Any entity, including public or private entities and natural or legal persons that process personal data of individuals (who reside in the Kingdom), if processing takes place outside the jurisdiction of the Kingdom is still considered as a party of the processing. Such an entity is in scope of the PDPL and will need to comply with its obligations in respect of such processing.
Example | Territorial scope | Parties outside the Kingdom
A consulting firm based in Germany provides services to its clients based in Jeddah region. Such services include the processing of personal data of employees of the clients – for business improvement purposes.
Such processing of personal data is in the scope of the PDPL. The consulting firm is required to comply with the PDPL, even though it is not based in the Kingdom.
Example | Territorial scope | Parties outside the Kingdom
An online store operates in the Kingdom. Its customers are individuals who live and work in the Kingdom. The online store uses cloud solutions to store the personal data of its customers. The cloud solution is hosted in the USA by the US technology company.
Such storage of personal data will be regulated by the PDPL – even though the personal data is hosted in the USA.
In scenarios 1 and 2, all individuals, no matter their citizenship or residency status, are protected by the PDPL.