transfers within multinational groups for central operations must use binding common rules, standard contractual clauses, or recipient approval certificates; transfers to provide direct services to data subjects must use recipient approval certificates if data is non-sensitive; and transfers for scientific research must be limited to necessary data and use standard contractual clauses or recipient approval certificates if data is non-sensitive. All appropriate safeguards must ensure controllers comply with the law and regulations and protect data subjects' rights including complaint filing and compensation.
Article 5 Subsequent Transfer of Personal Data
Subjects any personal data transferred outside the Kingdom to re-transfer rules, requiring that further transfers by external recipients comply with the Law and Regulations.
Article 6 Revocation of Exemption
Authorizes withdrawal of granted exemptions if controllers fail to maintain appropriate safeguards or if the competent authority determines safeguards are insufficient. Upon revocation, controllers must cease transfers and notify all recipients.
Article 7 Risk Assessment of Transferring or Disclosing
Requires controllers to assess risks before transferring data under exemption cases or when continuously transferring sensitive data externally. Risk assessments must evaluate transfer purpose and legal basis, nature and scope of processing, adequacy of safeguards, data minimization measures, likely impacts on data subjects, and mitigation controls.
Article 8 Guides and Guidelines
Authorizes the competent authority to issue guidance documents and guidelines to support implementation of the regulation's provisions.
Article 9 Enforcement
The regulation becomes effective upon publication in the Official Gazette.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 9 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 2 of 4
- Data subject rights and consent, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 2 of 4
- Conformity assessment and certification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 1 of 6
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 1 of 5
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 26 are shown.
Article 2 3 controls
- Applies to: ControllerDrafted by the Index
Controllers may transfer or disclose personal data to parties outside the Kingdom for conducting core business operations necessary for the controller's functions.
- Applies to: ControllerDrafted by the Index
Controllers may transfer or disclose personal data to parties outside the Kingdom for delivering services or benefits that data subjects expect.
- Applies to: ControllerDrafted by the Index
Controllers may transfer or disclose personal data to parties outside the Kingdom for undertaking scientific research and studies.
Article 3 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The competent authority must maintain and publicly display a roster of countries and international organizations meeting Kingdom data protection standards.
- ObligationApplies to: Public authorityDrafted by the Index
The competent authority must review the list of adequate jurisdictions every four years or when circumstances warrant, assessing safeguarding laws, supervisory capacity, cooperation readiness, and alignment with Kingdom requirements.
- Applies to: Public authorityDrafted by the Index
The competent authority may remove countries or organizations from the adequacy list if they no longer guarantee protection equivalent to Kingdom standards.
- Applies to: Public authorityDrafted by the Index
The competent authority may halt transfers or disclosures to countries or organizations on the adequacy list when necessary.
Article 4 5 controls
- Applies to: ControllerDrafted by the Index
Controllers may transfer or disclose personal data without meeting adequacy requirements if they apply standard contractual clauses, binding common rules, or accreditation certificates as safeguards.
- ObligationApplies to: ControllerDrafted by the Index
Controllers transferring data between public bodies under international agreements must include standard personal data protections in those agreements or memoranda of understanding.
- ObligationApplies to: ControllerDrafted by the Index
Controllers making non-recurring or limited-duration transfers to recipients lacking competent authority approval must use standard contractual clauses, provided the data is not sensitive.
- ObligationApplies to: ControllerDrafted by the Index
Controllers transferring non-sensitive data to provide services or benefits directly to data subjects may do so only if the recipient holds a competent authority approval certificate.
- ObligationApplies to: ControllerDrafted by the Index
Controllers transferring sensitive data for scientific research must meet specific conditions set by the competent authority.
Article 5 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers must ensure that any personal data transferred outside the Kingdom and subsequently re-transferred by external recipients complies with the Law and Regulations.
Article 6 3 controls
- ProhibitionApplies to: ControllerDrafted by the Index
An exemption from transfer restrictions shall cease to apply if the controller fails to implement appropriate safeguards.
- Applies to: Public authorityDrafted by the Index
An exemption from transfer restrictions shall cease to apply if the competent authority determines that safeguards are inadequate.
- ObligationApplies to: ControllerDrafted by the Index
When an exemption is revoked, the controller must stop transferring or disclosing personal data and notify all entities that received it.
Article 7 8 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must assess risks before transferring or disclosing personal data under exemption cases listed in Article 4.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must assess risks before continuously or extensively transferring sensitive data outside the Kingdom.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must examine the purpose and lawful basis for the external transfer or disclosure.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must describe the nature and scope of the external transfer or disclosure, including processing activities and geographical reach.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must evaluate whether safeguards and measures ensure protection equivalent to Kingdom standards.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must verify that transferred data is minimized to amounts necessary for the stated purpose.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must identify potential harms to data subjects and the likelihood each harm will materialize.
- ObligationApplies to: ControllerDrafted by the Index
Risk assessments must describe controls and measures to prevent or mitigate risks to personal data subjects.
Article 8 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The competent authority should issue guidance documents and guidelines to help implement this regulation's provisions.
Article 9 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The regulation takes effect when it appears in the Official Gazette.
Change history
No changes recorded since we began monitoring this policy.