SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
requires that individuals have the right to access their data and request corrections. Both IoT providers and data processors must imple - ment robust security measures to protect data against breaches and unauthorised access, as stipulated in the NCA’s guidelines. These obligations align with the PDPL’s security provisions to prevent data breaches. The PDPL mandates that personal data be destroyed when it is no longer necessary, which interacts with IoT providers’ obligations to ensure that devices or systems do not retain unnecessary data. The interac - tion ensures that data protection is not overlooked as IoT technologies expand, balancing innovation with the protection of individuals’ rights to privacy and security. Under the PDPL, processing may rely on several bases, including consent, contractual or legal neces - sity, legitimate interests subject to a balancing test, vital and public interests, and research/statistics with appropriate safeguards. For each processing pur - pose, identify the primary legal basis, document the justification, apply purpose limitation and data mini - misation, and maintain records of processing. Where relying on legitimate interests, complete and retain a written assessment demonstrating that the control - ler’s interests are not overridden by the data subjects’ rights and expectations and implement proportionate safeguards. For children’s data and sensitive personal data, apply heightened controls, document the neces - sity and ensure enhanced security. Cross-border transfers require adequacy or appropriate safeguards and a transfer assessment on file, with derogations used only where strictly necessary. 3.3 Rights and Obligations Under Applicable With respect to non-personal data, organisations should align with the NDMO’s data governance instruments (including the National Data Governance Interim Regulations, the Data Classification Policy, the Data Sharing Policy, the Open Data Policy and the KSA Open Data Licence), which require data to be classified and managed according to sensitivity and business/mission impact, and shared only on a pur - Data Regulation Non-Personal Data
pose‑limited, proportionate and secure basis. Access and reuse are governed by the applicable data clas - sification and any sharing agreement or open data licence, with “open” datasets generally made avail - able under standardised terms that require attribution, prohibit misrepresentation and preserve data integrity. Fairness, transparency and non‑discrimination prin - ciples apply to decisions on granting access, setting conditions or fees, and prioritising users, and charges (if permitted) should be objective and cost‑reflective. Requirements for the Collection, Processing and Use of Personal Data Article 10 of the PDPL stipulates that the controller may collect personal data only from the personal data subject. Such personal data may only be processed for the purpose for which the personal data is collect - ed. However, the controller, on an exceptional basis, may collect personal data from a person other than the personal data subject or process personal data for a purpose other than that for which the personal data is collected, namely when: • the personal data subject consents in accordance with the provisions of the PDPL. • the personal data is publicly available or collected from a publicly available source. • the controller is a public entity, and the personal data was not collected, or processed, as required either for security purposes or in order to imple - ment another law or fulfil judicial requirements in accordance with the provisions set out in the regulations; • compliance with this restriction may cause harm to the personal data subject or affect the vital inter - ests of the personal data subject (as set out in the regulations); • collection or processing of personal data is neces - sary to protect public health or safety or to protect the life or health of a specific individual. The regula - tions shall set out the rules and procedures appli - cable in this respect; • the personal data will not be recorded or stored in a form that makes it possible to identify the per - sonal data subject directly or indirectly. The regula - tions set out the rules and procedures applicable in this respect; and
386 CHAMBERS.COM
Powered by FlippingBook