Article 21 of the Saudi Personal Data Protection Law
المادة 21 من نظام حماية البيانات الشخصية
The article requires the controller to respond to the data subject's requests concerning their rights under the law within a specified period and by an appropriate means, which the regulations set.
Official text (Arabic)
This article has not been amended since the law was issued.
على جهة التحكم الاستجابة لطلبات صاحب البيانات الشخصية المتعلقة بحقوقه المنصوص عليها في النظام خلال مدة محددة وعبر وسيلة مناسبة تبينهما اللوائح.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 21 explained in plain English
The data subject's rights are incomplete if an entity can ignore their requests or delay them without limit. So this article establishes an express duty on the controller:
- Responding: The controller must respond to the data subject's requests concerning their rights stated in the law.
- Within a specified period: The response is not open-ended.
- By an appropriate means: That is, in a way that enables the data subject to submit their request and receive the reply.
But the article did not specify the length of the period or the type of means, and provided that the regulations set them. So no particular period should be assumed without referring to the regulations.
Note also that the duty to respond concerns requests relating to the rights stated in the law, and the article does not provide that responding necessarily means accepting every request; some rights in the law are restricted by other provisions.
This article comes after Article 20, which requires the controller to notify the competent authority and the data subject of a leak, damage or unlawful access to data, and before Article 22, which requires the controller to assess the effects of processing data for any product or service offered to the public. If an entity does not respond to your request, you can consult a lawyer specialized in personal data protection and cybercrime.
Practical example
Reem sent a request to an insurance company in Riyadh to correct her address recorded with it. The company must respond to her request within the period and by the means the regulations set, and may not leave the request unanswered indefinitely.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 21 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Cybercrime lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Cybercrime lawyers
Lawyers who handle this kind of case
Baker McKenzie
Frequently asked questions about Article 21 of the Saudi Personal Data Protection Law
How long does a company have to reply to my request about my data?
The article does not set the period, but provides that the response is within a specified period set by the regulations.
Must a company reply to my requests about my personal data?
Yes. The controller must respond to the data subject's requests concerning their rights stated in the law within a specified period and by an appropriate means.
More articles on Data Subject Rights
- Article 4Amended by M/148
The article gives the data subject five rights: to be informed, to access, to obtain a readable copy, to request correction, completion or updating, and to request destruction.
يكون لصاحب البيانات الشخصية -وفقاً للأحكام الواردة في النظام وما تحدده اللوائح- الحقوق الآتية: 1- الحق في العلم، ويشمل ذلك إحاطته علماً بالمسوغ النظامي لجمع بيا
- Article 5Amended by M/148
Personal data may not be processed, nor the purpose of processing changed, except with the data subject's consent, apart from cases the law provides, and the data subject may withdraw consent at any time.
1- فيما عدا الأحوال المنصوص عليها في النظام، لا تجوز معالجة البيانات الشخصية أو تغيير الغرض من معالجتها إلاَّ بعد موافقة صاحبها. وتُبين اللوائح شروط الموافقة، و
- Article 9Amended by M/148
The article lets the controller set periods for exercising the right of access and restrict it in certain cases, and requires it not to allow the data subject access in the cases specified in Article 16.
1- يجوز لجهة التحكم تحديد مدد لممارسة حق الوصول إلى البيانات الشخصية المقرر في الفقرة (2) من المادة (الرابعة) من النظام؛ وفق ما تحدده اللوائح. ويجوز كذلك لجهة ا
- Article 13Amended by M/148
When collecting data directly from its owner, the controller must inform them of seven elements, including the legal basis, the purpose, the identity of the collector and the entities to which the data will be disclosed.
على جهة التحكم، في حالة جمع البيانات الشخصية من صاحبها مباشرةً، اتخاذ الوسائل الكافية لإحاطته علماً بالعناصر الآتية عند جمع بياناته: 1- المسوغ النظامي لجمع بيان
- Article 17
If personal data is corrected, completed or updated, the controller must notify every entity to which the data was transferred of the change and make it available to it; the regulations set the periods and procedures.
1- إذا جرى تصحيح خطأ أو إكمال نقص أو إجراء تحديث في البيانات الشخصية، فعلى جهة التحكم أن تُشعر أي جهة أخرى انتقلت إليها تلك البيانات بأي تعديل يطرأ عليها، وأن ت
- Article 18Amended by M/148
The article requires the controller to destroy data without delay once its collection purpose ends, permits keeping it after removing what identifies its owner, and requires keeping it in two cases.
1- على جهة التحكم إتلاف البيانات الشخصية بعد انتهاء الغرض من جمعها دون تأخير. ومع ذلك، يجوز لها الاحتفاظ بتلك البيانات بعد انتهاء الغرض من جمعها إذا تمت إزالة ك
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.