Saudi ArabiaPersonal Data Protection Law, breach notification
Royal Decree No. M/19, Art. 20; Implementing Regulations Art. 24(1)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a breach, damage, or illegal access affecting the personal data of an individual in Saudi Arabia must notify the Competent Authority within 72 hours of becoming aware of the incident where it potentially causes harm to the personal data, the Data Subject, or their rights or interests, and must notify the Data Subject without undue delay where the breach may cause damage to their data or conflict with their rights or interests, following the Implementing Regulations' procedure.
These lines are LexLint's reading of the law's text. Also read by: Saudi Data and AI Authority (SDAIA), the Competent Authority under the Personal Data Protection Law (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://sdaia.gov.sa/en/SDAIA/about/Documents/PersonalDataBreachIncidents.pdf
- Guidance body
- Saudi Data and AI Authority (SDAIA), the Competent Authority under the Personal Data Protection Law
What it makes you log
Logging duty
Article 20 requires the controller to notify the Competent Authority, and the data subject where the breach would cause damage or prejudice, of a breach, damage or illegal access, in accordance with the Regulations. It is a duty to notify and states no record to keep. Implementing Regulations Article 24(3), which tells the controller to keep a copy of the reports it filed and document the corrective measures, is a record duty that this row does not cite and is not borrowed.
- Kind
- None
- As of
What this law does
Art. 20 requires the Controller to notify the Competent Authority upon knowing of any breach, damage, or illegal access to personal data, in accordance with the Implementing Regulations, and separately to notify the Data Subject of any breach that would cause damage to their data or prejudice their rights and interests.
The Law itself states no fixed notification window; Implementing Regulations Article 24(1) sets it at a delay not exceeding 72 hours of becoming aware of the incident, where the incident potentially causes harm to the Personal Data, to the Data Subject, or to their rights or interests.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .