Saudi Personal Data Protection Law 

Saudi Personal Data Protection Law 

With the technical development taking place in the Kingdom of Saudi Arabia and the speed of completing transactions electronically with ease and comfort, it has become necessary to provide protection for users’ private data and manage it in a way that gives them confidence and security to complete their work. In addition, personal data protection helps attract foreign investors to the Kingdom and enable them to conduct their business with peace of mind and security. 

What is personal data? 

It is the data through which a specific person can be specifically identified, as this data includes: 

• Basic personal data: the person’s name, national ID number, and also includes personal photos. 
• Contact information: phone number, email, personal address. 
• Financial data: such as bank account number and credit accounts.  
• Health data: This is everything related to a person’s physical, psychological and mental condition. 

Why is personal data collected? 

The purpose of collecting personal data varies depending on the entity collecting this data, and the purpose of collecting it may be: 

• Measuring beneficiary satisfaction with services provided, such as opinion polls.  
• Developing and improving the beneficiary experience and ensuring continuity of high-quality service provision. 
• Follow up on inquiries and complaints received by users to address them. 
• Preparing specialized studies in health fields (such as the percentage of male diabetics in the Kingdom in 2024) or in the field of education (such as the percentage of female students registered in the Noor system at the primary level this year) and others. 

Who is responsible for collecting personal data? 

Who is responsible for collecting personal data?

Personal data is collected by the controller, which is a public entity (such as the Ministry of Education) or a private entity (such as companies) that wishes to process this data for private and specific purposes, whether the processing is through it or by another entity. 

How is personal data collected? 

The controller collects personal data using the following methods: 

• Directly: through user data for which registration is made on the website or communication is made by phone. 
• Indirectly: through cookies (cookies) when you visit the website. 

What are the rights of personal data subjects? 

The Personal Data Protection Law stipulates the rights that personal data subjects enjoy when using their data, which are: 

• His right to know the purpose for which his personal data was collected.
• The right to access his personal data held by the controller. 
• The right to request access to his personal data available to the controller.  
• The right to request correction or updating of his personal data from the control authority. 
• The right to request the destruction of his personal data with the control authority when there is no need for it. 

What are the conditions and controls when collecting personal data? 

The controller is required to: 

• Obtaining the express consent of the personal data subject to collect this data.
• Determine the purpose of collecting personal data. The purpose may not be modified except with the consent of the personal data subject. 

What are the cases excluded from the consent of personal data subjects?

The Personal Data Protection System stipulates the cases in which the controlling authority may collect data, which are: 

• Consent of the personal data subject. 
• If this data is available to everyone. 
• If the controller is a public entity and the processing is required for the public interest, for a security purpose, or to implement judicial requirements.
• If there is harm to the data subject and affects his or her vital interests.
• If the purpose of collecting personal data is necessary to protect public health or safety or to protect the lives of a group of people.  
• If this data will not be recorded or stored and the identity of the persons will not be revealed directly or indirectly.
• If the purpose of collecting and processing personal data is to achieve the legitimate interests of the controller without prejudice to the rights and interests of the owner of this data.

In what cases is it not permissible to disclose personal data? 

The controller shall not disclose the personal data it has collected and processed, whether through the data subjects themselves, a public source, or others, in the following cases: 

• If the disclosure poses a security risk, threatens the Kingdom’s reputation or interests, or affects the Kingdom’s relationship with other countries. 
• If the disclosure prevents the disclosure of a crime or affects the accused’s rights to a fair trial. 
• If it puts the safety of individuals at risk. 
• If there is a violation of the privacy of an individual other than the owner of the personal data. 
• If it conflicts with the interest of an incomplete or incompetent person.
• If disclosure would result in a breach of professional obligations. 
• If the disclosure would result in a breach of a judicial procedure or ruling. 
• If a confidential source discloses information that is not available for disclosure in the public interest. 

When should personal data be destroyed? 

The controller must destroy this data if the purpose for which it was collected has been completed, but the system allows the controller to continue retaining this data in the following cases:

• If everything that leads to knowing the identity of the personal data subject specifically has been removed.   
• There is a statutory justification for retaining this data for a specific period, and this data must be destroyed after the expiration of this period. 
• If this data is related to a case pending before a judicial authority, the controlling authority must destroy this data once the case procedures are completed. 

What are the penalties imposed on violators of the personal data law? 

The Personal Data Protection Law stipulates the cases punishable by the law: 

• Penalty for publishing personal information: Anyone who discloses or publishes sensitive data with the intent to harm the owner of such data or achieve a personal interest shall be punished by imprisonment for a period not exceeding two years and a fine not exceeding 3 million Saudi riyals, or one of the two penalties. The penalty shall be doubled in the event of a repeat offense. 
• Penalty for violating the provisions of the law: Any person with a natural or legal status who violates the provisions of the system and its executive regulations shall be punished by a warning or a fine not exceeding 5 million riyals, and the penalty shall be doubled in the event of a repeat violation. 

Tasks of the National Cybersecurity Authority 

The National Cybersecurity Authority’s mission is to protect personal data as a security body responsible for cybersecurity in the Kingdom and the approved reference for all parties in this regard. The Authority is responsible for protecting networks, information technology systems, and the data they contain from the risk of hacking, sabotage, or illegal exploitation.  

Saudi Personal Data Protection Law 

Criminal lawyer from the office of lawyer Abdul Majeed Al Rashid

A criminal lawyer from the office of Attorney Abdulmajeed Al Rashid is responsible for handling cases related to personal data, such as extortion, impersonation, and others. Hiring a specialized criminal lawyer is extremely important to protect your personal data and assist you in filing a report with the police or the Public Prosecution and writing legal memoranda and objections in this regard.