Standard Contractual Clauses for Personal Data Transfer
Saudi Arabia · Regulation · Saudi Data & AI Authority
Our summary
This regulation provides mandatory contractual provisions that organizations must use when transferring personal data outside Saudi Arabia to countries or entities without equivalent data protection standards. It establishes obligations for data exporters and importers to ensure appropriate safeguards and specifies templates for different transfer scenarios between controllers and processors. The clauses give data subjects rights to complain to the Saudi Data and AI Authority about violations.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
10 sections
Jump to a chapter
Introduction
These clauses implement the Personal Data Protection Law and its amendments by establishing requirements for transferring personal data outside Saudi Arabia, including mechanisms for controllers exempted from standard protection levels.
Purpose
These clauses aim to guarantee personal data protection levels equivalent to those required by Saudi law when transferring data to countries or organizations lacking adequate protection, serving as one of several acceptable safeguards alongside binding corporate rules and authorized certifications.
Definitions
This section defines key terms used in the clauses, including the Kingdom of Saudi Arabia, the Personal Data Protection Law, the Saudi Data and AI Authority as competent authority, appropriate safeguards, standard contractual clauses, international organizations, and various types of data transfers and subsequent transfers.
Scope
These clauses apply to controllers and processors transferring personal data outside the Kingdom to countries or organizations without adequate protection, without diminishing controller accountability to the authority or data subjects.
Standard Contractual Clauses Rules
Standard Contractual Clauses provide protection for personal data transfers outside the Kingdom and must be included in contracts between exporters and importers of personal data. They cannot be modified except for filling blank fields, and violating this prohibition is deemed a breach of the law. Personal data cannot be transferred if the recipient country's laws prevent the importer from complying with the Clauses, and importers must submit to Kingdom jurisdiction and cooperate with the Competent Authority's requests and audits.
Standard Contractual Clauses Templates
Four templates address different transfer scenarios: controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller arrangements, with parties required to select the applicable template and remove inapplicable provisions.
Appendices
Standard Contractual Clauses ensure equivalent protection for personal data transfers to countries without adequate safeguards, applying to transfers in Appendix 2 and governed by Saudi Arabian law with disputes under Kingdom jurisdiction. Parties must adopt specified organizational, administrative and technical security measures from the appendices; notify each other of breaches within 24 hours and assist containment; limit data to necessary purposes; delete or anonymize data without unnecessary delay unless retention is legally required, needed for court proceedings, or necessary to protect vital interests; not transfer data to third parties outside the Kingdom unless they accede to these clauses; respond to data subject inquiries within 30 days or up to 60 days if requiring unusual effort or many requests arrive; and allow audits without undue delay (excluding confidential information unrelated to transferred data). Exporters must notify controllers within 48 hours of potential harm breaches and controllers must notify the Competent Authority within 24 hours per Article 24 of the Implementing Regulations.
Appendix 1 Parties of List
This appendix provides a template for recording the names, addresses, contact information, signatures, dates, and roles of personal data exporters and importers as parties to the transfer agreement.
Appendix 2 Description of the Transferred Personal Data
This appendix documents the categories of data subjects, types of personal data transferred, any sensitive data with applicable restrictions and safeguards, transfer purposes, and retention periods or criteria for the transfer.
Appendix 3 Security Measures
All parties must establish and describe organizational, administrative, technical and security safeguards for transferred personal data to meet the Law's and Implementing Regulations' standards. The appendix provides examples of measures including physical access controls (card systems, doors, alarms, cameras), IT system access controls (encrypted passwords, login procedures, auto-blocking), personal data access controls (permits, roles, authorization documentation, activity logs), disclosure controls (email encryption, VPNs, secure networks, media protection), input controls (logging and reporting systems), functionality controls (written agreements, employee training, confidentiality agreements, regular reviews), and data availability controls (backups, power systems, anti-virus systems, disaster recovery plans). Continuation of security measure examples: parties should implement data availability controls including fire protection, alarm systems, and proper archiving; and segregation controls separating data processing for different purposes through separation of development and testing environments, databases, systems, and logical separation between customer data.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 8 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 3 of 4
- Copyright and training data, not covered
Transparency and records 3 of 4
- Labelling of synthetic content, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 1 of 6
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 25 are shown.
Purpose 2 controls
- ObligationApplies to: ControllerDrafted by the Index
These standard contractual clauses aim to guarantee personal data protection levels equivalent to those required by Saudi law when transferring data outside the Kingdom to entities lacking adequate protection.
- Applies to: ControllerDrafted by the Index
Controllers and processors may use these clauses as one of several acceptable safeguards for cross-border transfers, alongside binding corporate rules and authorized certifications.
Scope 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers and processors must use these Standard Contractual Clauses when moving personal data to countries or organizations with inadequate protection, though this does not reduce controller accountability to the regulator or data subjects.
Standard Contractual Clauses Rules 8 controls
- ObligationApplies to: ProviderDrafted by the Index
Data exporters and importers must include the Standard Contractual Clauses as mandatory provisions in their transfer contracts.
- Applies to: AnyoneDrafted by the Index
Parties' existing obligations under data protection law remain unaffected by the adoption of Standard Contractual Clauses.
- ProhibitionApplies to: AnyoneDrafted by the Index
Contracting parties must not include terms that conflict with or limit the scope of the Standard Contractual Clauses.
- Applies to: AnyoneDrafted by the Index
Parties may add conditions related to personal data processing only if they do not contradict the Standard Contractual Clauses or data protection law.
- ProhibitionApplies to: AnyoneDrafted by the Index
Any modification to the approved text of Standard Contractual Clauses, except for required blank fields, shall not be recognized and is a violation.
- ObligationApplies to: ProcessorDrafted by the Index
Data importers must submit to Kingdom jurisdiction and comply with binding decisions and authority audits.
- ProhibitionApplies to: ControllerDrafted by the Index
Data exporters must not transfer personal data if the recipient country's laws prevent the importer from complying with the clauses.
- ObligationApplies to: ProcessorDrafted by the Index
Data importers must respond to competent authority requests and cooperate with auditing procedures and compliance follow-up measures.
Standard Contractual Clauses Templates 1 control
- ObligationApplies to: AnyoneDrafted by the Index
Parties must identify which of the four templates applies to their roles and remove provisions that do not apply before implementing the Standard Contractual Clauses.
Appendices 5 controls
- ProhibitionApplies to: AnyoneDrafted by the Index
Parties may not materially amend these Clauses except to choose the appropriate template or update appendix information.
- Applies to: AnyoneDrafted by the Index
Parties may incorporate these Clauses into a broader agreement or add other terms, provided they do not conflict with or infringe the fundamental rights of data subjects.
- ObligationApplies to: AnyoneDrafted by the Index
These Clauses do not absolve parties from duties under the Personal Data Protection Law and Implementing Regulations.
- RightApplies to: OthersDrafted by the Index
Data subjects whose personal data is transferred may report any breach of these Standard Contractual Clauses to the Saudi Data & AI Authority.
- ObligationApplies to: AnyoneDrafted by the Index
These Clauses are interpreted and applied according to the Personal Data Protection Law, its Implementing Regulations and the Regulation on Transfer of Personal Data Outside the Kingdom.
Appendix 2 1 control
- ObligationApplies to: AnyoneDrafted by the Index
Parties must document the categories of data subjects, types of personal data, sensitive data with applicable restrictions and safeguards, transfer purposes, and retention periods or criteria for each transfer.
Appendix 3 7 controls
- ObligationApplies to: AnyoneDrafted by the Index
All parties must specify the organizational, administrative, technical and security controls they will apply to transferred personal data under the applicable law and regulation.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should document controls in this appendix matching the actual circumstances of the data transfer they undertake.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should implement physical access controls such as card readers, electronic locks, security services, alarm systems and surveillance cameras to protect buildings and facilities where personal data is held.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should enforce IT system access controls including electronic password authentication, encryption against unauthorized access, system login procedures, and automatic computer lockout after periods of inactivity.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should establish personal data access authorization procedures with permit management, role definitions, authorization documentation and data access logging.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should protect personal data during transfer and storage using email encryption, secure networks such as VPNs, secure wireless connections and encryption protocols for web access.
- ObligationApplies to: AnyoneDrafted by the Index
Parties should implement input controls through logging and reporting systems to verify whether data has been entered, altered or removed.
Change history
No changes recorded since we began monitoring this policy.