Although the PDPL does not explicitly list any data protection principles, such principles are embedded in the PDPL’s provisions.
Understanding these principles will help you to understand many of the requirements of the PDPL. There are seven key data protection principles that form the foundation of the PDPL. The principles are as follows:
| No. | Principle | Description of the principle |
|---|---|---|
| 1 | Lawfulness, fairness and transparency | 1. You must ensure that you collect personal data based on a lawful basis. 2. You must, at all times, process personal data in compliance with the laws and regulations of the Kingdom. 3. Individuals must be provided with an understanding of how their personal data is processed by you. |
| 2 | Purpose limitation | 1. You need to have a specified purpose (reason) as to why you are processing the personal data. 2. You must determine the purpose of collection of personal data, which must be documented in the records of processing activities. |
| 3 | Data minimization | You must not collect more personal data than you need to achieve the purpose of processing of personal data. If you do not strictly need the personal data, you must not collect it. |
| 4 | Storage limitation | You must only process personal data for as long as you need it, unless you are obligated to store it for longer under the applicable laws (for example, specific laws of the sector in which you operate in). |
| 5 | Accuracy | 1. You must regularly review personal data that you hold to ensure that it is accurate, complete and up to date. 2. You must provide an opportunity to individuals to review their personal data and update it, where necessary. |
| 6 | Integrity and confidentiality | You need to have adequate technical and organizational measures to safeguard personal data. Such controls are required to protect the confidentiality, integrity and availability of the personal data during its transmission and storage. |
| 7 | Accountability | You must have appropriate measures and records in place to be able to demonstrate your compliance with data protection laws, regulations and principles. |
Please note that compliance with the above principles does not relieve you from the obligation to fully comply with all other requirements of the PDPL. However, it will serve as the foundation for effective compliance with the PDPL.