Saudi ArabiaPersonal Data Protection Law, data subject rights
In force.
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that holds the personal data of an individual in Saudi Arabia must act on the individual's request to access, obtain a copy of, correct or destroy that data within 30 days (extendable by up to 30 more days, on advance notice with reasons), after verifying the requester's identity, and must destroy the data on the individual's request or once it is no longer necessary for the purpose it was collected for.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What it makes you log
Logging duty
Implementing Regulations Articles 3 and 5 to 8 set response times, identity checks and the destruction duty and require the Controller to answer and act. Article 3(1)(d), which tells the Controller to keep a record of all requests received, is a record duty that this row does not cite and is not borrowed; the record of processing and request records are carried by the existing Implementing Regulations row.
- Kind
- None
- As of
What this law does
Article 4 of the Law gives a Data Subject five rights against the Controller: to be informed of the legal basis and purpose of collection, to access their Personal Data, to request a copy in a readable and clear format, to request correction, completion or update, and to request destruction when the data is no longer needed.
The Implementing Regulations require the Controller to act on a request within 30 days and allow an extension of up to 30 more days where the request needs disproportionate effort or the Data Subject has made multiple requests, if the Data Subject is told the reasons in advance (Art. 3(1)(a)).
The Controller must also verify the requester's identity before acting (Art. 3(1)(c)), and may refuse a request that is repetitive, manifestly unfounded or needs disproportionate effort, giving the Data Subject its reason (Art. 3(2)). Article 8(1) requires destruction of Personal Data on the Data Subject's request, when it is no longer necessary for the purpose of collection, when consent is withdrawn and was the sole basis, or when the data was unlawfully processed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .