Data Protection in Saudi Arabia

Data Protection in Saudi Arabia

The firm covers Saudi matters in cooperation with an announced partner office in Saudi Arabia. That partner office is not a branch owned by the firm, and the firm does not itself hold a Saudi law practice license; local licensing and representation are assessed for each matter in the Kingdom. Personal data in Saudi Arabia is governed by the Personal Data Protection Law, issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, together with its Implementing Regulation. The Saudi Data and AI Authority (SDAIA) is the competent authority. We scope a client's position with our partner office: whether it acts as a controller or a processor, which processing falls under the law and what has to be documented, appointed or notified.

What controllers have to put in place

Before or when collecting data, the controller must tell the individual who is collecting it, why, and on what basis. Consent can be withdrawn at any time, and processing for a legitimate interest requires a documented assessment that the individual's rights are not outweighed. The Implementing Regulation also calls for records of processing activities, impact assessments in the cases it lists, and a data protection officer where SDAIA's rules require one.

Rights, marketing and sensitive sectors

Individuals have the right to be informed, to access their data, to correct it and to withdraw consent. The Regulation sets specific controls for health data, credit data, advertising and direct marketing, and for photographing or copying official identity documents. Financial institutions supervised by SAMA also follow SAMA's own circulars on the updated law, and cybersecurity reporting to the National Cybersecurity Authority runs separately.

Breaches and transfers outside the Kingdom

A controller that learns of a breach likely to harm the data or conflict with individuals' rights or interests must notify SDAIA within 72 hours, giving the information the Regulation lists, and must tell the affected individuals without undue delay where they may suffer damage. Transfers of personal data outside the Kingdom follow SDAIA's separate Regulation on Personal Data Transfer outside the Kingdom and its risk assessment guidance. To scope a Saudi compliance file, see General Commercial & Corporate or contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE, Qatar, Bahrain and Oman, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Which law and authority govern personal data in Saudi Arabia?

The Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443H, amended by Royal Decree No. M/148 dated 5/9/1444H) and its Implementing Regulation. The Saudi Data and AI Authority (SDAIA) is the competent authority.

How quickly must a personal data breach be reported in Saudi Arabia?

Where the breach potentially harms the data or conflicts with individuals' rights or interests, the controller must notify SDAIA within 72 hours of becoming aware of it, and tell the affected individuals without undue delay if they may suffer damage.

Who handles Saudi data protection matters at the firm?

Saudi matters are handled in cooperation with the firm's announced partner office in the Kingdom. The firm does not itself hold a Saudi law practice license, and local licensing and representation are assessed for each matter.

Other markets

Company Formation in Saudi ArabiaData Protection in EgyptData Protection in the UAEData Protection in QatarData Protection in OmanData Protection in Bahrain