Saudi Arabia's new Personal Data Protection Law in force

There are detailed rules relating to the transfer of personal data outside of KSA. The PDPL allows for the transfer of personal data outside of KSA for several purposes (for example, if such action is taken to meet an obligation to which the data subject is a party) and subject to various conditions (for example, the transfer or disclosure must not compromise the national security or vital interests of KSA and must be limited to the minimum amount of personal data needed).

Subject to such requirements and conditions, the Transfer Regulations have introduced a number of circumstances where a cross border transfer of personal data is permissible. This includes to countries with appropriate levels of protection and no less than the protections afforded under the PDPL, based on an assessment and recommendations to be made to the Prime Minister by the Saudi Data & Artificial Intelligence Authority (SDAIA), including for the issuance of an adequacy decision or an international agreement with the relevant country.

However, transfers of personal data to countries which are not deemed as having an adequate level of protection may still be made based on "appropriate safeguards," such as adopting Business Common Rules, Standard Contractual Clauses, Certifications of Compliance and/or Binding Codes of Conduct. If the data controller is unable to use any of the appropriate safeguards, there are still limited cases where cross border transfers are permissible, such as if the transfer is necessary for the performance of an agreement to which the data subject is a party or if the transfer is necessary to protect the vital interests of a data subject that is unreachable. Such transfers are still however subject to various controls.

The PDPL recognises the concept of "legitimate interest" as one of the legal bases for processing of personal data, although this does not extend to the processing of sensitive data.

The PDPL has introduced a potential requirement for data controllers to register with SDAIA. It is expected that SDAIA will issue rules regarding such registration and will specify which data controllers must register.

Data controllers are required to appoint a DPO in certain circumstances. This includes where the data controller is a public entity that provides services involving the processing of personal data on a large scale, where the primary activities of the data controller consist of processing operations that require regular and continuous monitoring of individuals on a large scale, and where the core activities of the data controller consist of processing sensitive data.

The PDPL imposes data breach notification requirements to both the regulator (i.e., SDAIA) and impacted data subjects, depending on the circumstances. Where a notification to SDAIA is required, the data controller must notify within 72 hours of becoming aware of the breach. Where a notification to impacted data subjects is required, this must be made without undue delay.

The PDPL imposes criminal penalties (imprisonment of up to 2 years and/or a fine of SAR3 million (∼USD800,000)) for disclosure or publication of sensitive personal data, if committed with the intention of causing damage to the data subject or achieving a personal benefit.

Separately, SDAIA has the power to issue administrative fines of up to SAR5 million for any other violation, which may be doubled for repeat violations, and is appealable. This would appear to apply to breaches around issues such as failing to obtain appropriate consent, failure to respect data subject rights, failure to provide adequate notice of processing and so on.