Saudi ArabiaPersonal Data Protection Law, health data controls
Royal Decree No. M/19, Art. 23; Implementing Regulations Art. 26
In force.
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes the health data of an individual in Saudi Arabia must protect it from unauthorized use, misuse, use for other purposes and breach, must limit the processing to the minimum necessary to provide healthcare services and products or health insurance programs, and must document every stage of the processing and who is in charge of each stage.
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Actor identity
Logging duty
Article 26(4) requires the Controller to document all stages of Health Data Processing and to provide the means to identify the person in charge of each stage. It names no log format, no retention period and no recipient of the documentation. Article 33, the record of processing activities, is not cited by this row.
- Kind
- Implicit
- As of
- Provision
- Implementing Regulations Article 26(4)
- Trigger
- personal_data_processing
What this law does
Implementing Regulations Article 26 requires a Controller to take appropriate organizational, technical and administrative measures to protect Health Data from unauthorized use, misuse, use for purposes other than those it was collected for, or breach. Implementing Regulations Article 26(6) limits Health Data Processing to the minimum necessary to provide healthcare services and products or health insurance programs.
Implementing Regulations Article 26(4) requires a Controller to document all stages of Health Data Processing and to provide the means to identify the person in charge for each stage. Law Article 23 lists, among the additional controls the Regulations are to set for Health Data, restricting access to Health Data, including medical files, to the minimum number of employees or workers and only to the extent necessary to provide the required Health Services.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .