Saudi ArabiaPersonal Data Protection Law, credit data controls
Royal Decree No. M/19, Art. 24; Implementing Regulations Art. 27
In force.
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes the credit data of an individual in Saudi Arabia must protect it from unauthorized use, misuse, access by unauthorized individuals, use for other purposes and disclosure, and must obtain the individual's consent and notify them of any request to disclose their credit data, in accordance with the Credit Information Law.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Law Article 24 and Implementing Regulations Article 27 require protective measures, consent to disclosure and notice of a disclosure request. Neither article states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Implementing Regulations Article 27 requires a Controller to take organizational, technical and administrative measures to protect Credit Data from unauthorized use, misuse, access by unauthorized individuals, use for purposes other than those it was collected for, and Disclosure.
Implementing Regulations Article 27(2) requires a Controller to obtain the Data Subject's consent, and to notify the Data Subject, of any request to disclose their Credit Data, in accordance with the provisions of the Credit Information Law. Law Article 24 lists, among the additional controls the Regulations are to set for Credit Data, requiring that the Data Subject be notified when a request for Disclosure of their Credit Data is received from any entity.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .