Published:
Saudi Arabia’s Personal Data Protection Law (PDPL) came into force on September 14, 2023, 720 days after its publication in the Official Gazette under amended Article 43, and organizations were given one year from the effective date to bring their practices into line. This means companies are now in the full-compliance phase, and the question is no longer “Does the law apply to us?” but “Can we prove our compliance if asked?”
The law was issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H. Its application is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA) as the competent authority. Below is a 12-point checklist based on the text of the law and its implementing regulations, which compliance, IT or legal teams can use to assess where they currently stand.
Does the Law Apply to Your Organization?
The law applies to any processing of personal data relating to individuals that takes place in the Kingdom by any means, including processing by an entity outside the Kingdom of data belonging to individuals residing in it (Article 2). Processing is a broad concept that covers collection, storage, updating, use, disclosure, transfer and destruction. The only exclusion is an individual’s processing of data for personal or family purposes, provided the data is not published or disclosed to others. As a result, any company that has individual employees, customers or suppliers is most likely a “controller” within the meaning of the law.
The Checklist: 12 Points for Compliance with Saudi Arabia’s Personal Data Protection Law
1) Data Inventory and Record of Processing Activities
Start by mapping what data you collect, from where, for what purpose, where it is stored and who has access to it. Article 31 of the law and Article 33 of the implementing regulations require you to keep an accurate written record of processing activities for the entire processing period and for five years after it ends. At a minimum, the record must include: the details of the controller and the data protection officer, the purposes, the categories of data and data subjects, retention periods, the parties to whom data is disclosed, a description of transfers outside the Kingdom and their legal basis, and the security measures.
2) Identify the Legal Basis for Each Activity
As a general rule, processing requires the data subject’s consent (Article 5), subject to the exceptions in Article 6. These include processing required under another law, processing to perform a prior agreement to which the data subject is a party, or processing necessary for the controller’s legitimate interests, provided it does not prejudice the data subject’s rights and the data is not sensitive. If you rely on legitimate interest, the implementing regulations (Article 16) require you to carry out a documented assessment before processing that weighs your interest against individuals’ rights.
3) Valid Consent
- Consent must be given freely without misleading methods, for clear and specific purposes, by a person with full legal capacity, documented in a way that allows it to be verified, and obtained separately for each purpose (Implementing Regulations, Article 11).
- Consent must be explicit where the processing involves sensitive data, credit data, or decisions based solely on automated processing.
- Consent must not be made a condition for providing a service unrelated to the processing (Article 7 of the law), and it must be possible to withdraw it at any time (Article 5).
4) Privacy Policy and Notice at Collection
You must adopt a privacy policy that is available at the time of data collection and explains the purpose, the content, the method of collection, storage, processing and destruction, and data subjects’ rights and how to exercise them (Article 12). Article 4 of the implementing regulations sets out what the individual must be told at collection, including the contact details of the data protection officer, the retention period and how to withdraw consent. If the data is collected from someone other than the data subject, the data subject must be informed within a period not exceeding 30 days, unless an exception applies.
5) A Mechanism for Handling Data Subject Requests
Individuals have the right to be informed, to access their data, to obtain it in a readable and clear format, to request its correction, and to request the destruction of data that is no longer needed (Article 4). The implementing regulations require requests to be fulfilled within a period not exceeding 30 days, with the possibility of extension in specific cases. Prepare a form, a clear channel and a person responsible for follow-up.
6) Data Minimization, Retention and Destruction
The data collected must be limited to the minimum necessary for the purpose (Article 11) and destroyed without delay once the purpose has ended, unless the identifying elements have been removed, there is a legal basis requiring retention for a specific period, or the data relates to a pending case (Article 18). Set up a retention schedule for each category of data.
7) Processor Contracts
When you engage a service provider that processes data on your behalf (cloud, payroll, marketing, call center), Article 8 of the law requires you to choose a provider that offers sufficient guarantees and to verify its compliance. Article 17 of the implementing regulations specifies what the agreement must contain, including: the purpose, the categories of data, the processing period, the processor’s obligation to notify you of any breach without undue delay, a statement of whether the processor is subject to the laws of other countries, and the identification of sub-processors with your prior approval required for them.
8) Information Security
Article 19 of the law and Article 23 of the implementing regulations require you to take the necessary organizational, administrative and technical measures and to comply with the relevant controls and standards of the National Cybersecurity Authority, or with generally recognized best practices if the organization is not bound by those controls.
9) A 72-Hour Data Breach Response Plan
The controller must notify SDAIA within a period not exceeding 72 hours of becoming aware of a breach incident if it could harm the data or the data subjects or conflict with their rights, describing the incident, the categories and numbers affected, the risks and the measures taken. It must also notify the affected individuals without undue delay, in clear language, if the breach may harm them (Implementing Regulations, Article 24). Keep copies of the notifications and documentation of the corrective actions.
10) Data Protection Impact Assessment
A written, documented assessment of impacts and risks is required in cases that include: processing sensitive data, combining datasets from different sources, large-scale or repeated processing of data of persons lacking full legal capacity, continuous monitoring, use of emerging technologies, automated decision-making, or products that may cause serious harm to privacy (Implementing Regulations, Article 25).
11) Personal Data Protection Officer
A data protection officer must be appointed if the controller is a public entity that processes data on a large scale, or if its core activities consist of regular and systematic monitoring of individuals or the processing of sensitive data (Implementing Regulations, Article 32). The officer may be an employee or an external contractor. SDAIA has issued the Rules for Appointing a Personal Data Protection Officer, which set out the qualification requirements and duties.
12) Direct Marketing and Transfers Outside the Kingdom
- Do not send promotional material through personal communication channels without the recipient’s consent, provide an easy opt-out mechanism that is no less easy than the way consent was obtained, and clearly state the sender’s name (Article 25 of the law and Article 29 of the implementing regulations).
- If data is hosted or accessed outside the Kingdom, this is a transfer or disclosure governed by Article 29 of the law and the Regulation on Personal Data Transfer outside the Kingdom; we will cover this topic in a separate article.
- Do not photograph or copy official documents that identify individuals except as required by law or at the request of a competent public authority (Article 28).
Quick Reference Table: What Evidence Proves Your Compliance?
| Item | Expected evidence |
|---|---|
| Record of processing activities | An up-to-date written record for each activity |
| Legal basis | A legal-basis matrix + a legitimate interest assessment where relied upon |
| Consent | Records of the time, method and scope of consent |
| Transparency | A published privacy policy and collection notices |
| Rights | A written procedure and a log of requests and response times |
| Processors | Contracts or data protection addenda |
| Breaches | A response plan and an incident log |
| Impact assessment | Documented reports for the cases where it is required |
| Data protection officer | An appointment decision and job description where required |
Penalties and Liability
- Disclosing or publishing sensitive data in violation of the law with intent to cause harm or obtain personal benefit: imprisonment of up to two years and a fine of up to SAR 3 million, or either penalty (Article 35).
- All other violations by natural persons and private legal entities: a warning or a fine of up to SAR 5 million, which may be doubled for repeat violations up to twice the maximum (Article 36).
- The injured party’s right to claim compensation for material or moral damage before the competent court (Article 40), and the possibility of publishing a summary of the decision at the violator’s expense (Article 38).
Frequently Asked Questions
Do small companies need to comply?
The law does not exempt organizations based on their size; the test is whether they process individuals’ personal data. However, some obligations, such as appointing a data protection officer and conducting an impact assessment, depend on the nature of the processing and do not apply to every organization.
Is a privacy policy published on our website enough?
No. It is only one item on the checklist. Compliance requires records, legal bases, contracts, security measures and a breach plan that you can demonstrate.
What is the difference between a controller and a processor?
The controller determines the purpose and means of processing, while the processor processes the data for the controller’s benefit and on its behalf. The controller’s responsibility does not pass to another party when processing is outsourced (Article 8).
Is credit data considered sensitive data?
Credit data was removed from the definition of sensitive data by the 1444H amendment, but it still requires explicit consent under Article 24 of the law and Article 11 of the implementing regulations.
How Can We Help?
The team at Alburhan Law Firm helps companies carry out gap assessments based on this checklist and draft privacy policies, processor contracts, and data subject rights and breach procedures, as part of our communications and information technology services and governance and compliance programs. To define the scope of work, you can contact us.
This article provides general information and is not a substitute for legal advice tailored to your situation.
Need advice in this area? Communications & Information Technology – Alburhan Law Firm
