Meet PDPL compliance and minimise your legal risk

Saudi Arabia passed the Personal Data Protection Law (PDPL) in the government's Official Gazette on September 24, 2021. The law came into full enforcement on March 17, 2023, with an expected grace period of one year for businesses to become compliant.

The PDPL defines personal data as any information that identifies a person specifically or could lead to their identification, including (but not limited to): name, driver's license number, phone number, email address, or social security number. Personal data used for personal or household purposes are exempted from PDPL. The law also protects the personal data of deceased individuals if their information could lead to the identification of the deceased individual or their family members.

The PDPL also groups some types of personal data as "sensitive". Sensitive personal data is any information inferred from an individual's "ethnic or tribal origin, religious, intellectual or political belief, or indicates his membership in civil associations or institutions." It also includes criminal and security data, biometric data, genetic data, credit data, health data, location data, and data that indicates that an individual is unknown to one or both parents.

The transfer of personal data outside the Kingdom is permitted in limited circumstances. PDPL introduces the concept of adequacy, allowing personal data to be transferred to a country that can ensure appropriate protection of personal data and the rights of individuals. The law also recognises other grounds for transferring personal data outside the Kingdom, notably if the transfer is carried out in the performance of an obligation of the data subject.

The Saudi Data and Artificial Intelligence Authority (SDAIA) will be the primary authority that will oversee the implementation of PDPL for the first two years of its enforcement. The National Data Management Office (NDMO) will take over as the supervisory authority after this time period.

The SDAIA will oversee PDPL enforcement and is also expected to advise organisations regarding compliance with various provisions and consumer rights, among other responsibilities.

The Kingdom of Saudi Arabia (KSA) is not subject to the General Data Protection Regulation (GDPR) because GDPR protects data privacy rights of EU and EEA residents. However, suppose a business established in KSA collects the personal data of EU residents in exchange for goods and services or for monitoring their behaviour, in that case, GDPR will apply to those businesses.

Here are some links you can refer to for additional reading:

• Complete Guide to Saudi Arabia's PDPL
• Basics of Cookie Compliance