Saudi ArabiaPersonal Data Protection Law, sensitive data categories and processing
Royal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a)
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the definition of Sensitive Data in Article 1(11) of the Personal Data Protection Law reach biometric data that a Controller processes without using it "for the purpose of identifying the person"?
What it makes you log
Logging duty
Law Article 1(11) defines Sensitive Data to include identifying biometric data, Implementing Regulations Article 11(2)(a) requires explicit consent for processing it, and Article 8 sets the destruction duty (on request, when the purpose is met, on withdrawal of consent, or when the processing was unlawful). None of the three cited provisions requires a log or record, or a check of one. Implementing Regulations Article 11(1)(d), which documents consent in a verifiable register, and Article 33, the record of processing activities, sit outside this row's citation and are not borrowed.
- Kind
- None
- As of
What this law does
Art. 1(11) defines Sensitive Data as Personal Data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual's parents are unknown; biometric data enters through the identification-purpose clause, with no standalone "Biometric Data" term and no worked-example list, unlike the UAE, Oman, and ADGM statutes.
Implementing Regulations Art. 11(2)(a) requires explicit consent whenever processing involves Sensitive Data, reaching identifying biometric data by the Art. 1(11) definition. No modality-specific (voice or face) language was found.
Implementing Regulations Art. 8 requires the Controller to destroy Personal Data on enumerated grounds (purpose fulfilled, consent withdrawn), notifying every party the data was disclosed to and destroying all system copies; this is the general destruction duty applying to biometric data as Sensitive Data, with no biometric-specific retention ceiling found.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .