Saudi Arabia PDPL

Who is excluded from PDPL compliance? 

The PDPL does not apply to personal data being processed for family or personal use and there is no mention of revenue thresholds or business size in connection with it. 

Explicit consent is required for the processing of personal data, however, there are some exceptions to this, such as: 

• when processing is in the interest of the data subject and contact with them is impossible or difficult to achieve;
• if the processing is part of another system or of an implementation of some previous agreement to which the data subject is a party; or 
• if you are a public entity that is required to perform processing either for security purposes or to satisfy judicial requirements.  

This means that in general, you must obtain consent from a KSA resident prior to collecting, processing and/or storing their data.

How can I keep my organization PDPL compliant?

In order to be compliant with the PDPL you have to meet a series of requirements. There are as of yet a series of executive regulations still pending issuance which would clarify compliance but as of Q3 2022 you are required to : 

• Register via an electronic portal and pay an annual registration fee if you are a data controller. 
• Ensure that before processing personal data, said data is complete, accurate and relevant. In addition to this, you have to keep processing records and ensure proper training to all staff as regards PDPL compliance. 
• Display a privacy policy on your website, outlining how data will be processed.
• Appoint a local representative if your business operates but is not located in the KSA. In addition to this, you will need to appoint a data protection officer. 
• Obtain consent prior to data processing, as this is the main legal basis for processing under the PDPL.
• Conduct data protection impact assessments (DPIAs) to determine any risks posed to individuals. 
• Report data breaches immediately to the regulatory authorities. 
• Restrict international data transfers unless one of the following applies: 
• there is an extreme necessity that relates to a threat against the life of the data subject in question;
• there is an agreement that the KSA is party to;
• the data transfer serves Saudi interests.
  
  

What data access rights does PDPL grant? 

• Right to access: data subjects have the right to access their personal data, obtain a copy of it in a clear format, and free of charge.
• Right to be informed: data subjects have the right to be informed about the collection of their data, of the legal justification for this, and the purposes for which it is being collected. 
• Right to delete: data subjects can request that their personal data be deleted once its purposes have been exhausted.
• Right to rectification: data subjects have the right to request corrections of their personal data. 
• Right to object/withdraw consent to the processing of personal data: data subjects have the right to object to their personal data being processed and can withdraw their consent.

How to address data subject access requests under PDPL?

Data subject access requests have to be replied to within a period of 30 days with the possibility of extending this to an additional 30 days if the request requires unusual efforts or you receive multiple requests from the same data subject. 

A record of the requests received has to be kept and be made available upon request. 

Enforcement and penalties

The PDPL mandates that for the first two years the Saudi Data & Artificial Intelligence Authority (SDAIA) will be the regulatory authority that will implement the law, and thereafter the National Data Management Office (NDMO) will have the  authority to regulate the PDPL. 

Regarding penalties, unlike other privacy regulations, the PDPL sets out three categories of penalties, including confiscation of funds gained following a violation of the law and potentially requesting that the judgment be made public at the expense of the offender.

The three categories are as follows: 

• For disclosing sensitive personal information: up to SAR 3 million (approx. $798,000) and/or imprisonment for 2 years;
• For violating the data transfer provision: up to SAR 1 million (approx. $267,000) and/or imprisonment for 1 year;
• For other violations of the provisions: a warning notice or a fine up to SAR 5 million (approx. $1,331,000).

As you can see above, PDPL differs from other major privacy regulations as it imposes criminal liability for certain infractions. For repeated violations the fines may be increased up to double the maximums.

Data Subject Rights - GDPR vs. PDPL Saudi Arabia