Article 23 of the Saudi Communications and Information Technology Law

This article protects subscribers' personal information and documents held by service providers, and sets four obligations:

1. Protection: The service provider takes all necessary measures to protect the confidentiality of the user's personal information and documents and to prevent unlawful access to them, viewing of them or dealing with them, including preparing policies to protect them and submitting them to the Authority for approval, in accordance with the relevant legal provisions.
2. No disclosure: The user's information or documents may not be disclosed except with the user's consent and in accordance with the relevant legal provisions.
3. Notice of a breach: If the information or documents are breached in any way, the service provider must take the necessary measures to protect them and notify the Authority and the user immediately of the details of the incident, subject to the relevant legal provisions.
4. Retention: The service provider keeps the information and documents for the period the Authority determines, counted from the date of the last provision of the service. If a dispute over the service exists between the user and the service provider, they must be kept until the dispute ends.

The repeated reference to "the relevant legal provisions" means this article operates alongside other laws that may apply to data, which the article does not name. The article also does not set the retention period itself. A person whose data has been leaked or disclosed without consent should consult a lawyer specializing in cybercrime or in communications and information technology law.