Article 2 of the Saudi Personal Data Protection Law
المادة 2 من نظام حماية البيانات الشخصية
The law applies to all processing of individuals' data in the Kingdom, and to processing by entities abroad of data of individuals residing in it; personal or family use is excluded unless the data is published or disclosed.
Official text (Arabic)
This article has not been amended since the law was issued.
1- يُطبق النظام على أي عملية مُعالجة لبيانات شخصية تتعلق بالأفراد تتم في المملكة بأي وسيلة كانت، بما في ذلك معالجة البيانات الشخصية المتعلقة بالأفراد المقيمين في المملكة بأي وسيلة كانت من أي جهة خارج المملكة. ويشمل ذلك بيانات المتوفى إذا كانت ستؤدي إلى معرفته أو معرفة أحد أفراد أُسرته على وجه التحديد.
2- يُستثنى من نطاق تطبيق النظام، قيام الفرد بمعالجة البيانات الشخصية لأغراض لا تتجاوز الاستخدام الشخصي أو العائلي، ما دام أنه لم ينشرها أو يفصح عنها للغير. وتحدد اللوائح المقصود بالاستخدام الشخصي والعائلي المنصوص عليهما في هذه الفقرة.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 2 explained in plain English
This article determines when the Personal Data Protection Law applies and when it does not.
First: scope of application. The law covers:
- Any processing of personal data relating to individuals that takes place inside the Kingdom, by any means.
- Processing of the personal data of individuals residing in the Kingdom if carried out by an entity outside the Kingdom, by any means.
- Data of a deceased person, if it would lead to identifying that person or a member of their family specifically.
Second: the exception. The law does not apply to an individual who processes personal data for purposes that do not go beyond personal or family use, provided they do not publish it or disclose it to others. If they publish it or disclose it, this exception falls away. The article left it to the implementing regulations to specify what is meant by personal and family use, so its limits should not be asserted before referring to them.
In practice, this means that companies and entities serving residents of the Kingdom are covered by the law even if based abroad. This article relies on the definitions of processing, disclosure and publishing in Article 1, while Article 3 provides that the law does not prejudice any better protection provided by another law or an international agreement to which the Kingdom is a party.
Practical example
A delivery app based outside the Kingdom collects the names, addresses and mobile numbers of customers who live in Riyadh. This processing is covered by the law because it relates to individuals residing in the Kingdom. Ahmed, however, who keeps pictures of his family and his relatives' numbers on his phone for personal use, is not subject to the law as long as he does not publish them or disclose them to others.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 2 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
International Law & Foreign Investment lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
International Law & Foreign Investment lawyers
Lawyers who handle this kind of case
Akbar Law Firm & Legal Consultancy
Dr. Saleh Altayyar & Partners Law Firm
Frequently asked questions about Article 2 of the Saudi Personal Data Protection Law
Does the Personal Data Protection Law apply to a company outside Saudi Arabia?
Yes, if it processes personal data of individuals residing in the Kingdom, by any means.
Does the law protect the data of a deceased person?
Yes. The law covers the data of a deceased person if it would lead to identifying that person or a member of their family specifically.
Is an individual subject to the law if they keep data for personal use?
No, as long as the processing does not go beyond personal or family use and the data is not published or disclosed to others; the regulations specify what this use means.
More articles on Scope of the Law and Definitions
- Article 1Amended by M/148
The article defines the key terms of the Personal Data Protection Law, such as personal data, sensitive data, processing, disclosure, controller and processor.
لغرض تطبيق هذا النظام، يُقصد بالألفاظ والعبارات الآتية -أينما وردت في هذا النظام- المعاني المبينة أمام كل منها، ما لم يقتضِ السياق غير ذلك: 1- النظام: نظام حماي
- Article 3
The law's provisions and procedures do not prejudice any provision in another law or an international agreement to which the Kingdom is a party that gives the data subject a right or provides better protection for their data.
لا تخل الأحكام والإجراءات المنصوص عليها في النظام بأي حكم يمنح حقًّا لصاحب البيانات الشخصية أو يقرر حماية أفضل لها، ينص عليه نظام آخر أو اتفاقية دولية تكون المم
- Article 43Amended by M/148
The article provides that the Personal Data Protection Law takes effect 720 days after its publication in the Official Gazette.
يُعمل بالنظام بعد (سبعمائة وعشرين) يوماً من التاريخ الذي نشر به في الجريدة الرسمية.
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.