SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
5.3 Data Localisation Requirements The PDPL does not stipulate that data must be local - ised provided that the transfer and processing of per - sonal data outside KSA is performed in accordance with the PDPL and any other applicable law or regula - tion applicable to such personal data in KSA. In addi - tion, accessing data remotely would still constitute a transfer under the Standard Contractual Clauses For Personal Data Transfer. When transferring personal data outside KSA, there are special rules and regulations, however, that may apply in addition to, and exclusive of, the PDPL depending on the type of data (eg, health data) or sector (eg, financial), or if the localisation of data is in the national security, or public, interest of KSA. Under such circumstances, the transfer and/or processing of personal data may be restricted or prohibited alto - gether. From a PDPL perspective, per the Transfers Regula - tion, there are no distinct rules for transferring data relating to particular sectors; instead, the Transfers Regulation categorises certain types of data as sen - sitive, which are subject to stricter transfer require - ments. Otherwise, data transfers outside KSA may be permitted subject to certain circumstances. For example, Article 4 (2)(C) allows the transfer of sensitive data for central operations within multinational enti - ties, provided that the controller adheres to BCR or SCCs to ensure data protection. Similarly, Article 4 (2) (E) permits the transfer of sensitive data for scientific research and studies, but only if the data is limited to the minimum amount required and the receiving entity has an approval certificate from a body licensed by the competent authority. Additionally, Article 7 addresses the transfer of sensi - tive data on a continuous or widespread basis, requir - ing controllers to conduct a risk assessment before such transfers. This risk assessment must evaluate the purpose and legal basis of the transfer, the nature of the data, and the appropriate safeguards in place to ensure compliance with the Transfers Regula - tion. While the Transfers Regulation does not explic - itly differentiate between sectors, it imposes stricter requirements for sensitive data, which often includes sector-specific information such as health records or
financial data. By requiring SCCs, BCR or approval certificates, the Transfers Regulation ensures that all sensitive data, regardless of its sector, is transferred outside KSA only under conditions that guarantee an appropriate level of protection. The Transfers Regulation sets out the provisions in cases where controllers are exempted from the requirements to comply with the level of protection and the minimum level of transfer of personal data stipulated in subparagraphs (b) and (c) of paragraph (2) of Article (29) of the PDPL and provisions of the Transfers Regulation, namely that there is an adequate level of protection for personal data outside KSA and the transfer is limited to the minimum amount of per - sonal data needed. 5.4 Blocking Statutes KSA has no single “blocking statute”, but it has vari - ous relevant legal authorities on internet censorship which are primarily aimed at controlling online content to align with the country’s cultural, religious and legal norms. Key legislation on web censorship includes: • ACC Law: Article 6 of the ACC Law prohibits, and prescribes imprisonment and fines as penalties for, the publication, dissemination or promotion of content deemed offensive to public order, religious values or national security. This includes content relating to pornography, gambling, blasphemy, defamation and political dissent. • TCIT Law: Article 24 of the TCIT Law stipulates that, after co-ordination with the competent authorities, the CST must: (a) introduce internet filtering and limit access to specific content on the internet; and (b) prevent or restrict access to internet services by using internet gateways. It is prohibited to by-pass or swindle internet filtering or to provide the means to do so. In addition, the CST shall set the regulating controls and requirements. Foreign subpoenas and discovery orders are not self‑executing in KSA and ordinarily must proceed through letters rogatory or treaty channels. Applica - tions for the enforcement of foreign judgments and arbitration awards under the Execution Law must be
392 CHAMBERS.COM
Powered by FlippingBook