Processes personal data, in Saudi Arabia

Implementing Regulations of the Personal Data Protection Law, Arts. 3(1)(d), 24(3), 33 · Read the law's page

• Keep a written record of your personal data processing activities until five years after each activity ends and give the Competent Authority access to it on request, keep a copy of each breach report you submit to the Competent Authority, and record every data subject request you receive.

Personal Data Protection Law (Royal Decree No. M/19), Arts. 4 and 9; Implementing Regulations Arts. 3(1)(a)-(c), 5-8 · Read the law's page

• An app that holds the personal data of an individual in Saudi Arabia must act on the individual's request to access, obtain a copy of, correct or destroy that data within 30 days (extendable by up to 30 more days, on advance notice with reasons), after verifying the requester's identity, and must destroy the data on the individual's request or once it is no longer necessary for the purpose it was collected for.

Royal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Saudi Arabia must establish a lawful basis under the Personal Data Protection Law, most commonly the Data Subject's consent, following the consent mechanics set out in the Implementing Regulations.

Royal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) · Read the law's page

• An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.

Royal Decree No. M/19, Art. 20; Implementing Regulations Art. 24(1) · Read the law's page

• An app that suffers a breach, damage, or illegal access affecting the personal data of an individual in Saudi Arabia must notify the Competent Authority within 72 hours of becoming aware of the incident where it potentially causes harm to the personal data, the Data Subject, or their rights or interests, and must notify the Data Subject without undue delay where the breach may cause damage to their data or conflict with their rights or interests, following the Implementing Regulations' procedure.

Royal Decree No. M/19, Art. 23; Implementing Regulations Art. 26 · Read the law's page

• An app that processes the health data of an individual in Saudi Arabia must protect it from unauthorized use, misuse, use for other purposes and breach, must limit the processing to the minimum necessary to provide healthcare services and products or health insurance programs, and must document every stage of the processing and who is in charge of each stage.

Royal Decree No. M/19, Art. 24; Implementing Regulations Art. 27 · Read the law's page

• An app that processes the credit data of an individual in Saudi Arabia must protect it from unauthorized use, misuse, access by unauthorized individuals, use for other purposes and disclosure, and must obtain the individual's consent and notify them of any request to disclose their credit data, in accordance with the Credit Information Law.

Royal Decree No. M/19, Art. 25; Implementing Regulations Arts. 28-29 · Read the law's page

• An app that sends advertising, awareness or direct marketing material to an individual in Saudi Arabia must give the individual a free mechanism to stop receiving it that is as simple and easy as the procedure for consenting, and must stop sending as soon as the individual asks or withdraws consent.

Royal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom · Read the law's page

• An app transferring the personal data of an individual in Saudi Arabia to a recipient outside the Kingdom must confirm the transfer does not prejudice national security or Kingdom interests, that the destination affords a level of protection at least equivalent to the Law, and that the transfer is limited to the minimum data needed, following the Transfer Regulation's Appropriate Safeguards or Operational Processes conditions where an adequacy finding is not in place.

Royal Decree No. M/19, Arts. 35-36, 40 · Read the law's page

• An app operating in Saudi Arabia must not disclose or publish an individual's Sensitive Data, including identifying biometric data, in violation of the Law, since doing so with intent to harm the Data Subject or gain personal benefit is a criminal offense; other violations are subject to administrative fines up to SAR 5,000,000.

Credit Information Law, Royal Decree No. M/37 of 5 Rajab 1429H (8 July 2008), arts. 6, 9, 11, 12 and 13 · Read the law's page

• If you operate a credit information company in Saudi Arabia, get a licence from SAMA first (Article 12(1)).
• Keep consumer credit information confidential and use it only for the purposes the Law and its Implementing Regulations provide (Article 6).
• Create a consumer's credit record for the first time only with the consumer's written consent, and correct an error in a record when the consumer submits supporting documents (Article 9(1) and (6)).