SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
guidelines and exceptions for personal data transfer beyond KSA’s borders – thereby creating secure pro - cessing for personal data. The Regulation on Personal Data Transfer Outside the Kingdom (“Transfers Regulation”) imposes sev - eral restrictions on the international transfer of per - sonal information to ensure that such transfers comply with KSA’s data protection standards. According to Article 29 of the PDPL, personal data may only be transferred outside KSA if the receiving country or entity provides an appropriate level of protection that meets or exceeds the standards set by KSA law. This requirement is further detailed in Article 3 of the Trans - fers Regulation, which mandates that the competent authority publish and maintain a list of countries or international organisations that meet these protec - tion standards. If the receiving country is not on this list, the transfer is generally prohibited unless spe - cific appropriate safeguards are implemented, such as SCCs, BCR, or approval certificates from a licensed body as outlined in Article 4. These safeguards ensure that the data is protected to a level consistent with KSA regulations, even when transferred internation - ally. Before transferring personal data outside KSA, con - trollers are required to conduct a risk assessment under Article 7 of the Transfers Regulation. This assessment is mandatory for transfers involving sen - sitive data or when the transfer is made under the exemptions specified in Article 4 of the Transfers Reg - ulation. The risk assessment must evaluate several factors, including the purpose and legal basis for the transfer, the nature of the data, and the appropriate safeguards in place to protect the data. Additionally, the assessment must consider the potential material or moral effects of the transfer and the likelihood of risks to data subjects. This ensures that controllers carefully weigh the necessity of the transfer against the potential risks to individuals’ privacy and data security. The risk assessment requirement under - scores the importance of ensuring that international transfers are conducted responsibly and in compli - ance with the Transfers Regulation. Furthermore, the Transfers Regulation allows for exemptions from the general restrictions on inter -
national data transfers in specific cases, as outlined in Article 4 (2). For example, transfers are permitted for central operations within multinational entities, for scientific research, or to provide services to data subjects, provided that the appropriate safeguards are in place. However, even in these cases, the data must be limited to the minimum amount necessary to achieve the intended purpose, and the receiving entity must ensure compliance with KSA data protec - tion standards. If the competent authority determines that the safeguards are inadequate, the transfer may be halted, and the controller must notify the relevant entities under Article 6 of the Transfers Regulation. These restrictions and requirements ensure that inter - national data transfers are conducted in a manner that prioritises the protection of personal data and aligns with KSA’s legal and regulatory framework. 5.2 Government Notifications and Approvals Government approval for certain international data transfers is required under the Transfers Regulation. Transfers to countries or organisations on the com - petent authority’s approved list under Article 3 (1) do not need additional approval, but transfers to non- listed countries require appropriate safeguards, such as SCCs or BCR, which may need to be reviewed or approved. As of the time of writing, such a list of countries is yet to be published. For specific cases such as scientific research or pro - viding services to data subjects, the receiving entity must hold an approval certificate from a licensed body under Article 4 (2)(E), provided that the transferred data is not sensitive data. Additionally, controllers must conduct a risk assessment for sensitive data transfers per Article 7. While not all transfers require explicit approval, the Transfers Regulation ensures oversight through con - ditions such as exemptions from such approvals and the potential revocation of such exemptions if the instated safeguards are inadequate. Controllers must ensure compliance with the Transfers Regula - tion, which may involve notifying or seeking approval from the competent authority, particularly for sensitive data or transfers to non-approved jurisdictions. This framework prioritises data protection while allowing international transfers under strict safeguards.
391 CHAMBERS.COM
Powered by FlippingBook