Today, the Saudi Data and Artificial Intelligence Authority (“SDAIA”) has issued the Executive Regulations of the Personal Data Protection Law (“Executive Regulations” or “ER”) issued and published in the Official Gazette on 22/02/1445H (Corresponding September 7, 2023G). The PDPL and the Executive Regulations will come into force on 29/02/1445H (Corresponding to September 15,  2023G.)

Key highlights of the Executive Regulations include provisions addressing the exclusion of individuals processing personal data for personal or family use, guidelines to ensure the rights of personal data subjects, and more rigorous controls on data processing for public interest purposes. Additionally, the Executive Regulations emphasize the importance of data security, prompt notification of data breaches, and the appointment of dedicated Personal Data Protection Officers. The measures contained within the ER reflect the prevailing global trend of stringent data protection laws, compelling organizations to establish robust protection frameworks and promote increased transparency, thereby empowering individuals with greater authority over their personal data.  The Executive Regulations also align with Saudi’s Vision 2030, in aiming to increase transparency and regulate the utilization of data-driven services.

Stay tuned for further updates on the implementation and implications of these Executive Regulations, as they continue to shape the future of personal data protection within the Kingdom of Saudi Arabia.

Authors: Amr Hammad, Partner, Mario Fakhry, Associate, and Liana Rashid, Trainee Lawyer.

For further information, please contact Alex Saleh (alex.saleh@glaco.com) and Amr Hammad (amr.hammad@glaco.com).