Saudi ArabiaImplementing Regulations, record of processing activities, breach report copies and request records
Implementing Regulations of the Personal Data Protection Law, Arts. 3(1)(d), 24(3), 33
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Keep a written record of your personal data processing activities until five years after each activity ends and give the Competent Authority access to it on request, keep a copy of each breach report you submit to the Competent Authority, and record every data subject request you receive.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Log retention
Five years run from the end of the processing activity the record describes and the record is kept for the whole period of processing before that; the Regulations set no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Article 33 requires a written record of processing activities, kept for as long as the data is processed and for five years after the activity ends, with access for the Competent Authority on request; Article 24(3) requires the controller to keep a copy of each breach report and to document the corrective measures taken; Article 3(1)(d) requires a record of data subject requests. The Article 33 record lists contact details, purposes, categories, retention periods, recipients, transfers and security measures, which are not log-content values, so none is coded. The five years run from the end of each processing activity, so they are a floor on the retention of the record. Article 2(1) of the Regulations, which sets their reach, is not cited here, so the hook is empty. Law Article 31, the parent duty to keep records, and Implementing Regulations Article 11(1)(d), which documents consent, are coded on the comprehensive regime row.
- Kind
- Explicit
- As of
- Provision
- Implementing Regulations, Arts. 33, 24(3) and 3(1)(d)
- Trigger
- personal_data_processing
- security_incident
What this law does
Article 33 requires the controller to keep a record of personal data processing activities during all the period the data is processed and until five years after the end of any processing activity, in writing and accurate and up to date, and to give the Competent Authority access to it on request.
The record includes, at a minimum, the controller's name and contact details, the data protection officer where required, the purposes of the processing, the categories of data and of data subjects, retention periods where possible, the categories of recipients, a description of transfers outside the Kingdom and the security measures where possible.
Article 24(3) requires the controller to keep a copy of the reports it submits to the Competent Authority about a personal data breach and to document the corrective measures taken and any relevant documents or supporting evidence. Article 3(1)(d) requires the controller to take the necessary measures to document and keep a record of all data subject requests it receives, including oral requests.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.