The Saudi Data and Artificial Intelligence Authority (“SDAIA”) has announced the release of its Data Sovereignty Public Policy Paper (the “Policy”), which outlines, inter alia, the regulator’s sentiments on data sovereignty principles. The Policy was published for public consultation on 10 March 2024 and will be closed for comments on 9 April 2024.

Data sovereignty refers to the idea that a country (or jurisdiction) has the authority and right to govern and control the data generated within its borders. This means that the government has the power to regulate the collection, storage, processing, and distribution of data that originates within its territory.

The Policy’s target is to provide practical guidance for private, public, and non-profit organizations, while laying out to the public at large Saudi Arabia’s public policy positions on data sovereignty so that further input can be solicited, and considered, when finalizing the Policy.

This marks yet another significant milestone in connection with Saudi Arabia’s efforts towards producing a robust and transparent data regulatory environment intended to balance the rights, roles, and responsibilities of relevant stakeholder interests, ranging from business, government, individuals, and the international community at large.

The Policy sets out four fundamental principles for preserving national data sovereignty. These four principles revolve around (i) data as a national asset, (ii) data protection, (iii) data availability, and (iv) encouragement of local and foreign investment.

The release of the Policy represents another step forward toward enhancing data governance and cybersecurity in Saudi Arabia and reinforces SDAIA’s efforts to collaboratively lead in producing “best practice” policies in connection with Saudi Arabia’s digital transformation.

Authors: Feras Gadamsi, Partner, Head of Data & Technology and Rana Moustafa, Associate.

For more information please contact Alex Saleh (alex.saleh@glaco.com) or Feras Gadamsi (feras.gadamsi@glaco.com).