PDPL regulates processing of personal data in all forms.
Personal data in non-electronic form (such as personal data in a physical document) also falls within the scope of the PDPL. In practice, given the level of technological advancement in the Kingdom, the majority of processing will relate to personal data in electronic form.
Example | Personal data | Personal data in electronic form
HR department stores personal data about employees of the organization in several cloud storage systems. Such personal data exists in electronic form. Its use is regulated by the PDPL.
Example | Personal data | Personal data in non-electronic form
A university stores exam papers of its students. The exam papers contain personal data of students (for example, full names and ID numbers). Such personal data exists in non-electronic form. Its use is regulated by the PDPL.
The PDPL applies to the processing of personal data irrespective of the volume or type of personal data being processed. This means that small and medium-sized businesses are also subject to compliance with the PDPL.
In addition, the PDPL does not differentiate between other forms of personal data such as structured data (e.g. the data stored in databases) or unstructured data (e.g. personal data in different documents). As long as the data can identify a specific individual, it is considered as personal data and its use is regulated by the PDPL.