Insights into KSA's Personal Data Protection Law

The Personal Data Protection on Law of the Kingdom of Saudi Arabia was implemented by Royal Decree M/19 of 16 September 2021, approving Resolution on No.98 dated 14 September 2021 ('PDP Law') and published in the official Gazette on 24 September 2021. The Saudi Authority for Data and Artificial Intelligence (SDAIA) stated on 22 March 2022 announcing the decision to postpone full enforcement of the PDP Law till 17 March 2023. The PDP Law will be supported by Executive Orders, which provide detailed guidelines and standards for companies to achieve compliance with the Law.

The below article is based on the PDP Law published in 24th September 2021 and considers the draft executive regulations published in March 2022. On 20 November 2022, the Saudi Data and Artificial Intelligence Authority (SDAIA) launched a public consultation on proposed amendments to the Personal Data Protection Law. Furthermore, various provisions under the proposed amendments are subject to executive regulations which are yet to be published. Once the amendments are finalized a subsequent point of view shall be published to cover the same.

Download Report