Saudi Arabia2021

Saudi Arabia Personal Data Protection Law

Saudi PDPL

Royal Decree No. M/19, issued 2021 and implemented September 2023. Saudi Arabia's national personal data protection law, administered by SDAIA. Notably requires that sensitive personal data of Saudi nationals must be stored within the Kingdom.

Ask GCC LexAI about Saudi PDPL →Saudi Arabia data protection →

Key Requirements

Obtain explicit consent before collecting or processing sensitive personal data (health, financial, biometric data)
Store personal data of Saudi nationals within the Kingdom of Saudi Arabia (data localisation for sensitive data)
Provide data subjects with the right to access, correct, and request deletion of their data
Implement a human review mechanism for automated decisions with significant legal effects
Notify SDAIA within 72 hours of a personal data breach that may cause harm
Conduct due diligence on third-party processors and ensure contractual data protection obligations

Applies to

All entities processing personal data of individuals in Saudi Arabia, whether the entity is inside or outside the Kingdom.

Issued by:SDAIA ← Saudi Arabia overview

Related Documents (3)

analysis

AI Law in Saudi Arabia — In-Depth Analysis (Latham & Watkins / Lexology)

This document analyzes the developing AI legal landscape in Saudi Arabia, focusing on the Saudi Data and Artificial Intelligence Authority's (SDAIA) role in promoting AI adoption and establishing a regulatory environment. It highlights key developments such as the draft amendments to intellectual property legislation and the issuance of the AI Ethics Principles.

AI ethicsIntellectual propertyData privacyAI regulation

guidance2023

Saudi Arabia Data Privacy Handbook 2023 (PwC)

This handbook, published by PwC, serves as a starter guide for organizations to comply with the Saudi Arabia Personal Data Protection Law (PDPL). It explains key concepts, principles, and steps for building effective data privacy programs in accordance with the PDPL, which came into force on September 14, 2023, with full enforceability starting September 14, 2024.

data privacydata protectionPDPL compliance

strategy2020

National Strategy for Data and AI 2020 (Saudi Arabia)

The National Strategy for Data & AI, developed by SDAIA, outlines Saudi Arabia's vision to become a leading data-driven economy. It aims to maximize data collection, processing, and integration to develop AI solutions and improve public services. The strategy focuses on national priorities by 2025, building competitive advantages by 2030, and becoming a leading economy utilizing and exporting Data & AI after 2030.

Data strategyAI strategyEconomic developmentDigital transformation

AI-generated summaries only. This is not legal advice. Arabic originals are legally binding where applicable. · ← Glossary