SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
set expectations for permissible activities, monitoring scope and retention. Regarding applications, employers may verify can - didates’ education, employment history or other rel - evant records, but such processing must be lawful, transparent and limited to legitimate purposes. Sen - sitive data, such as criminal records or health infor - mation, generally requires explicit consent, and any third-party verification providers or processors must SDAIA, the PDPL and the national cybersecurity base - lines govern personal data handling across M&A from diligence through integration. Controllers must rely on a valid lawful basis, respect purpose limitation and minimisation, and implement safeguards (access con - trols, encryption, logging in). During diligence, entities should limit and struc - ture disclosures and use redaction, aggregation or anonymisation, apply heightened controls for sensi - tive data, and consider a DPIA where risks are high. Cross-border disclosures must satisfy PDPL transfer conditions with contractual safeguards, and parties should clearly allocate roles including processors of such data. comply with PDPL standards. 4.4 Data Protection in M&A At change of control, the buyer should confirm that personal data will continue to be processed for com - patible purposes on a valid legal basis (eg, legiti - mate interests where applicable) and assess whether refreshed consents are needed if purposes or dis - closures materially change. Controllers must ensure transparency by updating privacy notices and, where required, informing data subjects of any change to the data controller, processing purposes or material recipients. Post-closing integration should be preceded by a DPIA for new or high-risk uses, alignment of reten - tion schedules, migration and segregation controls, and the execution or novation of compliant data pro - cessing agreements with vendors. Buyers should also update records of processing activities, appoint or confirm a data officer if required, implement mecha - nisms to honour data subjects’rights, and ensure that
any ongoing cross-border transfers after integration meet PDPL transfer conditions.
5. International Considerations 5.1 Restrictions on International Data Transfers
KSA regulates cross-border transfers through the PDPL for personal data, complemented by sectoral and horizontal frameworks that affect non-personal data, including rules issued by SAMA for financial services, CST regulations regarding cloud computing services for telecom and cloud, health sector regula - tions, NDMO frameworks for government and “offi - cial” data, and NCA controls. Together, these instru - ments function as approval, assurance or localisation frameworks depending on the data and the regulated entity. For both personal and non-personal data, a “transfer” is understood broadly. It generally includes hosting or storing data outside KSA, enabling remote access to KSA-hosted data by personnel located abroad (for example, for support or shared services), making data available to or sharing it with foreign controllers, pro - cessors or sub-processors (including group affiliates), and any onward disclosure by a foreign recipient to another foreign party. Sectoral guidance, particularly for cloud and outsourcing, treats remote administra - tion and sub-processing outside KSA as cross-border activity and therefore subject to transfer controls. Transferring personal data outside KSA involves mov - ing individuals’ personal data from KSA to another country or jurisdiction. This process is often necessary for global business operations, partnerships or ser - vice delivery (eg, while using cloud storage solutions). Such arrangements are subject to specified require - ments of the PDPL. The NDMO sets out general standards for personal data transfer beyond the geographical limits of KSA in order to specify the terms and conditions for cross- border transfer and storage of personal data for both public and private entities while pointing out the sov - ereignty of personal data. The standards also stipulate the rights of personal data owners, along with general
390 CHAMBERS.COM
Powered by FlippingBook