The PDPL applies to processing of personal data on all territory on which the Kingdom has its authority, including the geographical territory of the Kingdom and its embassies in foreign jurisdictions.
Any entity, including public or private entities and natural or legal persons that process personal data inside the jurisdiction of the Kingdom is in the scope of the PDPL.
Example | Territorial scope | Processing in the Kingdom | Private entity
A hospital that is incorporated in the Kingdom processes the personal data of its employees and patients.
All of the processing takes place in the Kingdom. It includes processing of personal data of patients who come to this hospital for treatment from other countries. Therefore, the hospital must comply with the PDPL.
Example | Territorial scope | Processing in the Kingdom | Public entity
The Kingdom’s Ministry of Education processes the personal data of its employees, the schoolgoing children and teachers of the Kingdom.
All of the processing of the Ministry undertaken in the Kingdom is in scope for the PDPL.