SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
• the entities to which the personal data will be dis - closed, the capacity of such entities, and whether the personal data will be transferred, disclosed or processed outside KSA; • the potential consequences and risks that may result from not collecting the personal data; • the rights of the personal data subject pursuant to Article 4 of the PDPL; and • such other elements as set out in the regulations based on the nature of the activity performed by the controller. 3.4 Regulators and Enforcement For non-personal data, the NDMO leads data govern - ance and classification (particularly for government datasets), alongside the Digital Government Authority (DGA) on public-sector data and open data. The CSA’s cloud and data localisation frameworks and the NCA’s baseline controls shape non-personal data handling across sectors, with sector regulators (SAMA, CMA, health regulators) embedding these standards in out - sourcing, resilience and information-management rulebooks. Co-ordination relies on inter-agency stand - ards alignment and cross-referrals where cloud, tel - ecom and sector supervision overlap, and the General Authority for Competition (GAC) may engage where control of large non-personal datasets or infrastruc - ture access raises competition concerns. Recent trends include heightened scrutiny of cloud and data localisation, deeper embedding of NCA controls in sectoral rulebooks, and continued standardisation of government data governance and open data prac - tices through SDAIA/NDMO and DGA. For personal data, SDAIA and its Personal Data Pro - tection Authority (PDPA) are the primary regulators of the PDPL, with the CSA supervising telecom, digital and cloud frameworks (including data residency and anti-spam) and NCA overseeing cross-sector cyber - security controls. Sector regulators – most notably SAMA and CMA – set complementary requirements on data security, outsourcing/cloud, operational resil - ience and third-party risk. In health, the Ministry of Health and national health information bodies gov - ern health data handling and exchange. Public pros - ecution addresses criminal aspects of data offenc - es. Co-ordination occurs via referrals, co-operation agreements, concurrent investigations and aligned
guidance – for example, SDAIA/PDPA handling pri - vacy compliance, NCA overseeing security baselines, CST supervising cloud/telecom obligations and sector regulators applying domain-specific controls – with GAC interfacing on digital-market issues and co-ordi - nating to ensure remedies respect privacy and sec - toral rules. Recent trends include maturation of PDPL guidance and stepped-up supervisory engagement by SDAIA/PDPA, convergence of incident reporting expectations, and a growing GAC focus on data- driven theories of harm in digital and fintech markets. Sector authorities (CST, SAMA, health regulators, oth - ers) typically cross-reference NDMO data governance standards for classification, sharing and life-cycle management and align security expectations with NCA controls. This creates a layered regime where sectoral enforcement incorporates national data gov - ernance baselines. DGA government/open-data mandates align with NDMO standards for classification, metadata and sharing; where publication risks re-identification, DGA processes incorporate de-identification and licensing controls consistent with national guidance. NCA co-ordinates cybersecurity oversight with sector regulators (harmonised audits and incident reporting) and aligns protection levels with national classification schemes. CST co-ordinates with SDAIA on data residency, access by public authorities, and security obligations that apply across data types. CST also interfaces with GAC when telecom/information/communications/ technology and cloud matters raise data-related com - petition issues. GAC consults SDAIA and sector regulators on techni - cal feasibility of data access, segregation, interopera - bility or de-identification in conduct cases and merger remedies involving datasets.
388 CHAMBERS.COM
Powered by FlippingBook