Guide to Saudi Arabia’s Personal Data Protection Law (PDPL)

In this guide:

Overview of Saudi Arabia’s Personal Data Protection Law (PDPL)

The Personal Data Protection Law (PDPL) is updated and active in Saudi Arabia as of March 2023, serving as the first data protection law of its kind in the country. Established via Royal Decree, the PDPL is enforced by the Saudi Data & Artificial Intelligence Authority (SDAIA) and the National Data Management Office (NDMO), although the latter is the more present authority. The goal of the PDPL is to protect the public’s right to their personal data, especially in a digital format, by providing individuals with these rights and details. At the same time, the organizations to ensure misuse and abuse of personal data does not occur or is penalized promptly.

In other words, the PDPL applies to all government agencies, companies, and individuals that process Saudi residents’ personal data, defining personal data as any information that can identify an individual directly or indirectly. This is in line with other global data privacy regulations, and covers data like names, IDs, locations, online identifiers, biometrics, religious beliefs, health information, financial information.

Key provisions of the PDPL include:

• The principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality for personal data processing.
• Mandates for the collection of explicit consent from data subjects to process their personal data. Sensitive data like health, financial, biometric and private information require explicit and separate consent.
• Stipulations requiring that processing personal data is only done for legitimate, specified, explicit and legal purposes that the data subject has been informed about.
• The prohibition of personal data transfers outside of Saudi Arabia unless there are appropriate safeguards and legal grounds for the transfer.
• Companies are required to implement technical and organizational measures to ensure data security and prevent unauthorized access or disclosure of personal data.
• Data controllers (individuals & organizations holding your data) of a certain size must appoint a data protection officer (DPO) to oversee compliance, conduct data protection impact assessments for high-risk processing, and maintain records of processing activities.

To enforce these provisions, Saudi Arabia established the aforementioned regulatory bodies while specifically outlining several rights for its residents. These rights mirror laws like the European Union (EU) General Data Protection Regulation (GDPR), which is important because it helps ensure more seamless data transfer processes abroad. When countries do not align on the rights granted to individuals and protections required for personal data, there can be additional documentation required for businesses looking to make this sort of international transfer.

For Saudi Arabia, cross-border data transfers are prohibited unless specific, proactive consent has been obtained from the data subject and authorization has already been granted the NDMO. There are some countries already pre-approved by the NDMO, which makes those transfers a straightforward process from a legal perspective.

For the individual, also referred to as the data subject, the following enumerated rights are granted by the Kingdom of Saudi Arabia:

1. Right to access: Individuals have a right to request information about the personal data being processed about them by an individual or organization.
2. Right to rectification: If personal data held is inaccurate or incomplete, the individual may have the right to have it corrected. There are few exceptions to this requirement.
3. Right to erasure: Individuals can request the deletion of their personal data in certain circumstances.
4. Right to object: Individuals may object to the processing of their personal data for specific reasons, like marketing efforts targeting them, to mitigate this activity.

The PDPL establishes comprehensive requirements aligned with international standards for lawful, fair and transparent processing of personal data and respecting residents’ privacy rights. It aims to enable responsible data use while building trust and empowering data subjects. The law provides strong oversight, enforcement and penalties for violations.

Organizations looking to do business in Saudi Arabia must be aware and comply with the provisions in the PDPL, as it sets forth several clear obligations. However, these obligations should not be viewed as a burden but as an opportunity, as going above and beyond to protect consumers’ data privacy has positive knock-on effects.

Source: SDAIA Official Website

Secure your business compliance

Complying with international data protection legislation is no longer an option. It’s a requirement. Saudi Arabia’s PDPL joins a long list of global regulations placing the responsibility on businesses to comply with different, comprehensive legal requirements around personal data handling.

Before detailing all of the best practices businesses today should consider, it’s important to understand the key implications of this PDPL for organizations marketing or selling Saudi Arabian residents:

• Increased compliance obligations: Businesses must implement technical and organizational measures to comply with the data protection principles and requirements (listed above) in the PDPL. This requires significant investment.
• Data security: Companies must implement appropriate cybersecurity measures like encryption, anonymization, access controls and more to protect personal data.
• Consent management: Companies not only need to collect consent before processing personal data, but they need a process to manage it. This requires an organization to obtain separate, explicit, informed and unambiguous consents from data subjects for collecting and processing personal data, especially sensitive data. Existing consent responses need to be obtained again if the use cases change.
• Transparency: Clear privacy notices must be posted on the company website in an easy-to-find location to explain how personal data is handled to data subjects. Communications with customers may also need to be enhanced to make this information readily available.
• Data minimization: Businesses should collect, retain and process only the personal data that is adequate, relevant and limited for specified purposes. Databases and systems may need to be reviewed.
• Data localization: Sensitive personal data will need to be stored and processed only within Saudi Arabia, unless explicitly authorized for cross-border transfer by the NDMO.
• Data protection officers: Large companies will need to appoint formal data protection officers for compliance oversight, cooperation with authorities, handling data subject requests etc.
• Breach notification: Breaches affecting data subjects’ rights must be reported to the NDMO within 5 business days. Procedures should be established before an event so this can be done in a timely fashion if and when a breach does occur.
• Record keeping: Robust documentation of data processing activities, data inventories, and consents is required. These will need to be maintained and updated regularly per the PDPL’s accountability requirements.
• Potential penalties: Violations can take on a few different forms, and may lead to fines of up to SAR 20 million, restrictions on data processing, temporary ban on websites/services, imprisonment up to 1 year, and compensation to data subjects. In cases where there may be one or more penalties, the bigger penalty is typically selected. This becomes incredibly detrimental to business operations very quickly.

These provisions are a lot to consider for any organization, regardless of size. While the PDPL in Saudi Arabia represents a crucial step towards safeguarding individuals’ privacy and regulating the processing of personal data in the digital age, it puts a ton of requirements on businesses to adjust. And quickly!

Thus, these are the best recommendations for businesses looking to ensure compliance with this PDPL and other international regulations like it:

1. Conduct an audit to identify all personal data collection, storage, usage, sharing, retention and deletion.
2. Draft new or updated data protection and privacy policies and adjust external and internal privacy notices accordingly.
3. Check existing consent methods and refresh where required to meet the standards for explicit, informed, separate consent responses for personal and sensitive data.
4. Collect only the minimum amount of personal data necessary for specified purposes.
5. Assess third-party vendors & partners handling personal data and update contracts as needed.
6. Restrict sensitive personal data transfers to be within Saudi Arabia or obtain approval from the NDMO.
7. Strengthen cybersecurity to ensure data is effectively protected proactively.
8. Conduct impact assessments for high-risk processing activities.
9. Assign oversight roles when needed, including a formal DPO role.
10. Maintain stringent records of all data processing activities.
11. Establish an incidence response plan and procedures in the case of a data breach, then test regularly.
12. Conduct training and awareness activities for all staff handling personal data.
13. Monitor compliance via periodic reviews, audits and self-assessments to validate compliance across all operations and make regular improvements.

By taking these steps, businesses can effectively identify and mitigate compliance gaps with Saudi Arabia’s new data protection law. Ongoing monitoring and reviews will be key.

Organizations must assess their data governance, security and consent mechanisms and invest in enhancing privacy programs, policies and technologies to ensure full compliance with Saudi Arabia’s new data protection law. Doing so will not only improve the security posture of the company, but can help build lasting trust with consumers that helps the brand and business in the long run.

How Privacy Bee assists

In the contemporary digital landscape, protecting personal data and imparting knowledge about data usage to internal users has become an imperative for businesses engaged in online service delivery. New regulations are sprouting up around the word, necessitating more stringent opt-in and opt-out policies and granting consumers more rights. Consumers are gaining the ability to scrutinize and obliterate their personal data, increasing the accountability of organizations with regard to data protection.

Despite the proliferation of these regulations, the onus primarily falls upon individuals to vigilantly oversee, assess, and request the removal of their personal data wherever it may be dispersed throughout the vast realm of the internet. This task becomes even bigger when expanded across an entire organization, rendering it practically impossible for a single person or small team to manage without outside professional help. Nevertheless, the identification and subsequent elimination of this data play a pivotal role in deterring cybercriminals. It substantially reduces a company’s attack surface and mitigates the looming threat of a data breach. This is where Privacy Bee emerges as the optimal solution, simplifying the time-consuming process of monitoring and eradicating employee personal data for business leaders. It’s especially effective for executives who are highly visible to the general public.

Privacy Bee not only minimizes the proliferation of your organization’s personal data across the vast digital landscape but also extends its protective umbrella to vendors, helping you ensure 3rd party partners do not serve as the weak link in your security defenses. If you are already conducting risk assessments and vendor surveys, kudos to you! However, it is essential to recognize that a vendor is most susceptible to a breach via subpar data privacy management, which you wouldn’t want to bleed into your organization.

The Privacy Bee proactive approach fights back against the exploitation of your most sensitive data, fortifying your External Data Privacy on multiple fronts.

In the ever-expanding, billion-dollar surveillance industry, Data Brokers and People Search Sites have assumed pivotal roles, reaping profits by trading your organization’s information with obscure and uncontrollable entities. The consequences of private data exposure on the internet are far-reaching and pose significant threats when obtained by malicious hackers. A solitary data breach can lead to a loss in productivity, expensive remediation efforts, and recurring breach incidents—a predicament that plagues the majority of businesses following an initial breach. The first data breach sets off a chain reaction that not only inflicts short-term damage on your bottom line but also erodes brand value and customer trust over time. Furthermore, there are ripple effects to consider, such as heightened employee turnover due to poaching and a substantial decline in productivity due to more sophisticated spam outreach.

Privacy Bee combats external threat actors lurking beyond your organization’s perimeters. By meticulously pinpointing every nook and cranny of the internet where your data resides and swiftly purging it, Privacy Bee closes the data security gap. The service even encompasses dark web monitoring and provides timely data breach notifications if another company falls victim to an exploitation incident and potentially exposes your information in the process.

Our unwavering commitment is deeply rooted in the belief that privacy is an inalienable human right that transcends political discourse and negotiations. This is why Privacy Bee vigilantly monitors user data for security vulnerabilities while holding the surveillance industry accountable. We compel Data Brokers, People Search Sites, and more than 150,000 additional websites to expunge your stored data and opt out of further data collection.

Privacy Bee protection covers a wide range of potential threats, including:

• Data breaches
• Social engineering attacks
• Doxxing
• Identity theft
• Spam emails
• Telemarketing calls
• Cyberstalking
• Swatting
• Blackmail

Our service is a powerful tool for business leaders who want to protect their employees’ and customers’ data. In today’s world, where privacy is more important than ever, Privacy Bee is your trusted partner in the fight to preserve personal and organizational integrity.