Duty LXD-1384
Processes biometric data, in Saudi Arabia
Personal Data Protection Law, sensitive data categories and processingsince 1 line
Royal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) · Read the law's page
- An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.
Personal Data Protection Law, publicly available source groundsince 1 line
Royal Decree No. M/19, Arts. 10, 15 publicly available source ground (9/2/1443H, ) · Read the law's page
- Do not assume Saudi personal data is outside the Personal Data Protection Law merely because it is publicly available; public availability, or having been collected from a publicly available source, is only a ground for collecting, repurposing, or disclosing it without the Data Subject's consent, not an exemption from the Law's other duties.
Personal Data Protection Law, enforcement and penaltiessince 1 line
Royal Decree No. M/19, Arts. 35-36, 40 · Read the law's page
- An app operating in Saudi Arabia must not disclose or publish an individual's Sensitive Data, including identifying biometric data, in violation of the Law, since doing so with intent to harm the Data Subject or gain personal benefit is a criminal offense; other violations are subject to administrative fines up to SAR 5,000,000.