Personal data protection is no longer a technical matter for the IT department alone. With the Personal Data Protection Law in force in the Kingdom, every entity that collects or processes individuals' data, from customers' names and mobile numbers to employee files, is required to comply with clear rules, overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA).
Does the Law Apply to Your Company?
Most likely, yes. The Law applies to the processing of personal data relating to individuals in the Kingdom, whether collected through a website, an app, a paper form or a human resources system. Simply keeping a customer list or employee records is enough for the Law to concern you.
Core Principles
- Purpose limitation: collecting data for a clear and legitimate purpose, and not using it for another purpose incompatible with it.
- Data minimisation: collecting only what you need, not everything that can be collected.
- Transparency: informing data subjects what is collected, why, and who has access to it, through a clear privacy policy.
- Security: taking organisational and technical measures to protect data from unauthorised access.
- Retention: not keeping data longer than the purpose or the regulations require.
Data Subjects' Rights
The Law grants individuals rights that the company must be ready to respond to, including the right to be informed of how their data is processed, to access it, to request its correction, and to request its destruction in the cases specified by the Law. This requires a clear internal procedure for receiving and responding to requests.
A Five-Step Compliance Plan
- Data mapping: What data do you collect? From where? Where is it stored? Who has access to it?
- Identifying the legal basis: Do you rely on consent, the performance of a contract, or a legal obligation?
- Updating documents: the privacy policy, consent forms, and data protection clauses in contracts with suppliers and service providers.
- Security controls: access permissions, encryption, backups, and procedures for handling data breaches and notifying the competent authority as specified by the regulations.
- Training and review: raising employee awareness and reviewing compliance periodically.
Points That Need Special Attention
- Transferring data outside the Kingdom, including the use of foreign cloud services, which the Law and its regulations govern with specific controls.
- Sensitive data such as health and financial data, which is subject to stricter rules.
- Direct marketing by message and email, which requires attention to the data subject's consent.
Data protection compliance builds customer trust before it is a regulatory obligation. Our firm can carry out a gap assessment for your company and prepare the necessary policies and contracts in line with the Law and its implementing regulations.