Establishing a thriving digital economy is one of the key priorities for the Kingdom of Saudi Arabia (“Kingdom”) as per the Saudi Vision 2030. Data is the foundation of the modern digital economy. Therefore, it is essential that the use of personal data (including data privacy) is regulated in the Kingdom.
The data protection regulatory framework in the Kingdom includes the following:
1. the PDPL;
2. the Implementing Regulations to the PDPL, including the Implementing Regulation to the PDPL and Regulation on Personal Data Transfer outside the Kingdom;
3. Regulations, standards, policies and other legal instruments in the data protection area issued by the Saudi Data and Al Authority (“SDAIA”);
4. International treaties in the data protection area to which the Kingdom may be a party.
The PDPL is the key law in the Kingdom in the area of personal data protection. If you use personal data, you must always comply with the PDPL. You could be exempted from an obligation to comply with the PDPL in limited cases in accordance with the legal instruments issued by the competent authorities in the Kingdom.
For more details on the competent authority in the area of personal data protection (“Competent Authority”), please see section “Who is the Competent Authority?” of this Guidance.