SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
4. Sectoral Topics 4.1 Use of Cookies
regime, and marketing involving minors requires valid consent, typically from a parent or legal guardian. 4.3 Employment Privacy Law Under the PDPL, employers are considered control - lers, and therefore employee and applicant data must be processed lawfully, fairly and transparently, and only for specific and legitimate purposes in accord - ance with the PDPL. Monitoring time or productiv - ity tracking must be necessary and proportionate, explained in clear notices and grounded on a suitable lawful basis. High‑risk monitoring should be support - ed by documented risk assessments, and biometric time clocks involving sensitive data require enhanced safeguards. Remote work should implement technical and organi - sational measures, respect localisation/transfer lim - its, and avoid excessive location/activity tracking beyond stated purposes. In remote-work settings, employers commonly apply technical and organisa - tional safeguards, including access controls, encryp - tion, secure connectivity and logging-in in line with NCA expectations, while taking care to limit location or activity tracking to what is reasonably required for defined purposes. Organisations should also ensure that any processing or storage outside KSA complies with PDPL cross-border transfer conditions (includ - ing where employee data is accessed remotely from abroad, which may constitute a cross-border transfer), and associated regulatory safeguards. Bring Your Own Device (BYOD) programs warrant particular care: mobile device management or secure containers should segregate corporate from personal data; access to personal content should be tightly limited; and any device-level monitoring or telemetry must be clearly disclosed and confined to security- necessary data, reflecting the PDPL’s data-minimisa - tion and purpose-limitation principles. In addition to PDPL compliance, many KSA organisa - tions are already aligning BYOD security controls with NCA standards, because insecure personal devices can expose personal data to breaches and lead to PDPL compliance violations. The use of corporate IT systems is best governed through cogent, well-pub - licised acceptable-use and monitoring policies that
As of the time of writing, there are no specific require - ments imposed in KSA for the use of cookies. For the general rules in relation to gaining consent in rela - tion to cookies and SDKs, please see 3.3 Rights and Obligations Under Applicable Data Regulation under ‘Requirements for the Collection, Processing and Use of Personal Data’. 4.2 Personalised Advertising and Other Online Marketing Practices In KSA, personalised/targeted advertising is prin - cipally governed by the PDPL, together with CST rules on electronic marketing and anti‑spam, and the E‑Commerce Law and its Implementing Regulations. The PDPL generally requires explicit consent before personal data may be used for direct or targeted mar - keting, particularly where there is no prior interaction with the individual, and individuals must be given a clear and easy way to withdraw consent at any time, particularly when advertising is delivered through per - sonal communication channels such as email or SMS, and individuals must be given a clear and easy way to withdraw consent at any time. CST’s commercial communications and anti-spam framework requires prior opt-in for promotional SMS, calls and electronic messages, sender identification, and a free, effective opt-out that is promptly hon - oured, alongside suppression-list management. For online tracking, consent is expected for advertising cookies/SDKs and cross-site identifiers, delivered through a compliant consent interface that is granular, informed and reversible. Cross-border transfers must meet PDPL transfer conditions and be governed by appropriate contractual safeguards. While the law does not expressly regulate “profiling” in the same way as the EU GDPR, any profiling or target - ing that involves personal data must comply with the PDPL’s general principles of lawful processing, trans - parency and consent. The use of sensitive personal data (such as health, biometric, genetic or religious data) for marketing purposes is prohibited. Children’s personal data is protected under the general PDPL
389 CHAMBERS.COM
Powered by FlippingBook