SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
1.9 Enforcement Trends The PDPL moved into active enforcement on 14 Sep - tember 2024, under SDAIA, shifting the market from rulemaking to supervision and extending to non-KSA processors handling KSA residents’ data. Recent trends under this Law highlight an increased focus on privacy protection in the digital space. This includes increased enforcement and regulatory scrutiny for pri - vacy violations, and the law continues to evolve in line with technological advancements. In 2024, the gov - ernment enhanced its monitoring of online platforms, and enforcement activity has increasingly intersected with cybersecurity incidents, such as hacking, illegal data interception and online harassment. Expect scru - tiny of transfers, disciplined 72-hour breach reporting to SDAIA and timely data-subject notices, and super - visory use of the National Register and data privacy officer responsiveness as audit touchpoints. Recent enforcement activity has also been reflected in committee decisions issued under the PDPL frame - work. During the past year, the committees issued 48 decisions confirming violations and imposing the legal - ly prescribed penalties on regulated entities subject to the application of the PDPL. The violations reviewed by the committees included a number of practices related to the collection and processing of personal data, the disclosure of personal data without a legal basis, and failure by controllers to adopt appropriate organisational, administrative and technical measures to protect personal data, as well as violations relating to sending advertising and marketing messages to personal data subjects without obtaining their consent in accordance with the provisions of the Law.
under SDAIA’s remit, cyber-incident reporting and remediation under NCA controls, and sectoral report - ing and corrective action under SAMA’s frameworks. 1.8 Enforcement Proceedings and Fines While the PDPL itself does not spell out detailed pro - cedural steps for enforcement notices (such as how and when SDAIA must notify an organisation that it is under investigation), regulatory practice in KSA gener - ally involves written notices or requests from the com - petent authority requiring production of documents or explanations. How Cases Are Initiated • Matters are commonly triggered by data subjects’ complaints, breach/incident notifications and regulator-initiated supervision. SDAIA has been actively requiring prompt controller responses to complaints. Notice and Response • Authorities issue information requests and deci - sions, and may require corrective actions (eg, to cease or adjust processing, implement controls or register). Controllers must respond to requests from the competent authority and expect the authority’s notice to set the deadline to respond. Failure to meet that deadline can trigger enforce - ment risk. • Where a notification is required to SDAIA, the data controller must notify it within 72 hours of becom - ing aware of the breach. Where a notification is required to impacted data subjects, this must be • Warnings, corrective orders (including suspen - sion/restriction of processing) and administrative fines up to SAR5 million, which may be doubled for repeat violations, may be issued. Decisions can include publication of a summary at the violator’s expense. • Administrative sanctions are appealable. made without undue delay. Administrative Sanctions In addition, enforcement is administered through spe - cialised committees established to review PDPL vio - lations and impose the legally prescribed sanctions.
2. Privacy Litigation 2.1 Privacy Litigation Overview
As of the time of writing, privacy-related litigation in KSA is still in its infancy. There have not been notable lawsuits related to the PDPL. However, complaints and regulatory actions relating to data breaches or violations of consent are starting to emerge, as high - lighted in 1.9 Enforcement Trends . Claimants are pri - marily individuals (data subjects/consumers, employ - ees) alleging unlawful collection/use or disclosure.
383 CHAMBERS.COM
Powered by FlippingBook