Article 40 of the Saudi Personal Data Protection Law
المادة 40 من نظام حماية البيانات الشخصية
The article gives anyone who suffers harm because the Law or the regulations were violated the right to claim before the competent court compensation for material or moral damage proportionate to its extent.
Official text (Arabic)
This article has not been amended since the law was issued.
مع عدم الإخلال بإيقاع العقوبات المنصوص عليها في النظام، لمن لحقه ضرر -نتيجةَ ارتكاب أي من المخالفات المنصوص عليها في النظام أو اللوائح- حق المطالبة أمام المحكمة المختصة بالتعويض عن الضرر المادي أو المعنوي بما يتناسب مع حجم الضرر.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 40 explained in plain English
This article establishes the right to compensation for anyone harmed by violations of the Law, in addition to the penalties imposed on the violator.
Who has the right? "Anyone who suffers harm." The text does not limit the right to the data subject alone, but gives it to everyone who is harmed as a result of the violation.
Conditions for a claim:
- A violation of any provision of the Law or the regulations has occurred.
- Actual harm has occurred.
- The harm is the result of that violation.
Type of harm: compensation covers material damage (such as financial loss) and moral damage (such as psychological harm or damage to reputation).
Amount of compensation: it is proportionate to the extent of the harm, and the article does not specify an amount or a maximum.
Where to claim? Before the competent court.
Relationship to penalties: the article provides that this is "without prejudice to imposing the penalties stipulated in the Law," meaning that a ruling for compensation does not prevent punishing the violator, and imposing a penalty does not remove the harmed person's right to compensation. For example, Article 39 requires a public body to take disciplinary action against its personnel who violate, and this does not conflict with the harmed person's right to claim compensation.
Assessing whether harm exists, its extent and the causal link varies from case to case, so anyone considering a compensation claim is advised to consult a lawyer specialized in personal data protection and technology law.
Practical example
Khaled's data was leaked from a company in Riyadh because it violated the provisions of the Law, and it was used in a fraud that caused him a financial loss and psychological distress. Khaled has the right to claim before the competent court compensation for material and moral damage proportionate to the extent of his harm, and this does not prevent punishing the company under the Law.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 40 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Civil Litigation & Compensation lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Civil Litigation & Compensation lawyers
Lawyers who handle this kind of case
Dr. Ali Al-Rubaie Law Office and Ittihad Al-Asr Legal Company
Active contributor
Unwan Law Firm
Frequently asked questions about Article 40 of the Saudi Personal Data Protection Law
Can I claim compensation if my data was leaked because a company violated the Law?
Yes. Anyone who suffers harm as a result of violating the provisions of the Law or the regulations has the right to claim compensation for material or moral damage before the competent court.
Does compensation include psychological harm?
Yes. The article provides for compensation for material or moral damage in proportion to the extent of the harm.
Is compensation lost if the violating body is punished?
No. A claim for compensation is without prejudice to imposing the penalties stipulated in the Law.
More articles on Data Protection Violations and Penalties
- Article 35Amended by M/148
The article punishes with imprisonment of up to two years and a fine of up to SAR 3 million, or either, anyone who discloses or publishes sensitive data in violation of the Law with intent to harm or for personal benefit.
1- مع عدم الإخلال بأي عقوبة أشد منصوص عليها في نظام آخر، يُعاقب بالسجن مدة لا تزيد على (سنتين) وبغرامة لا تزيد على (ثلاثة ملايين) ريال، أو بإحدى هاتين العقوبتين
- Article 36Amended by M/148
The article punishes any natural person or private legal entity that violates the Law or the regulations with a warning or a fine of up to SAR 5 million, through a committee whose decision can be challenged before the competent court.
1- فيما لم يرد في شأنه نص خاص في المادة (الخامسة والثلاثين) من النظام، ودون إخلال بأيِّ عقوبة أشد منصوص عليها في نظام آخر؛ تُعاقَب بالإنذار أو بغرامة لا تزيد عل
- Article 37Amended by M/148
The article specifies who handles the detection of and inspection for violations of the Law and regulations, allows them to use criminal investigation bodies, and gives the competent authority the right to seize the means of the violation until it is decided.
1- يتولى الموظفون أو العاملون -الذين يصدر بتسميتهم قرار من رئيس الجهة المختصة- صلاحيات الضبط والتفتيش المتعلقة بالمخالفات المنصوص عليها في النظام أو اللوائح. وي
- Article 38
The article allows the court to confiscate funds obtained from violations of the Law without prejudice to the rights of good-faith third parties, and to publish a summary of the judgment or decision at the violator's expense once it becomes final.
1- مع عدم الإخلال بحقوق الغير حسن النية، يجوز للمحكمة المختصة الحكم بمصادرة الأموال المتحصلة من جراء ارتكاب المخالفات المنصوص عليها في النظام. 2- يجوز للمحكمة ا
- Article 39
The article requires a public body to take disciplinary action against any of its personnel who violate the Law or the regulations, without prejudice to Article 35 and paragraph 1 of Article 36.
دون إخلال بما ورد في المادة (الخامسة والثلاثين) والفقرة (1) من المادة (السادسة والثلاثين) من النظام، يجب على الجهة العامة مساءلة أي من منسوبيها -تأديبيًّا- في ح
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.