SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Publicly available KSA case law specifically address - ing “non-personal data” as a distinct category remains limited. Published jurisprudence generally addresses privacy or cybersecurity violations without parsing non-personal data as a separate doctrinal domain; disputes involving government open data, cloud data residency for non-personal content, or statistical dis - closure control have not produced widely accessible precedent as of the time of writing. In practice, compli - ance assessments and dispute outcomes are guided by regulator-issued frameworks (SDAIA/NDMO, NCA, CST) and sectoral decisions rather than reported court opinions. KSA does not maintain a single, comprehensive stat - ute governing “non-personal data” as a distinct legal category. Instead, the treatment of non-personal data is shaped by a patchwork of sectoral and cross-cut - ting frameworks that regulate government and com - mercial data assets, cybersecurity and localisation, open data, data sharing and statistical data. While the PDPL governs personal data, non-personal data is principally governed through national data gov - ernance policies (issued by SDAIA/NDMO), open data and data sharing frameworks for public-sector information, cybersecurity baselines and cloud rules (NCA and CST), sector rules (notably statistics and some regulated industries), and general laws govern - ing access to and protection of state or confidential information. The PDPL seeks to regulate the collection, process - ing and storage of personal data in KSA, ensuring data privacy and security. This applies to all personal data, including data generated by Internet of Things (IoT) services, where the IoT is defined as sensors and devices (things) that are connected to the internet and/ or other networks, which help to create value based on exchanged data such as easing jobs functions, as per the NCA’s Cybersecurity Guidelines for Internet of Things (“IoT Guidelines”). The IoT Guidelines aim to provide a comprehensive framework for organisa - tions utilisng IoT technologies to mitigate cybersecu - rity risks. The primary objective is to ensure that IoT
systems are secure, resilient, and compliant with the relevant laws and regulations. The scope of the IoT Guidelines applies to all organi - sations in KSA that use IoT technologies, as well as IoT manufacturers developing products and services. The guidelines are non-mandatory but strongly rec - ommended to minimise cybersecurity risks. They emphasise the importance of embedding cybersecu - rity into the governance, development, maintenance and management of IoT systems. The IoT Guidelines also encourage IoT manufacturers to adopt secure- by-design principles and provide consumers with transparent information about the cybersecurity fea - tures of their products. This dual focus on both users and manufacturers ensures a holistic approach to IoT cybersecurity. From an international perspective, KSA has not enact - ed legislation comparable to the EU Data Act, nor has it announced plans to adopt a framework of similar scope. 3.2 Interaction of Data Regulation and Data Protection Non-personal data is not subject to the PDPL’s law - ful-basis regime. Its processing is governed by the NDMO’s National Data Governance Framework and standards, contractual obligations, sectoral rules and general KSA law. Entities must classify data, apply appropriate access controls and security measures, manage retention and disposal, and ensure data quality and integrity. To the extent that non-personal datasets derive from previously personal data, enti - ties must document the anonymisation or aggregation process and maintain controls to prevent re-identifi - cation. Where non-personal data includes confiden - tial business information or trade secrets, processing must comply with trade secret law and contractual confidentiality obligations. Cloud processing of non- personal data remains subject to the CST framework’s confidentiality, security and incident response require - ments. IoT service providers must ensure that users are informed and give explicit consent before their per - sonal data is collected through IoT devices. The PDPL
385 CHAMBERS.COM
Powered by FlippingBook