Saudi ArabiaPersonal Data Protection Law, publicly available source ground
Royal Decree No. M/19, Arts. 10, 15 publicly available source ground (9/2/1443H, )
In force since .
A personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Do not assume Saudi personal data is outside the Personal Data Protection Law merely because it is publicly available; public availability, or having been collected from a publicly available source, is only a ground for collecting, repurposing, or disclosing it without the Data Subject's consent, not an exemption from the Law's other duties.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 10 and 15, the two articles this row covers, set the grounds for collecting, repurposing and disclosing personal data and impose no duty to create or keep a log or record. The Law carries a record duty elsewhere: Article 31 requires a Controller to maintain records of its processing activities, for a period the Regulations set, containing at least the Controller's contact details, the purpose, the categories of data subjects, recipients, any transfer outside the Kingdom and the expected retention period, and to make them available whenever the Competent Authority requests. That article is outside this row and sits outside the cited articles.
- Kind
- None
- As of
What this law does
The Personal Data Protection Law does not exempt publicly available personal data from its scope. Article 10 lists the Personal Data already being publicly available, or having been collected from a publicly available source, as one of several grounds on which a Controller may collect it from a source other than the Data Subject or repurpose it without the Data Subject's consent. Article 15 lists the same ground for disclosing Personal Data.
Personal data scraped from a publicly available Saudi source therefore does not need the Data Subject's consent on this specific ground, but it remains subject to the Law's other duties, including purpose limitation, accuracy, security, breach notification, and the Data Subject's rights. Article 43 provides that the Law comes into force 720 days after its Official Gazette publication date.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .