Navigating Data Privacy in Saudi Arabia: The PDPL Explained
The Personal Data Protection Law, under the Royal Decree M/19 promulgation dated September 17, 2021, forms the first-ever comprehensive law for personal data protection in Saudi Arabia. The law was published on September 24, 2021, in the Official Gazette. It took complete effect on September 14, 2023, after undergoing an approval of amendments in March 2023.
Objectives
The main object of the PDPL is the protection of individual privacy, and it works on controlling the flow of personal data and not abusing it. Some important principles of the Act are as follows:
- Purpose Limitation: Organizations must collect data only for specified and legitimate purposes.
- Data Minimization: The collection and retention of data should be minimal and necessary.
- Controller Obligations: Records for the processing should be maintained by the organizations, and they themselves need to register as controllers.
- Rights of Data Subjects: Individuals have rights with respect to their personal information, such as rights of access, rectification, and erasure.
Key Principles and Data Subjects Rights
The PDPL lays down basic principles that every business must comply with when processing personal data, including the following:
- Legal Basis/Purpose Limitation: There must be a precisely specified and legitimate reason for collection.
- Data Minimization: Organizations should collect only the data necessary for the specific purpose.
- Accuracy: Personal data shall be accurate and timely.
- Security Controls: There should be adequate security with regard to the personal data protection.
- Consent: Individuals must provide appropriate explicit consent for organizations to process their data, and they can withdraw this consent at any time.
Data Subjects' Rights
- Right to Know: Organizations should inform individuals about the purpose of data collection.
- Right to Access: Individuals can view their personal data and copies thereof.
- Right to Rectification: Individuals may have personal data rectified.Right to Erasure: Individuals can request the erasure of their data when it is no longer needed.
Regulatory Framework
The implementation of the PDPL rests with the Saudi Data & Artificial Intelligence Authority – SDAIA. The National Data Governance Interim Regulations complement it by establishing principles of accountability, transparency, and ethics in data use.
Comparison with GDPR
While both the PDPL and the General Data Protection Regulation have almost similar objectives with respect to personal data protection, they are very different. The GDPR applies to all the member states of the European Union, is rather broad in scope, and holds greater penalties for non-compliance. The PDPL concerns only Saudi Arabia and hence has a very important local context and consideration of culture. Also, it outlines some of the obligations that fall upon a controller, while the GDPR enacts a broader framework regarding activities related to data processing across industries.
