In force Last amended 5/9/1444 AH
Saudi Personal Data Protection Law
نظام حماية البيانات الشخصية
The Personal Data Protection Law of Saudi Arabia. This page presents the official Arabic text of each article with plain-English explanations for residents and businesses.
- Articles
- 43
- In force
- 42
- Amended
- 24
- Issued
- 9/2/1443 AH
Issued by: مرسوم ملكي رقم (م/19) وتاريخ 1443/2/9هـ · قرار مجلس الوزراء رقم (98) وتاريخ 1443/2/7هـ
Each article shows the official Arabic text, which is the only legally binding version, followed by our plain-English explanation.
Browse Personal Data Protection Law by topic
Scope of the Law and Definitions4 articlesData Subject Rights9 articlesConsent to Processing Data8 articlesController's Obligations17 articlesHealth Data and Marketing4 articlesTransferring Data Outside the Kingdom1 articleCompetent Authority and Supervision of Application8 articlesData Protection Violations and Penalties6 articles
Articles of the Saudi Personal Data Protection Law
- Article 1The article defines the key terms of the Personal Data Protection Law, such as personal data, sensitive data, processing, disclosure, controller and processor.Amended M/148
- Article 2The law applies to all processing of individuals' data in the Kingdom, and to processing by entities abroad of data of individuals residing in it; personal or family use is excluded unless the data is published or disclosed.
- Article 3The law's provisions and procedures do not prejudice any provision in another law or an international agreement to which the Kingdom is a party that gives the data subject a right or provides better protection for their data.
- Article 4The article gives the data subject five rights: to be informed, to access, to obtain a readable copy, to request correction, completion or updating, and to request destruction.Amended M/148
- Article 5Personal data may not be processed, nor the purpose of processing changed, except with the data subject's consent, apart from cases the law provides, and the data subject may withdraw consent at any time.Amended M/148
- Article 6The article sets out four cases in which personal data may be processed without the consent of its owner referred to in paragraph 1 of Article 5.Amended M/148
- Article 7Consent to processing personal data may not be made a condition for providing a service or benefit, unless the service or benefit is related to the processing that was consented to.
- Article 8The article requires the controller to choose a processor that provides the guarantees needed to implement the law and regulations and to verify its compliance, without prejudice to the controller's responsibilities.Amended M/148
- Article 9The article lets the controller set periods for exercising the right of access and restrict it in certain cases, and requires it not to allow the data subject access in the cases specified in Article 16.Amended M/148
- Article 10The rule is that personal data is collected from its owner directly and processed for the purpose it was collected for, with seven cases in which it may be collected from others or processed for another purpose.Amended M/148
- Article 11The article requires that the purpose of collecting data be linked to the controller's purposes, that the means be lawful, clear and secure, and that the content be limited to the minimum necessary.Amended M/148
- Article 12The article requires the controller to adopt a privacy policy made available to data subjects when their data is collected, and sets the elements it must include.Amended M/148
- Article 13When collecting data directly from its owner, the controller must inform them of seven elements, including the legal basis, the purpose, the identity of the collector and the entities to which the data will be disclosed.Amended M/148
- Article 14The controller may not process personal data without adequate steps to verify its accuracy, completeness, currency and relation to the purpose for which it was collected.
- Article 15The article bars the controller from disclosing personal data except in six specified cases, and refers the provisions for cases 2 to 6 to the regulations.Amended M/148
- Article 16The article bars the controller from disclosing data in cases 1, 2, 5 and 6 of Article 15 whenever the disclosure has any of nine specified characteristics.Amended M/148
- Article 17If personal data is corrected, completed or updated, the controller must notify every entity to which the data was transferred of the change and make it available to it; the regulations set the periods and procedures.
- Article 18The article requires the controller to destroy data without delay once its collection purpose ends, permits keeping it after removing what identifies its owner, and requires keeping it in two cases.Amended M/148
- Article 19The article requires the controller to take the organizational, administrative and technical measures and means that ensure personal data is protected, including when it is transferred, in accordance with the regulations.
- Article 20The article requires the controller to notify the competent authority when it learns of a leak, damage or unlawful access to data, and to notify the data subject if that may harm them.Amended M/148
- Article 21The article requires the controller to respond to the data subject's requests concerning their rights under the law within a specified period and by an appropriate means, which the regulations set.
- Article 22The article requires the controller to assess the effects of processing personal data for any product or service offered to the public, according to the nature of its activity, and refers the details to the regulations.
- Article 23The article refers to the regulations the setting of additional controls for processing health data, which must limit access to and processing of it to the fewest possible employees.
- Article 24The article refers to the regulations the setting of additional controls for processing credit data, including verifying explicit consent and notifying the data subject when disclosure of it is requested.Amended M/148
- Article 25A controller may not use a person's personal contact channels to send promotional or awareness materials without the recipient's consent and a clear way to stop them, except awareness materials from public bodies.
- Article 26Non-sensitive personal data may be processed for marketing purposes if it was collected directly from the data subject and they consented under the Law; the regulations set the controls.
- Article 27The article allows personal data to be collected or processed for scientific, research or statistical purposes without the data subject's consent in three cases, and refers the controls to the regulations.
- Article 28The article prohibits photographing or copying official documents that identify the data subject, except to implement a law or at the request of a competent public body under the regulations.
- Article 29The article allows personal data to be transferred outside the Kingdom or disclosed to a party outside it for specified purposes and on conditions, with extreme necessity cases exempt from the conditions.Amended M/148
- Article 30The article makes the competent authority the supervisor of the Law and the regulations without prejudice to the Central Bank's powers, and regulates the data protection officer and the supervisory and delegation powers.Amended M/148
- Article 31The article requires a controller to keep records of its personal data processing activities for a period set by the regulations, available to the competent authority on request, and sets their minimum content.
- Article 321- تقوم الجهة المختصة بإنشاء بوابة إلكترونية لغرض بناء سجل وطني عن جهات التحكم، تهدف إلى مراقبة ومتابعة التزام تلك الجهات بأحكام النظام…Repealed
- Article 33The article gives the competent authority the power to set requirements for data protection activities, license accreditation and audit bodies, and monitor compliance by bodies outside the Kingdom.Amended M/148
- Article 34The article gives the data subject the right to submit to the competent authority any complaint arising from the application of the Law and its regulations, and refers the rules for handling complaints to the regulations.
- Article 35The article punishes with imprisonment of up to two years and a fine of up to SAR 3 million, or either, anyone who discloses or publishes sensitive data in violation of the Law with intent to harm or for personal benefit.Amended M/148
- Article 36The article punishes any natural person or private legal entity that violates the Law or the regulations with a warning or a fine of up to SAR 5 million, through a committee whose decision can be challenged before the competent court.Amended M/148
- Article 37The article specifies who handles the detection of and inspection for violations of the Law and regulations, allows them to use criminal investigation bodies, and gives the competent authority the right to seize the means of the violation until it is decided.Amended M/148
- Article 38The article allows the court to confiscate funds obtained from violations of the Law without prejudice to the rights of good-faith third parties, and to publish a summary of the judgment or decision at the violator's expense once it becomes final.
- Article 39The article requires a public body to take disciplinary action against any of its personnel who violate the Law or the regulations, without prejudice to Article 35 and paragraph 1 of Article 36.
- Article 40The article gives anyone who suffers harm because the Law or the regulations were violated the right to claim before the competent court compensation for material or moral damage proportionate to its extent.
- Article 41The article requires everyone who has performed any personal data processing work to keep its secrets, and the obligation continues even after their employment or contractual relationship ends.
- Article 42The article tasks the head of the competent authority with issuing the regulations of the Law within no more than 720 days of its issuance, after coordinating with seven government bodies, each as it concerns them.Amended M/148
- Article 43The article provides that the Personal Data Protection Law takes effect 720 days after its publication in the Official Gazette.Amended M/148
A question about the Saudi Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Need a lawyer who knows the Saudi Personal Data Protection Law?
Describe your situation briefly and we'll suggest a lawyer who specialises in this law, free and with no commitment.