The definition of residing in the Kingdom is not limited by an individual’s citizenship, his/her residence status or any other type of legal status. The PDPL applies to processing of personal data of all individuals who reside in the Kingdom, no matter their nationality or duration of residence. Such individuals include, for example:
1. citizens of the Kingdom;
2. residents of the Kingdom, including temporary and permanent workers;
3. temporary visitors of the Kingdom, including tourists and visitors (for any reasons); and
4. any other individuals who reside in the Kingdom for any reason and for any timeline, irrespective of the legal basis of the stay.
Please note that even if the individual leaves the territory of the Kingdom, his/her personal data will still be within the scope of the PDPL if such personal data is still stored in the Kingdom.
Example | Territorial scope | Residing and staying in the Kingdom as employees
A trade company operates in the Kingdom. The majority of its employees work in the Riyadh office on a permanent basis. The processing of their personal data is regulated by the PDPL.
Some of its employees are based in its Dubai office and visit the Riyadh office once a month.
When the employees from the Dubai office stay in Riyadh, the processing of their personal data is in the scope of the PDPL.
Example | Territorial scope | Visiting the Kingdom as tourists
A family from Japan visits the Kingdom as tourists. They stay in one of the hotels in Riyadh. The hotel records their personal data, including names, phone numbers, bank card numbers, and emails. After the family returns to Japan, the hotel stores their personal data for several months.
While the personal data of the Japanese family members is stored by the hotel in Riyadh, such personal data will be protected by the PDPL – even if the family no longer stays in the Kingdom.