Article 39 of the Saudi Personal Data Protection Law
المادة 39 من نظام حماية البيانات الشخصية
The article requires a public body to take disciplinary action against any of its personnel who violate the Law or the regulations, without prejudice to Article 35 and paragraph 1 of Article 36.
Official text (Arabic)
This article has not been amended since the law was issued.
دون إخلال بما ورد في المادة (الخامسة والثلاثين) والفقرة (1) من المادة (السادسة والثلاثين) من النظام، يجب على الجهة العامة مساءلة أي من منسوبيها -تأديبيًّا- في حال مخالفته أيًّا من أحكام النظام واللوائح؛ وفق أحكام وإجراءات المساءلة والتأديب المقررة نظاماً.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 39 explained in plain English
This article deals with the position of personnel of public bodies who violate the provisions of the Law or the regulations.
The obligation: a public body must hold accountable through disciplinary action any employee or member of its personnel who violates any of the provisions of the Law and the regulations. The word "must" means that accountability is mandatory for the body and not left to its discretion.
How accountability is carried out: it is carried out under the accountability and disciplinary provisions and procedures prescribed by law. This article does not create new disciplinary penalties or special procedures, but refers to what is prescribed in the laws on accountability and discipline.
Relationship to other penalties: the article provides that this is without prejudice to what is stated in Article 35 and paragraph 1 of Article 36 of the Law. "Without prejudice" means that disciplinary accountability does not prevent the application of what those provisions prescribe when their conditions are met; it is added to them and does not replace them.
A violating member of a public body's personnel may therefore face two independent forms of accountability: disciplinary accountability within their body under this article, and whatever may follow under those articles.
In addition, Article 38 allows the competent court to rule to confiscate funds obtained from violations and to publish a summary of the judgment under its conditions.
Anyone harmed by a public employee's handling of their data, or an employee facing accountability, can consult a lawyer specialized in administrative cases and data protection.
Practical example
An employee at a government body viewed visitors' data and sent some of it to a person outside the body without a legal justification. The body must hold him accountable through disciplinary action under the disciplinary procedures prescribed by law, and this is without prejudice to what is stated in Article 35 and paragraph 1 of Article 36 of the Law.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 39 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Criminal Law lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Criminal Law lawyers
Lawyers who handle this kind of case
شركة امتداد النظام للمحاماة والاستشارات المهنية
- Labour & Employment Law
- Criminal Law
- Criminal Law
- Commercial & Corporate Law
Frequently asked questions about Article 39 of the Saudi Personal Data Protection Law
What happens to a government employee who violates the data protection law?
The public body must hold them accountable through disciplinary action under the accountability and disciplinary provisions and procedures prescribed by law.
Does disciplinary accountability prevent other penalties?
No. The article provides that accountability is without prejudice to what is stated in Article 35 and paragraph 1 of Article 36.
Is disciplinary accountability optional for the government body?
No. The text uses mandatory wording: the public body must hold its violating personnel accountable.
Articles this article refers to
- Article 35Amended by M/148
The article punishes with imprisonment of up to two years and a fine of up to SAR 3 million, or either, anyone who discloses or publishes sensitive data in violation of the Law with intent to harm or for personal benefit.
1- مع عدم الإخلال بأي عقوبة أشد منصوص عليها في نظام آخر، يُعاقب بالسجن مدة لا تزيد على (سنتين) وبغرامة لا تزيد على (ثلاثة ملايين) ريال، أو بإحدى هاتين العقوبتين
- Article 36Amended by M/148
The article punishes any natural person or private legal entity that violates the Law or the regulations with a warning or a fine of up to SAR 5 million, through a committee whose decision can be challenged before the competent court.
1- فيما لم يرد في شأنه نص خاص في المادة (الخامسة والثلاثين) من النظام، ودون إخلال بأيِّ عقوبة أشد منصوص عليها في نظام آخر؛ تُعاقَب بالإنذار أو بغرامة لا تزيد عل
More articles on Data Protection Violations and Penalties
- Article 35Amended by M/148
The article punishes with imprisonment of up to two years and a fine of up to SAR 3 million, or either, anyone who discloses or publishes sensitive data in violation of the Law with intent to harm or for personal benefit.
1- مع عدم الإخلال بأي عقوبة أشد منصوص عليها في نظام آخر، يُعاقب بالسجن مدة لا تزيد على (سنتين) وبغرامة لا تزيد على (ثلاثة ملايين) ريال، أو بإحدى هاتين العقوبتين
- Article 36Amended by M/148
The article punishes any natural person or private legal entity that violates the Law or the regulations with a warning or a fine of up to SAR 5 million, through a committee whose decision can be challenged before the competent court.
1- فيما لم يرد في شأنه نص خاص في المادة (الخامسة والثلاثين) من النظام، ودون إخلال بأيِّ عقوبة أشد منصوص عليها في نظام آخر؛ تُعاقَب بالإنذار أو بغرامة لا تزيد عل
- Article 37Amended by M/148
The article specifies who handles the detection of and inspection for violations of the Law and regulations, allows them to use criminal investigation bodies, and gives the competent authority the right to seize the means of the violation until it is decided.
1- يتولى الموظفون أو العاملون -الذين يصدر بتسميتهم قرار من رئيس الجهة المختصة- صلاحيات الضبط والتفتيش المتعلقة بالمخالفات المنصوص عليها في النظام أو اللوائح. وي
- Article 38
The article allows the court to confiscate funds obtained from violations of the Law without prejudice to the rights of good-faith third parties, and to publish a summary of the judgment or decision at the violator's expense once it becomes final.
1- مع عدم الإخلال بحقوق الغير حسن النية، يجوز للمحكمة المختصة الحكم بمصادرة الأموال المتحصلة من جراء ارتكاب المخالفات المنصوص عليها في النظام. 2- يجوز للمحكمة ا
- Article 40
The article gives anyone who suffers harm because the Law or the regulations were violated the right to claim before the competent court compensation for material or moral damage proportionate to its extent.
مع عدم الإخلال بإيقاع العقوبات المنصوص عليها في النظام، لمن لحقه ضرر -نتيجةَ ارتكاب أي من المخالفات المنصوص عليها في النظام أو اللوائح- حق المطالبة أمام المحكمة
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.