SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
• accountability and responsibility. In addition, in November 2023, the government announced the establishment the International Center for Artificial Intelligence Research and Ethics, which aims to advance competencies and legislative frame - works in the field of AI and other advanced technolo - gies. 1.6 Data Breach Requirement Under SDAIA’s Personal Data Breach Incidents Proce - dural Guide, certain requirements must be adhered to in the event of a personal data breach, namely: • Stage one: Notify SDAIA within 72 hours. Con- trollers must notify SDAIA via the Personal Data Breach Notification service on the National Data Governance Platform within no more than 72 hours of becoming aware of the breach, if the incident is expected to harm personal data or data subjects or conflict with their rights or interests, without prejudice to other NCA or sectoral reporting rules. The notification must include a description of the personal data breach (including timing, cause and discovery), the affected data subjects and data types, associated risks and mitigation measures taken and planned, whether data subjects have been or will be notified, and the relevant controller or data protection officer contact details. • Stage two: Breach incident containment. Control- lers must implement response and containment procedures for personal data breaches in line with international best practices and applicable regula - tions, including identifying the type and volume of affected data, determining and changing compro - mised data where possible, identifying affected individuals, and notifying data subjects without undue delay where their rights or interests may be harmed. Notifications must be made through appropriate communication channels, including direct and, where nationally widespread, public means, and must clearly explain the breach, asso - ciated risks, mitigation measures, controller and data protection officer contact details, and provide guidance to help affected data subjects mitigate potential harm such as fraud or identity theft. • Stage three: Documentation. The controller must retain records of all personal data breach incidents,
including documents submitted to SDAIA, correc - tive actions taken and related records, and must implement necessary corrective measures to con - tain breaches based on lessons learned. 1.7 Regulators KSA’s data protection and cybersecurity oversight is shared across several authorities with distinct man - dates. SDAIA is the primary regulator for the PDPL, while the NDMO sets national data governance poli - cies. NCA issues cybersecurity baselines and con - trols, and sectoral regulators including SAMA, CST and the Capital Market Authority (CMA) impose paral - lel requirements within their domains. The framework relies on co-ordinated supervision, complaint-driven and risk-based enforcement, and the alignment of data, cybersecurity and sectoral standards. Domestically, complaints are handled among the authorities in co-ordination with one another. Sector regulators impose domain-specific rules that intersect with data protection and cybersecurity. SAMA’s core competence includes prudential and conduct supervi - sion of financial institutions, with enforceable frame - works on cybersecurity, outsourcing and third-party risk that capture data handling and protection. CST supervises telecommunications, digital and cloud markets, including data localisation or transfer con - ditions embedded in licensing and cloud regulatory frameworks. CMA oversees capital markets partici - pants, including data and cybersecurity requirements tailored to market integrity and investor protection. SDAIA conducts and co-ordinates cross-border mat - ters using a combination of PDPL powers over KSA- established controllers/processors, co-operation instruments with foreign authorities, and government- to-government channels where compulsion abroad is required. Typical triggers include referrals from for - eign regulators, breaches involving offshore vendors or group entities, suspected unlawful international transfers, and data subjects’ complaints with foreign elements. In practice, significant privacy or security events often trigger multi-agency co-ordination. A personal data breach at a financial institution, for example, will require PDPL breach assessment and notifications
382 CHAMBERS.COM
Powered by FlippingBook