SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Data protection and privacy issues in the Kingdom of Saudi Arabia (KSA) are governed by a robust set of laws, regulations, policies, procedures, standards and guidelines. The most notable of these laws is the Personal Data Protection Law of 16 September 2021, issued by Roy - al Decree M/19, and its amendments (together with the Implementing Regulations, the PDPL) came into force on 14 September 2023. Other significant laws and regulations relating to the protection and privacy of data in KSA include, among others: • Telecommunications and Information Technology Law no. M/160 of 2022 (the “TCIT Law”); • Electronic Transactions Law no. M/18 of 2007 (the “ET Law”); • Anti-Cyber Crime Law no. M/17 of 2007 (the “ACC Law”); and • Electronic Commerce Law no. M/126 of 2019 (the “EC Law”). Also, in August and September 2024, the Saudi Data & AI Authority (SDAIA) issued several new regulations to enhance and streamline the data privacy framework in KSA. These regulations are: • regulation on personal data transfer outside KSA; • rules for appointing personal data protection officer; • data sharing policy; • elaboration and developing privacy policy guide - lines; • minimum personal data determination guidelines; • guidelines for binding common rulesBCR for per - sonal data transfer; • standard contractual clauses for personal data transfer; • personal data destruction, anonymisation and pseudonymisation guidelines; • personal data disclosure cases guidelines;
• personal data processing activities records guide - lines; and • personal data breach incidents procedural guide. The PDPL covers processing of personal data that (i) takes place in KSA or (ii) relates to individuals residing in KSA, by any means, by any party outside KSA. The TCIT Law covers communication services and pro - tection of client and customer data and privacy. The ET Law covers electronic transactions, creating and keeping electronic records, electronic signatures and electronic authentication certificates. The ACC Law addresses cybersecurity crimes and their punishment. The EC Law covers the usage of customers’ data in electronic commerce transactions. The policies, procedures, standards and guidelines are vast; however, those that are most relevant to data protection and privacy are: • general principles for protecting users’ personal data privacy; • procedures for launching services or products based on a customer’s personal data or regarding the sharing of personal data; • national data governance policies; • data management and personal data protection standards; • general standards for personal data transfer beyond the geographical limits of KSA; • children and incompetents’ privacy protection policy; and • guidelines and specifications on data management governance and personal data security. In KSA, the PDPL provides the baseline legal regime for any processing of personal data, while SDAIA’s National Data Management Office (NDMO) instru - ments govern government and non-personal data (including classification, sharing and de-identification standards), so mixed datasets are handled by apply - ing the PDPL to the personal elements and NDMO governance to the rest, with the PDPL still attaching if re-identification is reasonably possible. The PDPL’s security, breach notification and proces - sor oversight duties operate alongside prescriptive cybersecurity controls from the National Cybersecu -
379 CHAMBERS.COM
Powered by FlippingBook