Saudi consultation proposes data protection reform

The Saudi Data and Artificial Intelligence Authority (SDAIA) has launched a new consultation on proposed data protection regulation reforms.

Saudi Arabia last updated its Personal Data Protection Law (PDPL) in 2023, which created new rules for businesses handling personal data in Saudi Arabia.

The SDAIA’s consultation, launched on 6 October, proposes a number of amendments to the implementing regulations to the PDPL (Implementing Regulation). The proposals aim to provide clarity for entities and individuals on the procedures and controls outlined in the Implementing Regulation, to help them comply with the PDPL.

The changes are also expected to support the PDPL’s enforcement procedures and strengthen the preservation of data subjects’ rights, better protect personal data and enhance overall confidence in services in Saudi Arabia that involve data processing.

Below we outline the most significant proposals.

Record of personal data processing activities

Article 33 on records of processing has also been streamlined, including removing the provision for regulator templates.

Any records of data processing will need to be retained by businesses for an additional five years from the date of the activities being completed. While the amendment may reduce administrative burdens by removing prescriptive record-keeping requirements, it also shifts greater responsibility onto controllers to determine what records are necessary to demonstrate compliance. This proposed amendment is in contrast to other data protection laws internationally, which prescribe detailed content requirements for records of processing activities.

Data subject access requests

The proposed amendments retain the statutory 30-day response period for a data subject request. However, if the request is not fulfilled within this period, it can be deemed rejected by the controller. Notwithstanding this, data subjects will be entitled to submit a complaint to SDAIA if the 30-day period expires without receiving a response.

Complaints to SDAIA

Article 37 in relation to filing and handling complaints is updated, removing the current 90-day time limit for data subject complaints.

Breach notification

In relation to personal data breach, amendments to article 24 indicate that businesses will still be required to report a personal data breach to the SDAIA within 72 hours.

More significantly, the proposed wording appears to remove the current notification threshold for notification to SDAIA. This could potentially broaden the range of incidents that trigger notification and result in a material increase in reportable incidents.

Data processing impact assessment

The proposals also make notable amendments to the circumstances under which a data processing impact assessment is required to be undertaken. These include processing of personal or sensitive data relating to minors or individuals lacking legal capacity, large-scale processing, regular or systematic monitoring, and processing linked to emerging technologies.

While the draft does not define “emerging technologies”, the term is likely to capture technologies such as artificial intelligence and other data-processing technologies.

Registration

Article 34 would also be amended, making registration with the National Register of Controllers mandatory for controllers which transfer or disclose personal data outside Saudi Arabia.

With the current amendments, registration would become mandatory where the controller is a public entity; engaged in core activities requiring personal data processing; processing sensitive data or data relating to persons lacking partial or full legal capacity; or transferring or disclosing personal data outside Saudi Arabia.

Responding to requests from SDAIA

A new provision, article 36, has been proposed, which would require companies to respond to a request from SDAIA within 20 business days from the date the request is received.

If the entity is unable to respond within this time it may request an extension, “providing sufficient justification”. The approval of an extension request is at SDAIA’s discretion.

Data Protection Officer

Article 32 has been updated, including removing the “Rules for the Appointment of a Personal Data Protection Officer” issued by SDAIA.

Organisational, administrative and technical measures

Article 23 has been amended to clarify the application of rules issued by the National Cybersecurity Authority. If these rules are not applicable to a controller, they would be required to comply with recognised cybersecurity standards and best practices.

In particular, a new amendment – article 23(2) – would be added to provide clarity on the specific requirements for personal data stored in the Kingdom. While this explains that personal data can be transferred in accordance with the PDPL and the Implementing Regulations, it poses questions as to what “storage” within the Kingdom means in practice, and whether copies are sufficient.

The proposed requirement that controllers "store Personal Data within the Kingdom" is one of the most consequential amendments in the consultation. While cross-border transfers and disclosures would remain permissible in accordance with the PDPL and its Implementing Regulations, the proposal separates the concepts of "storage" and "transfer". This raises practical questions regarding cloud hosting arrangements, backup copies and distributed databases, particularly where personal data is routinely replicated across multiple jurisdictions.

Marketing and advertising

There are several important, proposed changes to articles 28 and 29 related to marketing and advertising.

In relation to data processing for advertising or awareness purposes, an amendment to article 28 states that, where there is a prior relationship between the controller and the recipient, it should be verified that consent has been sought, in accordance with the PDPL and Implementing Regulation, before any personal data is processed for promotional or awareness purposes. Controllers would also be required to retain evidence of the consent obtained.

Controllers must also put in place a “simple and straightforward” process for data subjects to opt-out of receiving promotional or awareness materials. Where consent for marketing is withdrawn, controllers must cease processing and destroy the data generated through that marketing activity without undue delay.

Article 28 also removes reference to the “Telecommunication and Information Technology Law or any other related laws”. Instead, the conditions are set out under the Implementing Regulation.

Key dates

The consultation, which closes on 5 November, provides an ideal opportunity for relevant stakeholders to help shape the future trajectory of data protection regulation in Saudi Arabia.

As article 38 stipulates, the regulations will enter into force 60 days after they are published in the Official Gazette. Businesses should be aware of this short timeline and review their compliance framework to consider what changes would be required.

Co-written by Mosaad AlSudrany of Pinsent Masons.