SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
rity Authority’s (NCA) Essential Cybersecurity Controls and sectoral frameworks (eg, the Saudi Central Bank (SAMA) for finance and the Communications, Space and Technology Commission (CST) for telecom/cloud). The Anti-Cyber Crime Law adds criminal penalties for unlawful access, interception or misuse, meaning a single incident can trigger PDPL compliance, sectoral supervisory action and criminal exposure. For AI, SDAIA’s national AI strategy and ethics prin - ciples guide responsible development, but the PDPL governs whenever AI systems train (by feeding data), tune (by adjusting model parameters) or infer (by using the model) from personal data (lawful basis, transparency, minimisation, data protection impact assessments (DPIAs) for high-risk uses, heightened safeguards for sensitive data), while robust NDMO- aligned de-identification is required to move process - ing outside the PDPL, and cross-border PDPL trans - fer conditions and any localisation mandates under NDMO/CST/SAMA must be respected for cloud and AI pipelines, with organisations generally applying the strictest applicable rule across these overlapping frameworks. 1.2 Rights and Obligations Under the PDPL, personal data must be processed lawfully, fairly and transparently for specified purpos - es, limited to what is necessary, accurate, retained only as required, and protected by appropriate tech - nical and organisational measures. Controllers are accountable through governance arrangements, records of processing, and oversight of processors. Sensitive personal data is subject to heightened safe - guards and, in some cases, additional conditions or approvals. Cross-border transfers are permitted only where PDPL requirements are met, with stricter rules for certain data types and government data. Organisations must identify a lawful basis for process - ing, provide clear privacy notices, manage vendors through contracts, conduct DPIAs for high-risk pro - cessing, implement security and breach-response measures aligned with applicable cybersecurity and sectoral requirements, and comply with any applica - ble data localisation obligations.
Data subjects have rights to be informed, to access and correct their data, and to request erasure where legally permitted, subject to statutory exceptions. The PDPL sets conditions, timelines and exemptions for these rights, requires documented handling of requests, and provides avenues for complaints to the competent authority, with sector regulators offering parallel remedies where applicable. As a general checklist, organisations should opera - tionalise the PDPL by inventorying and classifying data, documenting lawful bases (using compliant consent where required), publishing privacy notices and maintaining records of processing. They should establish governance (policies, roles, training), imple - ment processor contracts and third-party controls, and align security and breach response with the NCA, SAMA and CST requirements, meeting the shortest applicable notification timeline. 1.3 Special Categories of Personal Data Under the PDPL, “sensitive personal data” (includ - ing categories designated by law and regulation such as health, genetic and biometric data) may be pro - cessed only where a valid lawful basis exists and with heightened safeguards proportionate to risk, including stricter access controls, purpose limitation, minimisa - tion, secure storage and transmission (eg, encryption), documented risk assessments for high-risk uses, tighter breach notification triggers, and additional conditions for disclosure and cross-border transfers. Certain unlawful disclosures of sensitive data can attract criminal liability. For example, data about minors requires age-appro - priate transparency and a lawful basis that typically includes verifiable consent of a parent or legal guard - ian, with special care to avoid unfair profiling or mar - keting and to implement enhanced protection by design and default. In addition, processing data relat - ing to criminal accusations or convictions is generally limited to situations expressly authorised by law and typically carried out by or under the control of com - petent authorities, consistent with the Law of Criminal Procedure’s constraints on the collection, access and disclosure of criminal case information and the Basic Law’s privacy guarantees.
380 CHAMBERS.COM
Powered by FlippingBook