Saudi ArabiaPersonal Data Protection Law, cross-border transfer
Royal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Saudi Arabia to a recipient outside the Kingdom must confirm the transfer does not prejudice national security or Kingdom interests, that the destination affords a level of protection at least equivalent to the Law, and that the transfer is limited to the minimum data needed, following the Transfer Regulation's Appropriate Safeguards or Operational Processes conditions where an adequacy finding is not in place.
These lines are LexLint's reading of the law's text. Also read by: Saudi Data and AI Authority (SDAIA), the Competent Authority under the Personal Data Protection Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
SDAIA states that its risk assessment guideline is for reference only and is not legally binding.
- As of
- Guidance link
- https://sdaia.gov.sa/en/SDAIA/about/Documents/RisksTransferringDataOutsideKingdomEn.pdf
- Guidance body
- Saudi Data and AI Authority (SDAIA), the Competent Authority under the Personal Data Protection Law
- Open questions
- Which countries and international organizations does the list that the Competent Authority must publish under Article 3(1) of the Regulation on Personal Data Transfer Outside the Kingdom name as providing an "appropriate level of protection"?
What it makes you log
Logging duty
Law Article 29 permits a transfer outside the Kingdom only for listed purposes, with an adequate level of protection and limited to the minimum data needed, and the Regulation on Personal Data Transfer Outside the Kingdom adds safeguards and, in its Article 7, a risk assessment before a transfer. A risk assessment with listed elements is an assessment, not a log or a record kept or produced, and neither provision tells the controller to record transfers or open a record to the Competent Authority. The record of processing activities (Law Article 31, which lists transfers abroad) is outside this row's citation.
- Kind
- None
- As of
What this law does
Law Art. 29 permits a Controller to transfer personal data outside the Kingdom only for one of four enumerated purposes (international-agreement obligation, Kingdom interests, a Data Subject's own contractual obligation, or a Regulations-specified purpose), and only where the transfer does not prejudice national security or Kingdom vital interests, an adequate level of protection at least equivalent to the Law's own applies per a Competent Authority assessment, and the transfer is limited to the minimum data needed.
The standalone Regulation on Personal Data Transfer Outside the Kingdom operationalizes this with defined "Appropriate Safeguards" the competent authority may impose where an exemption from the adequacy requirement is granted, and an "Operational Processes" basis for data tied to a controller's own internal operations.
No provision compelling in-Kingdom data storage as a default rule was found; this is a multi-factor national-security-and-adequacy gate rather than either a blanket ban or an open transfer policy, more restrictive in structure than the UAE's or Jordan's equivalent provisions in this batch.
The original sdaia.gov.sa path for the Regulation 404s; it is now served from SDAIA's Digital Government Platform, and the "Appropriate Safeguards" and "Operational Processes" quotations above are confirmed against that working URL.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .