Saudi Arabia

Art. 20 requires the Controller to notify the Competent Authority upon knowing of any breach, damage, or illegal access to personal data, in accordance with the Implementing Regulations, and separately to notify the Data Subject of any breach that would cause damage to their data or prejudice their rights and interests.

No fixed notification window (hours or days) is stated in the Law itself; the specific timeline is deferred to the Implementing Regulations, whose exact notification-timeline article was not individually isolated.

The Personal Data Protection Law is Saudi Arabia's comprehensive personal-data statute, with the Implementing Regulations supplying the operative consent-mechanics detail (Arts. 4, 11-12). Consent is the default lawful basis; other grounds are set out in the Law's Art. 6 area, not individually enumerated. A Controller/Processor structure is present.

SDAIA is the Competent Authority for most sectors (Law Art. 1(3)), with the Saudi Central Bank (SAMA) designated as the Competent Authority for its own regulated financial sector, a sector-split enforcement structure.

Law Art. 29 permits a Controller to transfer personal data outside the Kingdom only for one of four enumerated purposes (international-agreement obligation, Kingdom interests, a Data Subject's own contractual obligation, or a Regulations-specified purpose), and only where the transfer does not prejudice national security or Kingdom vital interests, an adequate level of protection at least equivalent to the Law's own applies per a Competent Authority assessment, and the transfer is limited to the minimum data needed.

The standalone Regulation on Personal Data Transfer Outside the Kingdom operationalizes this with defined "Appropriate Safeguards" the competent authority may impose where an exemption from the adequacy requirement is granted, and an "Operational Processes" basis for data tied to a controller's own internal operations.

No provision compelling in-Kingdom data storage as a default rule was found; this is a multi-factor national-security-and-adequacy gate rather than either a blanket ban or an open transfer policy, more restrictive in structure than the UAE's or Jordan's equivalent provisions in this batch.

The original sdaia.gov.sa path for the Regulation 404s; it is now served from SDAIA's Digital Government Platform, and the "Appropriate Safeguards" and "Operational Processes" quotations above are confirmed against that working URL.

Art. 35 imposes criminal penalties, imprisonment up to two years or a fine up to SAR 3,000,000, or both, doubled on recidivism, on any individual who discloses or publishes Sensitive Data (including identifying biometric data) with intent to harm the Data Subject or gain personal benefit, prosecuted by the Public Prosecution before the competent court. Art. 36 sets administrative fines up to SAR 5,000,000, doubled on repeat violation, for other violations.

No civil private-right-of-action provision letting a Data Subject sue a Controller directly for damages was found in the sections read; this is treated as not established rather than a confirmed negative pending a full read of any general civil-liability article.

Art. 1(11) folds "biometric... Data for the purpose of identifying the person" directly into the Sensitive Data definition, with no standalone "Biometric Data" term and no worked-example list, unlike the UAE, Oman, and ADGM statutes. Implementing Regulations Art. 11(2)(a) requires explicit consent whenever processing involves Sensitive Data, reaching identifying biometric data by the Art. 1(11) definition. No modality-specific (voice or face) language was found.

Implementing Regulations Art. 8 requires the Controller to destroy Personal Data on enumerated grounds (purpose fulfilled, consent withdrawn), notifying every party the data was disclosed to and destroying all system copies; this is the general destruction duty applying to biometric data as Sensitive Data, with no biometric-specific retention ceiling found.

Article 15 lists eleven enumerated uses of a copyrighted work that are lawful without the copyright owner's permission. The first of them is personal use, excluding computer software and audio-visual works; others include quotation with attribution and educational use.

None of the eleven reaches reproduction for training an AI or machine-learning model, and no text-and-data-mining opt-out or opt-in mechanism was found elsewhere in the sections located, so training a model on scraped Saudi-copyrighted text rests on none of the Law's own exceptions.

Article 3(5) protects a database, whether mechanically readable or readable in any other manner, as a derived work only where it is creative as to the selection or arrangement of its contents, the same creativity-based standard the article applies to encyclopedias, anthologies, and folklore compilations.

No separate sui generis or producer's database right, of the kind the European Union's Database Directive creates, was found in the sections located; a non-creative, merely comprehensive database compiled by a scraper's target falls outside this protection.

The Personal Data Protection Law does not exempt publicly available personal data from its scope. Article 10 lists the Personal Data already being publicly available, or having been collected from a publicly available source, as one of several grounds on which a Controller may collect it from a source other than the Data Subject or repurpose it without the Data Subject's consent. Article 15 lists the same ground for disclosing Personal Data.

Personal data scraped from a publicly available Saudi source therefore does not need the Data Subject's consent on this specific ground, but it remains subject to the Law's other duties, including purpose limitation, accuracy, security, breach notification, and the Data Subject's rights. Article 43 provides that the Law comes into force 720 days after its Official Gazette publication date; no source located states that publication date, so this Law's specific commencement day is not confirmed.

Article 15(2) permits quoting passages from a copyrighted work, in its original language or in translation, in another work without the copyright owner's permission, and states this also applies to journalistic summaries abstracted from newspapers and periodicals, provided the quotation is consistent with established conventions and within the limits justified by its purpose, and that the source and the author's name are mentioned.

Related rights for performers, producers of audio recordings, and broadcasting organizations exist elsewhere in the Law (Arts. 9, 18-19), but none of the provisions located create a press-publisher neighbouring right or a compelled platform-to-publisher bargaining regime reaching a news aggregator. No text-and-data-mining opt-out mechanism and no reported case on hyperlinking, framing, or hot-news misappropriation was located.