Saudi ArabiaPersonal Data Protection Law, comprehensive regime and lawful basis
Royal Decree M/19 (9/2/1443H, ), comprehensive regime; Implementing Regulations Arts. 4, 11-12
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Saudi Arabia must establish a lawful basis under the Personal Data Protection Law, most commonly the Data Subject's consent, following the consent mechanics set out in the Implementing Regulations.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which authority is the "Competent Authority" for a Controller regulated by the Saudi Central Bank, given that Article 1(3) of the Personal Data Protection Law leaves the authority "to be determined by a resolution of the Council of Ministers"?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state, Event time
Logging duty
Law Article 31 requires a controller to maintain records of its personal data processing activities, available whenever the Competent Authority requests them, and Implementing Regulations Article 11(1)(d) requires consent to be documented through means that allow later verification, such as registers recording the time and means of consent. The Article 31 record names contact details, purposes, categories, recipients, transfers abroad and retention periods, which are not log-content values; the consent register supplies the consent state and its time. Article 31 leaves the record's retention period to the Regulations, and the five-year term sits in Implementing Regulations Article 33, which this row does not cite, so no retention is coded. Implementing Regulations Article 3(1)(d), which tells a controller to keep a record of every data subject request, is also uncited. Article 2(1)'s first prong turns on processing that takes place in the Kingdom, which has no hook value; its second prong reaches data of individuals residing in the Kingdom.
- Kind
- Explicit
- As of
- Provision
- Law Article 31; Implementing Regulations Article 11(1)(d)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The Personal Data Protection Law is Saudi Arabia's comprehensive personal-data statute, with the Implementing Regulations supplying the operative consent-mechanics detail (Arts. 4, 11-12).
Consent is the default lawful basis (Article 5), and Article 6 lists four cases in which processing needs no consent: processing that serves the actual interests of the Data Subject where communicating with them is impossible or difficult, processing under another law or in implementation of a previous agreement with the Data Subject, processing by a Public Entity for security purposes or to satisfy judicial requirements, and processing necessary for the legitimate interest of the Controller provided no Sensitive Data is processed.
A Controller/Processor structure is present. The Competent Authority is the authority to be determined by a resolution of the Council of Ministers (Article 1(3)), and the Law's supervision provision leaves in place the powers of the Saudi Central Bank under other legal provisions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .