Saudi ArabiaPersonal Data Protection Law, enforcement and penalties
Royal Decree No. M/19, Arts. 35-36, 40
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app operating in Saudi Arabia must not disclose or publish an individual's Sensitive Data, including identifying biometric data, in violation of the Law, since doing so with intent to harm the Data Subject or gain personal benefit is a criminal offense; other violations are subject to administrative fines up to SAR 5,000,000.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which persons does "every person with a special natural or legal capacity" in Article 36(1) of the Personal Data Protection Law reach, in particular a Processor or a foreign Controller?
What it makes you log
Logging duty
Article 35 punishes intentional disclosure or publication of Sensitive Data, and Article 36 sets a warning or a fine for any other violation, decided by a committee whose decision can be appealed to the competent court. Neither article requires a log or a record. The record duty (Law Article 31) and the Competent Authority's powers to request documents (Article 30(4)(a)) and to inspect (Article 37) sit in articles this row does not cite and are not borrowed.
- Kind
- None
- As of
What this law does
Art. 35 imposes criminal penalties, imprisonment up to two years or a fine up to SAR 3,000,000, or both, doubled on recidivism, on any individual who discloses or publishes Sensitive Data (including identifying biometric data) with intent to harm the Data Subject or gain personal benefit, prosecuted by the Public Prosecution before the competent court. Art. 36 sets administrative fines up to SAR 5,000,000, doubled on repeat violation, for other violations.
Article 40 separately lets any individual who suffers damage as a result of a violation of the Law or the Regulations apply to a competent court for proportionate compensation for the material or moral damage.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .